Higress & HiRoute Nov 2026: Safer AI Gateways, 92% Cheaper Model Routing, Omarchy Desktop

Higress: Production-Grade Hardening

Clearer Access Boundaries

The controller now listens for plaintext xDS only on the loopback address, and gRPC service reflection is disabled in production, reducing configuration-surface exposure. Database MCP servers require authentication credentials, and external authentication can match on the presence of specific request headers, giving operators explicit rules for which requests need auth.

More Stable AI and MCP Requests

Explicit handling of malformed requests: AI requests containing duplicate top-level model fields are rejected, preventing the gateway and upstream from selecting different models. Rate-limiting, geo-IP, and IP-restriction plugins were fixed to no longer crash on anomalous X-Real-IP headers.

Complete tool-call and usage recording: Fixed loss of tool-call content during streaming desensitization, and corrected under-counting of tokens in non-streaming responses, making call logs and rate-limit counters reliable.

Easier MCP server onboarding: The gateway automatically adapts between old and new MCP protocols, unifies business logic across both, and preserves upstream discovery instructions per configuration, reducing protocol-mismatch integration issues.

Controlled Upgrades and Plugin Operations

hgctl upgrade --from-helm

takes over existing Helm deployments while retaining Helm release history. Plugins are published as immutable snapshots with digest verification; the Console plugin marketplace surfaces only audited, version-pinned plugins. AI inference services can enable the built-in Endpoint Picker via a standard WasmPlugin reference.

Version highlights: v2.2.5 (early October, 133 changes) refined Helm migration, plugin snapshots, and MCP protocol adaptation; v2.2.6 (10 Nov, 76 changes) focused on access boundaries, request validation, and AI/MCP stability fixes.

HiRoute: Making Subscriptions Last Longer

Use Strong Models Only for Critical Steps

HiRoute routes routine work to economical models and complex reasoning to flagship models. At each routing decision point it evaluates the previous stage's performance, the next stage's difficulty, and whether earlier problems will cascade; the flagship model takes over when protection is needed, then hands back once the risk clears.

In a technical-selection benchmark, Qwen 3.8 Flash handled research verification while GPT-6 Astra made key decisions. Across two successful acceptance runs, API-equivalent cost dropped 92.01% and 91.39% respectively (from $1.839–1.842 to $0.138–0.147). Tool-call chains reuse the same model; model selection occurs only at new-message, context-compression, or rebuild points, preserving cache — a six-request session showed 95–99% cache hit rate .

Structured New-Model Trial Framework

New models enter a five-tier ladder: Trial (L1) → Familiar (L2) → Trust (L3) → Delegate (L4) → Entrust (L5) . At every decision point three questions are scored: How did it do? How hard is next step? Will problems persist? Low-score protection triggers flagship takeover whenever a weak step threatens downstream work. Promotion requires evidence thresholds: ≥30 scoring phases, ≥3 independent sessions, ≥60% scoring coverage, ≥85% competence rate. Before widening usage, operators can replay their own historical records against the new thresholds to validate the promotion.

Integrate Subscriptions and API Keys into Daily Workflows

Broad Agent support: Codex, Claude Code, Qoder, Pi, DeepSeek Harness, OpenCode, Hermes; Codex Desktop configurable separately.

Subscription + API combo: New Claude subscription integration; same-named models from subscription and API can be combined, with subscription preferred and automatic fallback to API when subscription is unavailable.

Granular quotas and accurate billing: API keys support one-time, periodic, or shared quotas; pre-reserve on forward, settle on completion. Fixed double-billing of Messages cache tokens.

Task-to-Agent binding: Routing plans can bind execution agents; Hermes can delegate published plans, merging task division with model selection.

Desktop Expansion: Windows, macOS, Linux Server, and Omarchy

Windows desktop addresses community demand with improved install/uninstall/update diagnostics and image-request forwarding. macOS covers Apple Silicon and Intel; Linux servers managed via Web UI and CLI, with SSH-tunnel access for remote use. v0.6.0 adds Omarchy desktop (x86_64 and ARM64 signed packages). Omarchy is an Arch Linux + Hyprland distribution bundling OpenCode, Claude Code, etc., making AI coding a native desktop workflow. HiRoute launches from the application menu and reuses compatible Linux backend services or its bundled runtime.

Release cadence: 0.2.0/0.3.0/0.3.1 (Oct) refined decision models, Agent and subscription onboarding; 0.5.0 (3 Nov) brought Windows desktop, new-model trial, task routing; 0.5.1/0.5.3 (5–6 Nov) improved install/update and fixed image requests; 0.6.0 (9 Nov) added Omarchy desktop.

Next: Bringing Intelligent Routing to the Enterprise

Roadmap connects local developer workflows with centralized enterprise governance:

Developer / Local: HiRoute Desktop — unified local AI gateway for personal Agents and models.

Enterprise / Centralized: Higress (K8s, control-plane/data-plane separation, distributed security) + HiRoute Gateway (AI gateway, model routing, task routing, cost governance).

AI gateway capabilities will move into the Rust kernel while maintaining compatibility with existing Higress Wasm plugins. Containerization and multi-replica demands are tracked in https://github.com/higress-group/higress/issues/104 (issue #104).

Community & Thanks

Community feedback drove Windows desktop support and install/update polish. @JasonBuildAI and @Aias00 contributed Windows build/storage, cache billing, build and verification; @Aias00 also added Helm-to-hgctl migration for Higress.

Higress code contributors: @sunxia0, @zhihao-yuan, @yyqdbngt, @btlqql, @dusk5-Surtr plus all participants in v2.2.5 and v2.2.6.

HiRoute code contributors: @JasonBuildAI, @Aias00 ; issue reporters: @springsheep, @MrSsunlight, @NieRonghua, @Nicholas2015, @alaggxz, @fishcake11, @hejun041, @Weiss545, @menglol, @wy471x, @augustazz .

References

Higress releases: https://github.com/higress-group/higress/releases HiRoute releases: https://github.com/higress-group/HiRoute/releases HiRoute download: https://hiroute.ai/zh/download/ Routing, cost, delegation practices: https://hiroute.ai/zh/news/ Experiment records & cost methodology:

https://github.com/higress-group/HiRoute/blob/v0.6.0/experiments/cases/research-cost-quality/README.md

Omarchy:

https://omarchy.org/