From 5fdbc3ab7993107424ec2a03182c69fa7c2ed458 Mon Sep 17 00:00:00 2001 From: eric Date: Mon, 1 Jun 2026 08:27:00 -0700 Subject: [PATCH] [eric] router: revert dev pin to 0.3.60 (0.4.x adds an api auth gate that 401s our oauth/provider-sync calls, breaking every subscription connect); documented what porting the bump needs --- backend/apps/nine_router/process.py | 37 ++++++++++++++++------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/backend/apps/nine_router/process.py b/backend/apps/nine_router/process.py index ca346a9f..4117f108 100644 --- a/backend/apps/nine_router/process.py +++ b/backend/apps/nine_router/process.py @@ -27,31 +27,34 @@ NINE_ROUTER_URL = f"http://localhost:{NINE_ROUTER_PORT}" NINE_ROUTER_API = f"{NINE_ROUTER_URL}/api" NINE_ROUTER_V1 = f"{NINE_ROUTER_URL}/v1" -# Pinned 9router npm package version. +# Pinned 9router npm package version. Stays at 0.3.60. # -# TEST BUMP (eric/hardening): 0.3.60 -> 0.4.66 to evaluate whether the newer -# router (a) fixes the cross-provider WebSearch regression and (b) unlocks the -# subscription routes 0.3.60 can't serve. Confirmed empirically on a booted -# 0.4.66 instance: it exposes cc/claude-opus-4-8 and cx/gpt-5.5 (the latter -# 404'd on 0.3.60), and it reworked WebSearch behind a NEW /api/v1/search route -# that didn't exist in 0.3.x. Gemini 3.5 Flash is Antigravity-only there -# (ag/gemini-3.5-flash-low), not on the gc/ Gemini-CLI lane. +# DO NOT bump to 0.4.x without porting 9Router API auth first. Tested 0.4.66 +# empirically (2026-06-01): it adds an auth gate to its internal /api/* routes, +# so the endpoints our connect/sync flow calls without a token now 401 instead +# of working: +# endpoint 0.3.60 0.4.66 +# /api/oauth//device-code 400 401 Unauthorized +# POST /api/providers 400 401 Unauthorized +# That 401 makes start_oauth() throw, which 500s EVERY subscription connect +# (Claude/Codex/Gemini). oauth.py + sync.py would each need to discover and +# send 9Router 0.4.x's API token on every /api/* call before a bump is viable. # -# The original reason for the 0.3.60 pin (kept for history): versions between -# 0.3.60 and 0.3.96 regressed cross-provider WebSearch, so a Codex/Gemini -# primary delegating WebSearch saw "claude-haiku-4-5-20251001 unavailable" or -# hallucinated output. That note only ever covered up to 0.3.96; 0.4.x was -# never tested, and the /api/v1/search rework may well have fixed it. DO NOT -# ship this bump to prod until WebSearch is verified live on a non-Claude -# primary (run.sh + a connected Codex/Gemini sub); revert to "0.3.60" if it -# still misbehaves. +# What the bump WOULD buy once auth is ported: cc/claude-opus-4-8 and cx/gpt-5.5 +# on the sub routes (gpt-5.5 404s on 0.3.60), and a reworked WebSearch behind a +# new /api/v1/search route. Gemini 3.5 Flash is Antigravity-only there +# (ag/gemini-3.5-flash-low), never on the gc/ Gemini-CLI lane. +# +# Original 0.3.60 pin reason (still holds): versions 0.3.60-0.3.96 regressed +# cross-provider WebSearch (a Codex/Gemini primary delegating WebSearch saw +# "claude-haiku-4-5-20251001 unavailable" or hallucinated output). # # Note: 0.3.60-0.4.20 ALL emit `max_tokens` (not max_completion_tokens) # when translating Anthropic->OpenAI, which OpenAI's GPT-5 family rejects. # The fix lives in our /api/openai-passthrough proxy; see core/openai_passthrough.py # and sync_openai_api_key for how the translation lane is rerouted via an # `openai-compatible` provider-node that honors `baseUrl`. -NINE_ROUTER_NPM_VERSION = "0.4.66" +NINE_ROUTER_NPM_VERSION = "0.3.60" _process: subprocess.Popen | None = None