@amir83nasr/10router 0.1.10 → 0.1.12

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to 10Router will be documented in this file.
 
+## [0.1.12] — 2026-10-20
+
+- Fix: Claude Code routed through the `opencode` free lane failed tool calls with `400 unknown field "thinking"`. The OpenAI-dialect endpoint inherited the model's `zai`/`deepseek` capability thinking shape and sent `body.thinking`; the transport now declares `thinkingFormat: "openai"` (opencode, opencode-zen and opencode-go OpenAI transports) and `resolveFormat` prefers the transport matching the target format. Claude- and Gemini-format transports keep their native shape.
+- Fix: a stream that closed without `finish_reason` left the `tool_use` block open and the message unterminated, so the client dropped the turn as failed. The end-of-stream flush now closes open blocks, emits buffered tool arguments, and always sends `message_delta` + `message_stop`; truncated tool JSON degrades to `end_turn` instead of a broken `tool_use`.
+- Fix: empty `tool_result` content (empty array, image-only, or a missing response) was sent as `""` or `"[]"` and rejected by OpenAI-dialect upstreams with `Message content must contain text`. A shared `EMPTY_TOOL_RESULT` placeholder is now applied when converting Claude tool results, when backfilling missing tool responses, and in `filterToOpenAIFormat`.
+- Fix: the built-in chat page posted to `/api/dashboard/chat/completions`, a route that never existed, so every message 404'd. The route now delegates to `handleChat` and mints/reuses a local API key server-side; the page is reachable from the sidebar, renders markdown, and surfaces SSE error events.
+- Tests: `tests/unit/claude-code-tool-flow.test.js` covers the thinking wire format per provider/transport, stream finalize without `finish_reason`, truncated tool arguments, empty tool results, and the flush contract.
+
+## [0.1.11] — 2026-10-18
+
+- Fix: the CLI update notice never fired on networks that silently drop IPv6. `registry.npmjs.org` resolves to both A and AAAA records, so Node blackholes the first connection for ~10s before Happy Eyeballs falls back to IPv4, while the check aborted at 3s — a cold check routinely needs 2-14s. Measured 5/8 fetches and 1/12 notices here; the 10s budget now measures 8/8.
+- Fix: a failed check was never remembered, so every invocation re-paid the full timeout stall and then re-served the same stale version ("stale cache beats silence"). Failures are now recorded with a 10-minute cooldown (`FAIL_TTL`, mirroring `FAIL_TTL_MS` in `src/lib/versionCheck.js`), so an unreachable registry costs one stall per window instead of one per run, and a version published during the window still surfaces once the link recovers.
+- Tests: cover the failure memory (no retry inside the cooldown, retry past it) and the recovery path (a version published while the registry was down appears after the cooldown without waiting out `UPDATE_TTL`).
+
 ## [0.1.10] — 2026-10-18
 
 - Fix: every combo edit made from the dashboard failed with a 500 `Failed to update combo`. `PUT /api/combos/[id]` declared the parsed request body as `const` but reassigns it after cleaning the members array, so `Assignment to constant variable` was thrown inside the try and swallowed by the catch; only requests carrying `models` hit it, which is why name-only edits and combo creation worked. Introduced with the member-validation block in v0.1.9.

package/bin/update-check.mjs

@@ -12,6 +12,18 @@ import path from "node:path";
 // per hour of CLI use; offline stays fail-open via stale-cache fallback.
 export const UPDATE_TTL = 3600 * 1000;
 
+// The registry resolves to both A and AAAA records. On networks that drop
+// IPv6 silently, Node's first connection attempt blackholes for ~10s before
+// Happy Eyeballs falls back to IPv4, so a cold check routinely needs 2-14s.
+// The old 3s budget aborted nearly every check on such links (measured 5/8),
+// and the failure then re-served the stale version — so 0.1.10 never showed.
+// 10s measured 8/8 here; FAIL_TTL bounds what a genuinely offline run costs.
+const FETCH_TIMEOUT_MS = 10000;
+
+// A failed check is remembered, so a bad network costs one stall per window
+// instead of one per invocation. Mirrors FAIL_TTL_MS in src/lib/versionCheck.js.
+export const FAIL_TTL = 10 * 60 * 1000;
+
 export function cmpVer(a, b) {
   const pa = String(a).replace(/^v/, "").split("-")[0].split(".").map(Number);
   const pb = String(b).replace(/^v/, "").split("-")[0].split(".").map(Number);
@@ -28,7 +40,7 @@ export function cmpVer(a, b) {
 export async function fetchLatest(pkgName, fetchFn = fetch) {
   try {
     const r = await fetchFn(`https://registry.npmjs.org/${pkgName.replace("/", "%2F")}/latest`, {
-      signal: AbortSignal.timeout(3000),
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     });
     if (!r.ok) return null;
     return (await r.json())?.version || null;
@@ -73,15 +85,26 @@ export async function checkUpdate({
       latest = cached?.latest && now - (cached.checkedAt || 0) < UPDATE_TTL ? cached.latest : null;
     }
     if (!latest) {
-      latest = await fetchLatest(pkg.name, fetchFn);
-      if (latest) {
+      // A recent failure means the registry was unreachable: re-fetching would
+      // re-pay the full timeout stall on every invocation. Serve stale instead.
+      const cooling = now - (cached?.failedAt || 0) < FAIL_TTL;
+      latest = cooling ? cached?.latest || null : await fetchLatest(pkg.name, fetchFn);
+      if (!cooling) {
         try {
           fs.mkdirSync(dataDir, { recursive: true });
-          fs.writeFileSync(cacheFile, JSON.stringify({ latest, checkedAt: now }));
+          fs.writeFileSync(
+            cacheFile,
+            // On failure keep the last-known version but mark it stale, so the
+            // notice still fires from cache while the fetch is in cooldown.
+            latest
+              ? JSON.stringify({ latest, checkedAt: now })
+              : JSON.stringify({ latest: cached?.latest || null, checkedAt: 0, failedAt: now }),
+          );
         } catch {
           /* cache best-effort */
         }
-      } else latest = cached?.latest || null; // stale cache beats silence
+      }
+      if (!latest) latest = cached?.latest || null; // stale cache beats silence
     }
     if (!latest || cmpVer(pkg.version, latest) >= 0) return null;
     const ua = env.npm_config_user_agent || "";

package/open-sse/providers/registry/opencode-go.js

@@ -31,6 +31,9 @@ export default {
       format: "openai",
       baseUrl: "https://opencode.ai/inference/go/v1/chat/completions",
       auth: { combined: true, header: "Authorization", scheme: "bearer" },
+      // OpenAI dialect only: the gateway rejects `thinking`/`enable_thinking`
+      // (400 unknown field "thinking"), so normalize reasoning to reasoning_effort.
+      thinkingFormat: "openai",
     },
     {
       format: "claude",
@@ -41,6 +44,7 @@ export default {
       format: "openai-responses",
       baseUrl: "https://opencode.ai/inference/go/v1/responses",
       auth: { combined: true, header: "Authorization", scheme: "bearer" },
+      thinkingFormat: "openai",
     },
   ],
   // supportedFormats follow the endpoint table in https://opencode.ai/v2/docs/console/go

package/open-sse/providers/registry/opencode-zen.js

@@ -31,6 +31,9 @@ export default {
       format: "openai",
       baseUrl: "https://opencode.ai/inference/openai/v1/chat/completions",
       auth: { combined: true, header: "Authorization", scheme: "bearer" },
+      // OpenAI dialect only: the gateway rejects `thinking`/`enable_thinking`
+      // (400 unknown field "thinking"), so normalize reasoning to reasoning_effort.
+      thinkingFormat: "openai",
     },
     {
       format: "claude",
@@ -41,6 +44,7 @@ export default {
       format: "openai-responses",
       baseUrl: "https://opencode.ai/inference/openai/v1/responses",
       auth: { combined: true, header: "Authorization", scheme: "bearer" },
+      thinkingFormat: "openai",
     },
   ],
   // supportedFormats follow the per-model API families (chat completions /

package/open-sse/providers/registry/opencode.js

@@ -19,6 +19,9 @@ export default {
     },
     forceStream: true,
     noAuth: true,
+    // OpenAI dialect only: the gateway rejects `thinking`/`enable_thinking`
+    // (400 unknown field "thinking"), so normalize reasoning to reasoning_effort.
+    thinkingFormat: "openai",
     quirks: {
       forceAutoToolChoiceModels: [
         "muse-spark-1.2-contributor-free",

package/open-sse/translator/concerns/thinkingUnified.js

@@ -124,9 +124,24 @@ const NATIVE_ONLY_FORMATS = new Set([
   "kiro",
 ]); // "kiro" legacy (provider removed)
 
+// Provider/transport-level wire override. Multi-endpoint providers declare one
+// entry per endpoint format, so prefer the entry matching targetFormat; fall back
+// to the provider's default transport. The override describes an OpenAI-dialect
+// endpoint, so it only applies on OpenAI-family wires — a Claude/Gemini endpoint
+// keeps deriving its native thinking shape from the capabilities below.
+function providerThinkingFormat(provider, targetFormat) {
+  if (targetFormat !== "openai" && targetFormat !== "openai-responses") return null;
+  const cfg = provider ? PROVIDERS[provider] : null;
+  if (!cfg) return null;
+  const entry = Array.isArray(cfg.transports)
+    ? cfg.transports.find((t) => (t.format || "openai") === targetFormat) || cfg
+    : cfg;
+  return entry.thinkingFormat || null;
+}
+
 function resolveFormat(targetFormat, model, provider) {
   if (targetFormat === "commandcode") return "commandcode";
-  const providerFmt = provider ? PROVIDERS[provider]?.thinkingFormat : null;
+  const providerFmt = providerThinkingFormat(provider, targetFormat);
   if (providerFmt) return providerFmt;
   const caps = getCapabilitiesForModel(provider, model);
   const isOpenAIWire = targetFormat === "openai" || targetFormat === "openai-responses";

package/open-sse/translator/concerns/toolCall.js

@@ -1,6 +1,7 @@
 // Tool call helper functions for translator
 
 import { FORMATS } from "../formats.js";
+import { EMPTY_TOOL_RESULT } from "../schema/index.js";
 
 // Anthropic tool_use.id must match: ^[a-zA-Z0-9_-]+$
 const TOOL_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
@@ -147,7 +148,7 @@ export function fixMissingToolResponses(body) {
         newMessages.push({
           role: "tool",
           tool_call_id: id,
-          content: "",
+          content: EMPTY_TOOL_RESULT,
         });
       }
     }

package/open-sse/translator/formats/openai.js

@@ -5,6 +5,7 @@ import {
   CLAUDE_BLOCK,
   VALID_OPENAI_CONTENT_TYPES,
   VALID_OPENAI_MESSAGE_TYPES,
+  EMPTY_TOOL_RESULT,
 } from "../schema/index.js";
 
 // Re-export valid-type lists (moved to schema/blocks.js) to keep existing importers working.
@@ -26,8 +27,15 @@ export function filterToOpenAIFormat(body, opts = {}) {
     // Normalize developer role to system (many providers don't support developer)
     if (msg.role === ROLE.DEVELOPER) msg = { ...msg, role: ROLE.SYSTEM };
 
-    // Keep tool messages as-is (OpenAI format)
-    if (msg.role === ROLE.TOOL) return msg;
+    // Keep tool messages as-is (OpenAI format) — but an empty one is a 400 on
+    // several OpenAI-dialect upstreams ("Message content must contain text").
+    if (msg.role === ROLE.TOOL) {
+      const empty =
+        msg.content === "" ||
+        msg.content == null ||
+        (Array.isArray(msg.content) && msg.content.length === 0);
+      return empty ? { ...msg, content: EMPTY_TOOL_RESULT } : msg;
+    }
 
     // Keep assistant messages with tool_calls as-is
     if (msg.role === ROLE.ASSISTANT && msg.tool_calls) return msg;

package/open-sse/translator/request/claude-to-openai.js

@@ -2,7 +2,7 @@ import { register } from "../index.js";
 import { FORMATS } from "../formats.js";
 import { adjustMaxTokens } from "../formats/maxTokens.js";
 import { encodeDataUri } from "../concerns/image.js";
-import { ROLE, OPENAI_BLOCK, CLAUDE_BLOCK } from "../schema/index.js";
+import { ROLE, OPENAI_BLOCK, CLAUDE_BLOCK, EMPTY_TOOL_RESULT } from "../schema/index.js";
 import { collapseTextParts } from "../concerns/message.js";
 
 function stripAnthropicBillingHeader(text) {
@@ -62,7 +62,7 @@ export function claudeToOpenAIRequest(model, body, stream) {
   }
 
   // Fix missing tool responses - OpenAI requires every tool_call to have a response.
-  // Local variant: scans contiguous tool replies + inserts "[No response received]"
+  // Local variant: scans contiguous tool replies + inserts EMPTY_TOOL_RESULT
   // (distinct from the global immediate-next check in concerns/toolCall, runs on the openai leg).
   fixMissingToolResponsesOpenAI(result.messages);
 
@@ -123,7 +123,7 @@ function fixMissingToolResponsesOpenAI(messages) {
         const missingResponses = missingIds.map((id) => ({
           role: ROLE.TOOL,
           tool_call_id: id,
-          content: "[No response received]",
+          content: EMPTY_TOOL_RESULT,
         }));
         messages.splice(insertPosition, 0, ...missingResponses);
         i = insertPosition + missingResponses.length - 1;
@@ -216,7 +216,9 @@ function convertClaudeMessage(msg) {
             const textOnly = block.content.filter((c) => c?.type === CLAUDE_BLOCK.TEXT);
             resultContent =
               textOnly.map((c) => c.text).join("\n") ||
-              (resultImages.length ? "" : JSON.stringify(block.content));
+              (resultImages.length || block.content.length === 0
+                ? ""
+                : JSON.stringify(block.content));
           } else if (block.content) {
             resultContent = JSON.stringify(block.content);
           }
@@ -224,7 +226,9 @@ function convertClaudeMessage(msg) {
           toolResults.push({
             role: ROLE.TOOL,
             tool_call_id: block.tool_use_id,
-            content: resultContent,
+            // Empty content is a 400 on several OpenAI-dialect upstreams
+            // ("Message content must contain text"); keep a placeholder.
+            content: resultContent || EMPTY_TOOL_RESULT,
           });
           // The OpenAI tool role is text-only, so a screenshot or any other image a
           // tool returned would otherwise vanish. Hand it to the model in the user

package/open-sse/translator/response/openai-to-claude.js

@@ -70,9 +70,73 @@ function stopTextBlock(state, results) {
   state.textBlockStarted = false;
 }
 
+// Buffered tool args parse as JSON → safe to hand the client a tool_use finish.
+function bufferedArgsComplete(state) {
+  for (const [idx] of state.toolCalls) {
+    const buffered = state.toolArgBuffers?.get(idx);
+    if (!buffered) continue;
+    try {
+      JSON.parse(buffered);
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+// Close every open block, flush tool args, then message_delta + message_stop.
+// Shared by the finish_reason path and the end-of-stream flush so a stream that
+// dies without a finish chunk still terminates instead of truncating the turn.
+function emitMessageFinish(state, results, reason) {
+  if (state.claudeFinishEmitted) return;
+  state.claudeFinishEmitted = true;
+
+  stopThinkingBlock(state, results);
+  stopTextBlock(state, results);
+
+  for (const [idx, toolInfo] of state.toolCalls) {
+    // Emit buffered + sanitized args as single delta before stop
+    const buffered = state.toolArgBuffers?.get(idx);
+    if (buffered) {
+      const sanitized = sanitizeToolArgs(toolInfo.name, buffered);
+      results.push({
+        type: "content_block_delta",
+        index: toolInfo.blockIndex,
+        delta: { type: "input_json_delta", partial_json: sanitized },
+      });
+    }
+    results.push({
+      type: "content_block_stop",
+      index: toolInfo.blockIndex,
+    });
+  }
+
+  // Mark finish for later usage injection in stream.js
+  state.finishReason = reason;
+
+  // Use tracked usage (will be estimated in stream.js if not valid)
+  const finalUsage = state.usage || { input_tokens: 0, output_tokens: 0 };
+  results.push({
+    type: "message_delta",
+    delta: { stop_reason: convertFinishReason(reason) },
+    usage: finalUsage,
+  });
+  results.push({ type: "message_stop" });
+}
+
 // Convert OpenAI stream chunk to Claude format
 export function openaiToClaudeResponse(chunk, state) {
-  if (!chunk || !chunk.choices?.[0]) return null;
+  // End-of-stream flush (stream.js calls the translator with chunk=null): the
+  // upstream can close right after a tool-call delta without ever sending
+  // finish_reason, which used to leave the client with an unterminated message.
+  if (!chunk) {
+    if (!state.messageStartSent || state.claudeFinishEmitted) return null;
+    const results = [];
+    const reason = state.toolCalls.size > 0 && bufferedArgsComplete(state) ? "tool_calls" : "stop";
+    emitMessageFinish(state, results, reason);
+    return results;
+  }
+  if (!chunk.choices?.[0]) return null;
 
   const results = [];
   const choice = chunk.choices[0];
@@ -234,37 +298,7 @@ export function openaiToClaudeResponse(chunk, state) {
 
   // Finish
   if (choice.finish_reason) {
-    stopThinkingBlock(state, results);
-    stopTextBlock(state, results);
-
-    for (const [idx, toolInfo] of state.toolCalls) {
-      // Emit buffered + sanitized args as single delta before stop
-      const buffered = state.toolArgBuffers?.get(idx);
-      if (buffered) {
-        const sanitized = sanitizeToolArgs(toolInfo.name, buffered);
-        results.push({
-          type: "content_block_delta",
-          index: toolInfo.blockIndex,
-          delta: { type: "input_json_delta", partial_json: sanitized },
-        });
-      }
-      results.push({
-        type: "content_block_stop",
-        index: toolInfo.blockIndex,
-      });
-    }
-
-    // Mark finish for later usage injection in stream.js
-    state.finishReason = choice.finish_reason;
-
-    // Use tracked usage (will be estimated in stream.js if not valid)
-    const finalUsage = state.usage || { input_tokens: 0, output_tokens: 0 };
-    results.push({
-      type: "message_delta",
-      delta: { stop_reason: convertFinishReason(choice.finish_reason) },
-      usage: finalUsage,
-    });
-    results.push({ type: "message_stop" });
+    emitMessageFinish(state, results, choice.finish_reason);
   }
 
   return results.length > 0 ? results : null;

package/open-sse/translator/schema/defaults.js

@@ -5,3 +5,9 @@ export const MODEL_FALLBACK = "unknown";
 
 // Default image mime when source omits it (base64 blobs without a declared type).
 export const DEFAULT_IMAGE_MIME = "image/png";
+
+// Placeholder for a tool result with no text (image-only, empty array, or a
+// missing response). OpenAI-dialect wires reject `role:"tool"` with empty
+// content. Deliberately not JSON-shaped: a leading "[" reads as a raw-JSON
+// stringification bug to callers inspecting the bridge.
+export const EMPTY_TOOL_RESULT = "(no output)";

package/open-sse/translator/schema/index.js

@@ -8,4 +8,4 @@ export {
   VALID_OPENAI_MESSAGE_TYPES,
 } from "./blocks.js";
 export { OPENAI_FINISH, CLAUDE_STOP, GEMINI_FINISH } from "./finishReasons.js";
-export { MODEL_FALLBACK, DEFAULT_IMAGE_MIME } from "./defaults.js";
+export { MODEL_FALLBACK, DEFAULT_IMAGE_MIME, EMPTY_TOOL_RESULT } from "./defaults.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amir83nasr/10router",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Amir83Nasr/10Router.git"
@@ -62,6 +62,7 @@
     "class-variance-authority": "^0.7.1",
     "cn": "^0.3.0",
     "confbox": "^0.2.4",
+    "dompurify": "^3.2.7",
     "jose": "^6.1.3",
     "lucide-react": "^1.47.0",
     "marked": "^18.0.1",

package/src/app/(dashboard)/dashboard/basic-chat/BasicChatPageClient.tsx

@@ -2,6 +2,8 @@
 import Icon from "@/shared/components/Icon";
 
 import { useEffect, useMemo, useRef, useState } from "react";
+import DOMPurify from "dompurify";
+import { marked } from "marked";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { getModelsByProviderId } from "@/shared/constants/models";
@@ -10,6 +12,8 @@ import {
   isOpenAICompatibleProvider,
 } from "@/shared/constants/providers";
 
+marked.setOptions({ gfm: true, breaks: true });
+
 const STORAGE_KEYS = {
   sessions: "basic-chat.sessions",
   activeSessionId: "basic-chat.activeSessionId",
@@ -100,6 +104,28 @@ function readAssistantText(chunk) {
   return pieces[0] || "";
 }
 
+// Errors arrive as SSE events (`{ error }` or a Responses-style `{ type: "error" }`)
+// with no choices; the content-only parse would drop them and end the turn empty.
+function readChunkError(chunk) {
+  if (!chunk || typeof chunk !== "object") return "";
+  if (chunk.error) return textValue(chunk.error) || "Request failed";
+  if (chunk.type === "error") return textValue(chunk.message) || "Request failed";
+  return "";
+}
+
+function MarkdownMessage({ text }) {
+  const raw = textValue(text);
+  const html = useMemo(() => {
+    if (!raw) return "";
+    // DOMPurify needs a DOM; the server render has none (sessions hydrate from storage).
+    if (typeof window === "undefined") return null;
+    return DOMPurify.sanitize(marked.parse(raw, { async: false }));
+  }, [raw]);
+
+  if (html === null) return <span className="whitespace-pre-wrap break-words">{raw}</span>;
+  return <div className="chat-markdown break-words" dangerouslySetInnerHTML={{ __html: html }} />;
+}
+
 async function fileToDataUrl(file) {
   return await new Promise((resolve, reject) => {
     const reader = new FileReader();
@@ -747,6 +773,7 @@ export default function BasicChatPageClient() {
       const decoder = new TextDecoder();
       let buffer = "";
       let assistantText = "";
+      let streamError = "";
 
       while (true) {
         const { value, done } = await reader.read();
@@ -765,6 +792,12 @@ export default function BasicChatPageClient() {
 
           try {
             const chunk = JSON.parse(payload);
+            const chunkError = readChunkError(chunk);
+            if (chunkError) {
+              streamError = chunkError;
+              continue;
+            }
+
             const text = readAssistantText(chunk);
             if (!text) continue;
 
@@ -787,13 +820,16 @@ export default function BasicChatPageClient() {
 
       updateSession(sessionId, (currentSession) => ({
         ...currentSession,
-        messages: currentSession.messages.map((message) =>
-          message.id === assistantMessageId
-            ? { ...message, content: assistantText || message.content, status: "done" }
-            : message,
-        ),
+        messages: currentSession.messages.map((message) => {
+          if (message.id !== assistantMessageId) return message;
+          if (!assistantText && streamError) {
+            return { ...message, content: message.content || streamError, status: "error" };
+          }
+          return { ...message, content: assistantText || message.content, status: "done" };
+        }),
         updatedAt: new Date().toISOString(),
       }));
+      if (!assistantText && streamError) setLoadError(streamError);
       finalizeSessionTitle(sessionId, userText);
     } catch (error) {
       if (error.name !== "AbortError") {
@@ -1036,8 +1072,10 @@ export default function BasicChatPageClient() {
                         </div>
                       ) : null}
 
-                      <div className="whitespace-pre-wrap break-words text-[15px] leading-7">
-                        {content}
+                      <div
+                        className={`break-words text-[15px] leading-7 ${isAssistant ? "" : "whitespace-pre-wrap"}`}
+                      >
+                        {isAssistant ? <MarkdownMessage text={content} /> : content}
                         {isAssistant && isStreaming && !streamingText ? (
                           <span className="inline-block animate-pulse">▋</span>
                         ) : null}

package/src/app/api/dashboard/chat/completions/route.ts

@@ -0,0 +1,45 @@
+import { handleChat } from "@/sse/handlers/chat.js";
+import { getApiKeys, createApiKey } from "@/lib/localDb";
+import { getConsistentMachineId } from "@/shared/utils/machineId";
+
+export const dynamic = "force-dynamic";
+
+// The browser only holds the dashboard JWT. The LLM handler still enforces
+// requireApiKey, so reuse (or mint) a local key server-side; it never reaches the client.
+async function getInternalApiKey(): Promise<string> {
+  const keys = await getApiKeys();
+  const active = keys.find((k) => k.isActive !== false);
+  if (active) return active.key;
+  const created = await createApiKey("Default Key", await getConsistentMachineId());
+  return created.key;
+}
+
+export async function POST(request: Request) {
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  let apiKey: string;
+  try {
+    apiKey = await getInternalApiKey();
+  } catch {
+    return Response.json({ error: "Failed to prepare API key" }, { status: 500 });
+  }
+
+  // Only the body matters here; forwarding the browser's headers would also hand
+  // cookies/origin to upstream executors that read rawHeaders.
+  const upstreamRequest = new Request(request.url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+    },
+    body: JSON.stringify(body),
+    signal: request.signal,
+  });
+
+  return handleChat(upstreamRequest);
+}

package/src/app/globals.css

@@ -300,57 +300,98 @@
 }
 
 /* ── MARKDOWN BODY ─────────────────────────────────────── */
-/* Changelog modal markdown. Scoped to ChangelogModal. */
-.changelog-body h1 {
+/* Shared by the changelog modal and chat assistant messages. */
+:is(.changelog-body, .chat-markdown) h1 {
   font-size: 1.4rem;
   font-weight: 700;
   margin: 1.5rem 0 0.75rem;
   padding-bottom: 0.5rem;
   border-bottom: 1px solid var(--border);
 }
-.changelog-body h1:first-child {
+:is(.changelog-body, .chat-markdown) h1:first-child {
   margin-top: 0;
 }
-.changelog-body h2 {
+:is(.changelog-body, .chat-markdown) h2 {
   font-size: 1.3rem;
   font-weight: 700;
   margin: 2.25rem 0 0.6rem;
-  color: var(--primary);
 }
-.changelog-body h2:first-child {
+:is(.changelog-body, .chat-markdown) h2:first-child {
   margin-top: 0;
 }
-.changelog-body h3 {
+/* Changelog headings use --primary; chat keeps inherited color (its panel is always dark). */
+.changelog-body h2 {
+  color: var(--primary);
+}
+:is(.changelog-body, .chat-markdown) h3 {
   font-size: 0.95rem;
   font-weight: 600;
   margin: 0.75rem 0 0.4rem;
 }
-.changelog-body ul {
+:is(.changelog-body, .chat-markdown) ul {
   list-style: disc;
   padding-left: 1.5rem;
   margin: 0.5rem 0;
 }
-.changelog-body li {
+:is(.changelog-body, .chat-markdown) ol {
+  list-style: decimal;
+  padding-left: 1.5rem;
+  margin: 0.5rem 0;
+}
+:is(.changelog-body, .chat-markdown) li {
   margin: 0.25rem 0;
   line-height: 1.6;
 }
-.changelog-body p {
+:is(.changelog-body, .chat-markdown) p {
   margin: 0.5rem 0;
   line-height: 1.6;
 }
-.changelog-body code {
+:is(.changelog-body, .chat-markdown) code {
   background: var(--muted);
   padding: 0.1rem 0.35rem;
   border-radius: 4px;
   font-size: 0.875em;
   font-family: ui-monospace, monospace;
 }
-.changelog-body a {
+:is(.changelog-body, .chat-markdown) pre {
+  background: var(--muted);
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  padding: 0.75rem 1rem;
+  margin: 0.75rem 0;
+  overflow-x: auto;
+}
+:is(.changelog-body, .chat-markdown) pre code {
+  background: none;
+  padding: 0;
+  border-radius: 0;
+  font-size: 0.85em;
+  line-height: 1.55;
+}
+:is(.changelog-body, .chat-markdown) a {
   color: var(--primary);
   text-decoration: underline;
 }
-.changelog-body hr {
+:is(.changelog-body, .chat-markdown) hr {
   border: none;
   border-top: 1px solid var(--border);
   margin: 1.5rem 0;
 }
+
+/* Chat panel is always dark (#212121), so theme tokens resolve to light values there. */
+.chat-markdown h1 {
+  border-bottom-color: rgba(255, 255, 255, 0.15);
+}
+.chat-markdown code {
+  background: rgba(255, 255, 255, 0.1);
+}
+.chat-markdown pre {
+  background: rgba(0, 0, 0, 0.35);
+  border-color: rgba(255, 255, 255, 0.12);
+}
+.chat-markdown a {
+  color: #7cc4ff;
+}
+.chat-markdown hr {
+  border-top-color: rgba(255, 255, 255, 0.15);
+}