feat(release): v2.3.14 — iFlow fix, MITM compile, GeminiCLI fallback, new models, tier scoring API

- fix(oauth): restore iFlow clientSecret default — was empty string, now uses the valid public key (#339)
- fix(mitm): compile src/mitm/*.ts to JS during prepublish so server.js exists in npm bundle (#335)
- fix(gemini-cli): graceful projectId fallback — warn + empty string instead of hard 500 error (#338)
- feat(models): add gpt5.4 to Codex; add claude-sonnet-4, claude-opus-4.6, deepseek-v3.2, minimax-m2.1, qwen3-coder-next, auto to Kiro (#334)
- fix(electron): sync electron/package.json version to 2.3.13 (#323)
- feat(scoring): add tierPriority (0.05) to ScoringWeights Zod schema and combos/auto API route

CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog
 
-## [2.3.13] - 2026-03-12
+## [2.3.14] - 2026-03-13
+
+### 🐛 Bug Fixes
+
+- **iFlow OAuth (#339)**: Restored the valid default `clientSecret` — was previously an empty string, causing "Bad client credentials" on every connect attempt. The public credential is now the default fallback (overridable via `IFLOW_OAUTH_CLIENT_SECRET` env var).
+- **MITM server not found (#335)**: `prepublish.mjs` now compiles `src/mitm/*.ts` to JavaScript using `tsc` before copying to the npm bundle. Previously only raw `.ts` files were copied — meaning `server.js` never existed in npm/Volta global installs.
+- **GeminiCLI missing projectId (#338)**: Instead of throwing a hard 500 error when `projectId` is missing from stored credentials (e.g. after Docker restart), OmniRoute now logs a warning and attempts the request — returning a meaningful provider-side error instead of an OmniRoute crash.
+- **Electron version mismatch (#323)**: Synced `electron/package.json` version to `2.3.13` (was `2.0.13`) so the desktop binary version matches the npm package.
+
+### ✨ New Models (#334)
+
+- **Kiro**: `claude-sonnet-4`, `claude-opus-4.6`, `deepseek-v3.2`, `minimax-m2.1`, `qwen3-coder-next`, `auto`
+- **Codex**: `gpt5.4`
+
+### 🔧 Improvements
+
+- **Tier Scoring (API + Validation)**: Added `tierPriority` (weight `0.05`) to the `ScoringWeights` Zod schema and the `combos/auto` API route — the 7th scoring factor is now fully accepted by the REST API and validated on input. `stability` weight adjusted from `0.10` to `0.05` to keep total sum = `1.0`.
 
 ### ✨ New Features
 

electron/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute-desktop",
-  "version": "2.0.13",
+  "version": "2.3.13",
   "description": "OmniRoute Desktop Application",
   "main": "main.js",
   "author": {

open-sse/translator/request/openai-to-gemini.ts

@@ -320,12 +320,17 @@ export function openaiToGeminiCLIRequest(model, body, stream) {
 
 // Wrap Gemini CLI format in Cloud Code wrapper
 function wrapInCloudCodeEnvelope(model, geminiCLI, credentials = null, isAntigravity = false) {
-  const projectId = credentials?.projectId;
+  let projectId = credentials?.projectId;
 
   if (!projectId) {
-    throw new Error(
-      `${isAntigravity ? "Antigravity" : "GeminiCLI"} account is missing projectId. Reconnect OAuth to load your real Cloud Code project before sending requests.`
+    // Graceful fallback: warn instead of hard-throw so the request reaches
+    // the provider and fails with a meaningful provider-side error (#338).
+    // Users who reconnect OAuth will get their real projectId loaded.
+    console.warn(
+      `[OmniRoute] ${isAntigravity ? "Antigravity" : "GeminiCLI"} account is missing projectId. ` +
+        `Attempting request with empty project — reconnect OAuth to resolve.`
     );
+    projectId = "";
   }
 
   const cleanModel = model.includes("/") ? model.split("/").pop()! : model;
@@ -371,12 +376,14 @@ function wrapInCloudCodeEnvelope(model, geminiCLI, credentials = null, isAntigra
 }
 
 function wrapInCloudCodeEnvelopeForClaude(model, claudeRequest, credentials = null) {
-  const projectId = credentials?.projectId;
+  let projectId = credentials?.projectId;
 
   if (!projectId) {
-    throw new Error(
-      "Antigravity/Claude account is missing projectId. Reconnect OAuth to load your real Cloud Code project before sending requests."
+    console.warn(
+      `[OmniRoute] Antigravity/Claude account is missing projectId. ` +
+        `Attempting request with empty project — reconnect OAuth to resolve.`
     );
+    projectId = "";
   }
 
   const cleanModel = model.includes("/") ? model.split("/").pop()! : model;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "2.3.12",
+  "version": "2.3.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "2.3.12",
+      "version": "2.3.13",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [

package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "2.3.13",
+  "version": "2.3.14",
   "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
   "type": "module",
   "bin": {

scripts/prepublish.mjs

@@ -101,13 +101,42 @@ if (existsSync(publicSrc)) {
   cpSync(publicSrc, publicDest, { recursive: true });
 }
 
-// ── Step 8: Copy MITM cert utilities (if needed) ───────────
+// ── Step 8: Compile + copy MITM cert utilities ─────────────
 const mitmSrc = join(ROOT, "src", "mitm");
 const mitmDest = join(APP_DIR, "src", "mitm");
 if (existsSync(mitmSrc)) {
-  console.log("  📋 Copying MITM utilities...");
+  console.log("  🔨 Compiling MITM utilities (TypeScript → JavaScript)...");
   mkdirSync(mitmDest, { recursive: true });
-  cpSync(mitmSrc, mitmDest, { recursive: true });
+
+  // Write a temporary tsconfig.json targeting the mitm directory
+  const mitmTsconfig = {
+    compilerOptions: {
+      target: "ES2020",
+      module: "CommonJS",
+      outDir: mitmDest,
+      rootDir: mitmSrc,
+      resolveJsonModule: true,
+      esModuleInterop: true,
+      skipLibCheck: true,
+    },
+    include: [mitmSrc + "/**/*"],
+  };
+  const tmpTsconfigPath = join(ROOT, "tsconfig.mitm.tmp.json");
+  writeFileSync(tmpTsconfigPath, JSON.stringify(mitmTsconfig, null, 2));
+
+  try {
+    execSync(`npx tsc -p ${tmpTsconfigPath}`, { cwd: ROOT, stdio: "inherit" });
+    console.log("  ✅ MITM utilities compiled to app/src/mitm/");
+  } catch (err) {
+    console.warn("  ⚠️  MITM compile warning (non-fatal):", err.message);
+    // Fallback: copy source files so at least they are present
+    cpSync(mitmSrc, mitmDest, { recursive: true });
+  } finally {
+    // Cleanup temp tsconfig
+    try {
+      rmSync(tmpTsconfigPath);
+    } catch {}
+  }
 }
 
 // ── Step 9: Copy shared utilities needed at runtime ────────

src/app/api/combos/auto/route.ts

@@ -22,6 +22,7 @@ interface ScoringWeights {
   latencyInv: number;
   taskFit: number;
   stability: number;
+  tierPriority: number;
 }
 
 const DEFAULT_WEIGHTS: ScoringWeights = {
@@ -30,7 +31,8 @@ const DEFAULT_WEIGHTS: ScoringWeights = {
   costInv: 0.2,
   latencyInv: 0.15,
   taskFit: 0.1,
-  stability: 0.1,
+  stability: 0.05,
+  tierPriority: 0.05,
 };
 
 interface AutoComboConfig {

src/lib/oauth/constants/oauth.ts

@@ -67,7 +67,7 @@ export const QWEN_CONFIG = {
 // iFlow OAuth Configuration (Authorization Code)
 export const IFLOW_CONFIG = {
   clientId: process.env.IFLOW_OAUTH_CLIENT_ID || "10009311001",
-  clientSecret: process.env.IFLOW_OAUTH_CLIENT_SECRET || "",
+  clientSecret: process.env.IFLOW_OAUTH_CLIENT_SECRET || "4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW",
   authorizeUrl: "https://iflow.cn/oauth",
   tokenUrl: "https://iflow.cn/oauth/token",
   userInfoUrl: "https://iflow.cn/api/oauth/getUserInfo",

src/shared/constants/pricing.ts

@@ -32,6 +32,14 @@ export const DEFAULT_PRICING = {
 
   // OpenAI Codex (cx)
   cx: {
+    // Issue #334: add gpt5.4
+    "gpt5.4": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
     "gpt-5.2-codex": {
       input: 5.0,
       output: 20.0,
@@ -39,6 +47,7 @@ export const DEFAULT_PRICING = {
       reasoning: 30.0,
       cache_creation: 5.0,
     },
+
     "gpt-5.2": {
       input: 5.0,
       output: 20.0,
@@ -764,6 +773,50 @@ export const DEFAULT_PRICING = {
       reasoning: 2.5,
       cache_creation: 0.5,
     },
+    // Models from issue #334
+    "claude-sonnet-4": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    "claude-opus-4.6": {
+      input: 15.0,
+      output: 75.0,
+      cached: 7.5,
+      reasoning: 75.0,
+      cache_creation: 15.0,
+    },
+    "deepseek-v3.2": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 1.1,
+      cache_creation: 0.27,
+    },
+    "minimax-m2.1": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.1,
+      reasoning: 1.6,
+      cache_creation: 0.4,
+    },
+    "qwen3-coder-next": {
+      input: 2.0,
+      output: 8.0,
+      cached: 0.5,
+      reasoning: 8.0,
+      cache_creation: 2.0,
+    },
+    // Kiro "Auto" model — routes to best available
+    auto: {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
   },
 };
 

src/shared/validation/schemas.ts

@@ -89,6 +89,7 @@ const scoringWeightsSchema = z
     latencyInv: z.number().min(0).max(1),
     taskFit: z.number().min(0).max(1),
     stability: z.number().min(0).max(1),
+    tierPriority: z.number().min(0).max(1).optional().default(0.05),
   })
   .optional();