Shkarko CLI Proxy API 7.3.0

Linux release assets
- CLIProxyAPI_<version>_linux_<arch>.tar.gz is the default Linux build. It supports dynamic library plugins and is built against a GLIBC 2.17 baseline.
- CLIProxyAPI_<version>_linux_<arch>_no-plugin.tar.gz is the portable Linux build for musl-based or older systems such as OpenWrt. It does not support dynamic library plugins.
FreeBSD release assets
- CLIProxyAPI_<version>_freebsd_aarch64_no-plugin.tar.gz is the FreeBSD arm64 build. It is built without CGO and does not support dynamic library plugins.
Changelog
- feat(codex): forward X-Codex-Turn-State header in executor requests (e696ea47)
- feat(codex): preserve native fidelity for responses-lite requests (f702bc1a)
- feat(cooldowns): add cooldown snapshot feature for management auth files (1ca975df)
- docs(config): document payload filter examples for codex tools (94d6eb53)
- Merge pull request #5795 from router-for-me/feat/management-auth-cooldowns (d23ba5ee)
- feat(devin): add Devin/Cognition provider integration and CLI OAuth (f9475276)
- feat(devin): bind upstream session_id and cascade_id to CPA canonical session (cbe800aa)
- feat(devin): prefix all Devin model IDs with devin/ namespace (eed24907)
- feat(devin): restrict glm-5-2 to free tier, remove static swe-1-7-lightning, and harden cloak (02fd1bde)
- fix(devin): restrict sensitive word obfuscation strictly to system prompt only (f5247e49)
- feat(devin): support sensitive-words in auth json metadata and attributes (1b694851)
- refactor(devin): align sensitive-words with antigravity to config.yaml only (d115fe2c)
- fix(devin): sanitize claude subagent identity and emoji directives to prevent content policy 403 (c0b86059)
- refactor(devin): keep sensitive words strictly external in config.yaml without hardcoding (c0b76c2d)
- feat(devin): support credential quota and seat status query via GetUserStatus (7b5741c6)
- fix(devin): strip system prompt lines matching configured sensitive words to evade unicode normalization bypass (5b8e3821)
- feat(devin): add devin/gemini-3-8-flash and devin/grok-4-6 model definitions and signature recognition (ea2f29fe)
- feat(devin): enhance request-log with intermediate interactions and decoded upstream body (2caab7db)
- docs(devin): document cloud-side system instructions baseline in DevinExecutor (8a377071)
- feat(devin): add deepseek-v4-flash and deepseek-v4-1-flash models (308e5ad3)
- feat(devin): support none thinking level for glm-5-2 (0c2351bb)
- docs(devin): update DevinExecutor comment with verbatim reconstructed cloud system prompt (59df75d2)
- feat(devin): add standalone devin_models.json catalog and remote updater (982cd124)
- feat(devin): auto-namespace model IDs from clean devin_models.json (61741744)
- feat(devin): add symmetric decoded upstream response in request log (16cb6c0b)
- feat(devin): parse protobuf timestamp and harden partial failure logging (469aa367)
- feat(cmd): add fetch_devin_models CLI tool for dynamic model catalog extraction (2683ec20)
- feat(devin): clamp maxTokens to model MaxCompletionTokens (ca664c6e)
- feat(devin): map model aliases and swe-1-7/haiku/sonnet/gpt-4-1 UIDs (bf06746d)
- feat(registry): auto-populate Gemini token limits and generation methods for Devin models (0aedd05d)
- fix(devin): calculate total_input_tokens and total_tokens correctly (85ddf3ae)
- feat(registry): transparently resolve un-prefixed devin models in auth selection (fbabc274)
- Revert "feat(registry): transparently resolve un-prefixed devin models in auth selection" (a0ccc3a4)
- fix(util): enforce strict devin/ prefix requirement for devin provider (ca159b30)
- fix(devin): align wire protocol, harden streaming, and resolve multi-turn tool/signature parity (f1f5506c)
- fix(devin): sort streaming tool call stop events and normalize prompt CRLF (a5ea971f)
- fix(devin): guard against reopening thought step on late-arriving signatures (2f2f9b43)
- fix(devin): bound tool call indices against OOM, set Refresh timeout, and check manual callback state (d754298a)
- fix(devin): update streaming tool call step metadata if arriving in subsequent frames (50dd5826)
- fix(devin): enforce Connect-RPC EOS trailer invariant, validate frame flag, and bind OAuth callback to ctx (5d0c77cf)
- perf(devin): cache sensitive word regex matcher, preallocate request bytes and frame decompression buffer (6c7d2d57)
- perf(devin): eliminate O(K^2) tool call argument string allocations using strings.Builder (6df8f322)
- perf(devin): cache Devin HTTP transports per proxy URL to reuse connection pools (86de823d)
- fix(devin): propagate stream chunk errors, fix truncated protobuf infinite loop, respect ctx roundtripper, and limit auth response body reads (6a239f57)
- fix(devin): store transient quota metrics strictly in Quota.Signals and keep Metadata static (98b106f0)
- fix(devin): normalize upstream internal errors to 502 Bad Gateway (1604cb03)
- fix(devin): dynamic catalog-driven chat_model_uid resolution and effort clamping (926450e8)
- fix(devin): transport reuse, interleaved stream steps, strings.Builder panic, and updater URL (fb2c1c1a)
- feat(devin): integrate global signature detector for cross-provider signature detection (9d190f30)
- refactor(devin): deduplicate auth credentials extraction, filter sparse tool calls, and optimize model lookup (30b2ac89)
What's Changed
- feat(cooldowns): add cooldown snapshot feature for management auth files by @LTbinglingfeng in https://github.com/router-for-me/CLIProxyAPI/pull/5795
- feat(devin): add Devin / Cognition Connect-RPC provider integration by @sususu98 in https://github.com/router-for-me/CLIProxyAPI/pull/5789
Full Changelog: https://github.com/router-for-me/CLIProxyAPI/compare/v7.2.159...v7.3.0