Sync upstream main raw

.env.example

@@ -92,7 +92,7 @@ OMNIROUTE_USE_TURBOPACK=1
 # OMNIROUTE_PORT=20128
 
 # Hostname/bind address for the Next.js server.
-# Used by: scripts/run-next.mjs (HOST), Playwright runner (HOSTNAME).
+# Used by: scripts/dev/run-next.mjs (HOST), Playwright runner (HOSTNAME).
 # Default: 0.0.0.0 (HOST) / 127.0.0.1 (HOSTNAME inside tests).
 #HOST=0.0.0.0
 #HOSTNAME=127.0.0.1
@@ -111,6 +111,12 @@ NODE_ENV=production
 # Default: endpoint-proxy-salt  |  Change per-deployment for isolation.
 MACHINE_ID_SALT=endpoint-proxy-salt
 
+# Salt for deriving CLI machine-ID auth tokens (HMAC-SHA256).
+# Used by: src/lib/machineToken.ts — rotates the local CLI auth token without
+#          touching code. Set to a new value to invalidate existing CLI tokens.
+# Default: omniroute-cli-auth-v1
+# OMNIROUTE_CLI_SALT=omniroute-cli-auth-v1
+
 # Set true when running behind HTTPS (reverse proxy with TLS termination).
 # Used by: src/lib/auth — sets the Secure flag on session cookies.
 # Default: false  |  MUST be true in any non-localhost deployment.
@@ -137,6 +143,15 @@ ALLOW_API_KEY_REVEAL=false
 # Used by: src/lib/compliance/index.ts — suppresses logs for specific keys.
 # NO_LOG_API_KEY_IDS=key_abc123,key_def456
 
+# Fallback per-day request budget applied to API keys whose `rate_limits`
+# column is null. Default (unset/empty/malformed) preserves the legacy
+# 1000/day, 5000/week, 20000/month windows so existing deployments do not
+# silently lose rate limiting on upgrade.
+# Set explicitly to "0" to opt out entirely (unlimited fallback). Any
+# positive integer N enables N/day, 5N/week, 20N/month.
+# Used by: src/shared/utils/apiKeyPolicy.ts — checkRateLimit() fallback.
+# DEFAULT_RATE_LIMIT_PER_DAY=1000
+
 # Maximum request body size in bytes (rejects larger payloads).
 # Used by: src/shared/middleware/bodySizeGuard.ts — prevents oversized uploads.
 # Default: 10485760 (10 MB)
@@ -297,6 +312,11 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Used by: open-sse/executors — replaces Node.js default TLS fingerprint.
 # ENABLE_TLS_FINGERPRINT=true
 
+# Allow the Claude Turnstile Playwright browser context to ignore HTTPS certificate errors.
+# Only enable for local debugging or trusted MITM/corporate proxy environments.
+# Used by: open-sse/services/claudeTurnstileSolver.ts
+# OMNIROUTE_TURNSTILE_IGNORE_TLS_ERRORS=false
+
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 9. CLI TOOL INTEGRATION
@@ -412,6 +432,10 @@ PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES=70
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
 
+# Skip the postinstall native-runtime warm-up (useful in CI / headless installs). Default: 0.
+# Used by: scripts/postinstall.mjs.
+#OMNIROUTE_SKIP_POSTINSTALL=0
+
 # Force a DB healthcheck regardless of cadence.  Default: 0.
 # Used by: src/lib/db/core.ts::shouldRunDbHealthCheck().
 #OMNIROUTE_FORCE_DB_HEALTHCHECK=0
@@ -527,6 +551,30 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # QODER_CLI_WORKSPACE=
 # OMNIROUTE_QODER_WORKSPACE=
 
+# ── Blackbox Web validated-token override (issue #2252) ──
+# Used by: open-sse/executors/blackbox-web.ts. Blackbox `/api/chat` rejects
+# requests whose `validated` field doesn't match the frontend `tk` token,
+# returning HTTP 403 even with a valid session cookie + active subscription.
+# Set this to the `tk` value exported from app.blackbox.ai's Next.js bundle
+# to bypass the random-UUID fallback. Leave empty to keep the legacy behavior.
+# BLACKBOX_WEB_VALIDATED_TOKEN=
+
+# ── Vision Bridge OpenAI-compatible endpoint override (issue #2232) ──
+# Used by: src/lib/guardrails/visionBridgeHelpers.ts. By default the
+# vision-bridge guardrail sends non-Anthropic image-description calls to
+# `https://api.openai.com/v1`, which fails with 401 if your operator doesn't
+# have an OpenAI key or wants to use a different vision model
+# (e.g., `google/gemini-2.0-flash` via the Gemini OpenAI-compat endpoint, or
+# any model registered in OmniRoute via the self-loop endpoint).
+#
+# Set these two env vars to point the bridge at any OpenAI-compatible URL:
+#   - VISION_BRIDGE_BASE_URL=http://localhost:20128/v1   (OmniRoute self-loop)
+#   - VISION_BRIDGE_BASE_URL=https://generativelanguage.googleapis.com/v1beta/openai
+#   - VISION_BRIDGE_BASE_URL=https://openrouter.ai/api/v1
+# Anthropic models (anthropic/*) keep their dedicated path and are unaffected.
+# VISION_BRIDGE_BASE_URL=
+# VISION_BRIDGE_API_KEY=
+
 # ─────────────────────────────────────────────────────────────────────────────
 # ⚠️  GOOGLE OAUTH (Antigravity, Gemini CLI) & OTHER PROVIDERS — REMOTE SERVERS
 # ─────────────────────────────────────────────────────────────────────────────
@@ -557,19 +605,19 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.137 (external, cli)"
-CODEX_USER_AGENT="codex-cli/0.130.0 (Windows 10.0.26200; x64)"
+CLAUDE_USER_AGENT="claude-cli/2.1.143 (external, cli)"
+CODEX_USER_AGENT="codex-cli/0.131.0 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
 ANTIGRAVITY_USER_AGENT="antigravity/1.23.2 darwin/arm64"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
 QODER_USER_AGENT="Qoder-Cli"
 QWEN_USER_AGENT="QwenCode/0.15.9 (linux; x64)"
-CURSOR_USER_AGENT="Cursor/3.3"
+CURSOR_USER_AGENT="Cursor/3.4"
 GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.130.0
+# CODEX_CLIENT_VERSION=0.131.0
 
 
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -656,6 +704,13 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # OMNIROUTE_CHATGPT_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_CHATGPT_TLS_GRACE_MS=10000
 
+# ── Claude TLS sidecar (Chromium-fingerprinted client) ──
+# Used by: open-sse/services/claudeTlsClient.ts — wire-level timeout for
+# the bogdanfinn/tls-client koffi binding and the JS-side grace window
+# layered on top of it when the native library is wedged.
+# OMNIROUTE_CLAUDE_TLS_TIMEOUT_MS=60000
+# OMNIROUTE_CLAUDE_TLS_GRACE_MS=10000
+
 # ── Circuit breaker thresholds and reset windows ──
 # Used by: open-sse/config/constants.ts → src/lib/resilience/settings.ts.
 # Defaults match historical PROVIDER_PROFILES values (post-scaling for
@@ -772,6 +827,30 @@ APP_LOG_TO_FILE=true
 # Default: 256 (Docker) | system default (npm)
 # OMNIROUTE_MEMORY_MB=256
 
+# ── CLI helpers (bin/cli/) ──
+# Override UI language for CLI output. Accepts BCP-47 locale (e.g. en, pt-BR).
+# Falls back to LC_ALL / LC_MESSAGES / LANG / en if unset.
+# OMNIROUTE_LANG=en
+
+# Show server logs inline when running in supervised mode (omniroute serve).
+# Set to "1" to forward server stdout/stderr to the terminal.
+# Equivalent to the --log flag on `omniroute serve`.
+# OMNIROUTE_SHOW_LOG=1
+
+# Bearer token injected as x-omniroute-cli-token header for machine-auth (task 8.12).
+# Auto-generated on first run if machine-id is available; set manually to override.
+# OMNIROUTE_CLI_TOKEN=
+
+# Per-attempt HTTP timeout for CLI → server calls (milliseconds). Default: 30000.
+# OMNIROUTE_HTTP_TIMEOUT_MS=30000
+
+# Set to 1 to print retry/backoff details to stderr during CLI commands.
+# OMNIROUTE_VERBOSE=0
+
+# Custom directory for CLI plugin discovery (omniroute-cmd-* packages).
+# Default: ~/.omniroute/plugins/  Override in dev/CI to point at a local plugin tree.
+# OMNIROUTE_PLUGIN_PATH=
+
 # ── Prompt cache (system prompt deduplication) ──
 # Used by: open-sse/services — caches identical system prompts across requests.
 # PROMPT_CACHE_MAX_SIZE=50              # Max cached entries (default: 50)
@@ -938,7 +1017,7 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/utils/cursorVersionDetector.ts. Default: probed automatically.
 # CURSOR_STATE_DB_PATH=
 
-# Direct Cursor bearer token used by scripts/cursor-tap.cjs (developer tooling).
+# Direct Cursor bearer token used by scripts/ad-hoc/cursor-tap.cjs (developer tooling).
 # CURSOR_TOKEN=
 
 # Log Responses API SSE-to-JSON translation details.
@@ -1056,8 +1135,8 @@ APP_LOG_TO_FILE=true
 # ═══════════════════════════════════════════════════════════════════════════════
 # 25. TEST & E2E
 # ═══════════════════════════════════════════════════════════════════════════════
-# Used by scripts/run-next-playwright.mjs, scripts/smoke-electron-packaged.mjs,
-# scripts/run-ecosystem-tests.mjs and scripts/uninstall.mjs.
+# Used by scripts/dev/run-next-playwright.mjs, scripts/dev/smoke-electron-packaged.mjs,
+# scripts/dev/run-ecosystem-tests.mjs and scripts/build/uninstall.mjs.
 # Production deployments should leave every value below unset.
 
 # E2E bootstrap mode for the Playwright runner. Accepted: auth | fresh | reuse.
@@ -1099,7 +1178,7 @@ APP_LOG_TO_FILE=true
 # Number of parallel translation requests (default 4).
 # OMNIROUTE_TRANSLATION_CONCURRENCY=4
 
-# Electron smoke harness (used by scripts/smoke-electron-packaged.mjs).
+# Electron smoke harness (used by scripts/dev/smoke-electron-packaged.mjs).
 # ELECTRON_SMOKE_URL=http://127.0.0.1:20128/login
 # ELECTRON_SMOKE_TIMEOUT_MS=45000
 # ELECTRON_SMOKE_SETTLE_MS=2000

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -165,7 +165,7 @@ body:
       description: "Which commands or tests should prove this bug is fixed?"
       placeholder: |
         Example:
-        - node --import tsx/esm --test tests/unit/my-file.test.ts
+        - node --import tsx --test tests/unit/my-file.test.ts
         - npm run test:coverage
     validations:
       required: false

.github/ISSUE_TEMPLATE/test_coverage_task.yml

@@ -59,7 +59,7 @@ body:
       description: "List the commands that must pass before this issue can be closed."
       placeholder: |
         Example:
-        - node --import tsx/esm --test tests/unit/my-suite.test.ts
+        - node --import tsx --test tests/unit/my-suite.test.ts
         - npm run test:coverage
     validations:
       required: true

.github/workflows/ci.yml

@@ -197,7 +197,7 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run check:node-runtime
-      - run: node --import tsx/esm --test --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts
+      - run: node --import tsx --test --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts
 
   node-24-compat:
     name: Node 24 Compatibility (${{ matrix.shard }}/2)
@@ -221,7 +221,7 @@ jobs:
       - run: npm ci
       - run: npm run check:node-runtime
       - run: npm run build
-      - run: node --import tsx/esm --test --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts
+      - run: node --import tsx --test --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts
 
   node-26-compat:
     name: Node 26 Compatibility (${{ matrix.shard }}/2)
@@ -245,7 +245,7 @@ jobs:
       - run: npm ci
       - run: npm run check:node-runtime
       - run: npm run build
-      - run: node --import tsx/esm --test --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts
+      - run: node --import tsx --test --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/unit/*.test.ts
 
   test-coverage:
     name: Coverage
@@ -452,7 +452,7 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run check:node-runtime
-      - run: node --import tsx/esm --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
+      - run: node --import tsx --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
 
   test-security:
     name: Security Tests

.github/workflows/claude-code-review.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 

.github/workflows/opencode-provider-ci.yml

@@ -0,0 +1,61 @@
+name: opencode-provider CI
+
+on:
+  push:
+    branches: [main, release/v3.8.0]
+    paths:
+      - "@omniroute/opencode-provider/**"
+  pull_request:
+    branches: [main, release/v3.8.0]
+    paths:
+      - "@omniroute/opencode-provider/**"
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: "@omniroute/opencode-provider"
+
+jobs:
+  test:
+    name: Test (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ["20", "22", "24"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+          cache-dependency-path: "@omniroute/opencode-provider/package-lock.json"
+      - run: npm ci
+      - run: npm test
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: "@omniroute/opencode-provider/package-lock.json"
+      - run: npm ci
+      - run: npm run build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: opencode-provider-dist
+          path: "@omniroute/opencode-provider/dist"
+          retention-days: 7

.gitignore

@@ -5,6 +5,12 @@
 omnirouteCloud/
 omnirouteSite/
 
+# Claude Code local state — runtime files only; shared commands at .claude/commands/ are tracked
+.claude/scheduled_tasks.lock
+.claude/scheduled_tasks/
+.claude/sessions/
+.claude/state.json
+
 # Root-level underscore-prefixed directories (private/draft — never commit)
 /_*/
 
@@ -76,6 +82,7 @@ open-sse/test/*
 .github/instructions/codacy.instructions.md
 
 # Playwright
+.playwright-mcp/
 test-results/
 playwright-report/
 blob-report/

.husky/pre-commit

@@ -12,6 +12,9 @@ npm run check:any-budget:t11
 # Strict env-doc sync (FASE 2)
 node scripts/check/check-env-doc-sync.mjs
 
+# CLI i18n consistency check — all t() keys must exist in en.json (FASE 8.3)
+node scripts/check/check-cli-i18n.mjs
+
 # i18n docs drift advisory (FASE 5) — warn-only on pre-commit; CI enforces strict.
 node scripts/i18n/check-translation-drift.mjs --warn || \
   echo "⚠️  i18n drift detected. Run 'npm run i18n:run' to update locale mirrors."