Release v3.8.52

.env.selfhost.example

@@ -23,11 +23,15 @@ APP_BIND_HOST=127.0.0.1
 
 # ── Auth ──────────────────────────────────────────────────────────────
 # false = the dashboard and /v1 proxy are open to APP_BIND_HOST's network.
-# true  = every request needs an API key / dashboard login. The dashboard
-#         auto-creates INITIAL_PASSWORD on first boot (read it from the logs:
-#         `docker logs omniroute | grep -i password`). # EDIT ME — set true.
+# true  = /v1 requests need an API key (a logged-in dashboard session also works);
+#         the dashboard needs login once a password
+#         exists. Create the login password in the onboarding wizard on first visit
+#         (skipping that step turns dashboard login off, even with
+#         REQUIRE_API_KEY=true); after you submit it, the wizard asks for
+#         a one-time token from `docker logs omniroute | grep BOOTSTRAP`.
+#         # EDIT ME — set true.
 REQUIRE_API_KEY=false
-# INITIAL_PASSWORD=                  # uncomment to pre-seed the dashboard password
+# INITIAL_PASSWORD=strong-password-here # fill in to pre-seed the dashboard password (an empty value behaves like unset)
 
 # ── Memory ceiling (V8 old-space) ──────────────────────────────────────
 # 1024 = dashboard + light chat. Coding agents (long POST /v1/responses

.github/PULL_REQUEST_TEMPLATE/bugfix.md

@@ -0,0 +1,49 @@
+## Summary
+
+- What was broken, for whom, and what does this change fix?
+- Root cause in one or two sentences.
+
+## Related Issues
+
+- Closes # <!-- use "Refs #" if this only partially fixes the issue -->
+
+## Target Branch
+
+See the [Release Strategy](../../docs/ops/RELEASE_STRATEGY.md) and the [ROADMAP](../../ROADMAP.md):
+
+- [ ] Base is the active `release/v3.8.x` branch (the highest open `release/v*`), not `main`
+      (after 3.9.0, fixes target `stable/v3` and are forward-ported to v4 with credit)
+
+## Proof Of Fix (required)
+
+Every bug fix must be validated by ONE of the following (`AGENTS.md`, Hard Rule #18).
+A fix without either is not merged.
+
+- [ ] **TDD (preferred)** — a test that fails before the fix and passes after it.
+  - Test file(s):
+  - Failing output before the fix (paste the relevant lines):
+- [ ] **Real-environment test** (only when TDD is not possible — OAuth upstream flows,
+      upstream WebSocket/Cloudflare behavior, UI-only regressions, hardware-dependent
+      behavior) — record the exact command and its result:
+  - Environment:
+  - Command:
+  - Result:
+
+## Scope
+
+- [ ] Only the files the failing test proves need changing are touched
+- [ ] No test was weakened or deleted to make the suite pass
+
+## Validation
+
+Choose the focused loop for your change type from the
+[Contribution Golden Path](../../docs/ops/CONTRIBUTION_GOLDEN_PATH.md). The full unit suite,
+Vitest, the 60% coverage gate, and the production build all run in CI on this PR:
+
+- [ ] Change type: provider / routing / UI / i18n / CLI / DB / build-deploy / other
+- [ ] Focused tests and category gates from the golden path
+- [ ] `npm run lint`
+
+## Reviewer Notes
+
+- Risky areas, side effects on other providers/routes, or follow-ups reviewers should know about.

.github/PULL_REQUEST_TEMPLATE/feature.md

@@ -0,0 +1,44 @@
+## Summary
+
+- What does this feature add, and who uses it?
+- Link the issue or discussion where it was agreed on.
+
+## Related Issues
+
+- Closes #
+- Related to #
+
+## Target Branch
+
+See the [Release Strategy](../../docs/ops/RELEASE_STRATEGY.md) and the [ROADMAP](../../ROADMAP.md):
+
+- [ ] Base is the active `release/v3.8.x` branch (the highest open `release/v*`), not `main`
+- [ ] I understand that from 3.8.55 on, feature PRs are held with the `v4-feature` label and
+      re-targeted to the v4 channel (`develop`) when it opens — they are not closed
+
+## Design
+
+- Where does the code live (route / handler / executor / service / DB module / UI)?
+- New settings, env vars, feature flags, DB migrations, or MCP tools? List them.
+- Is it opt-in? Data-mutating behavior must be off by default.
+
+## Validation
+
+Choose the focused loop for your change type from the
+[Contribution Golden Path](../../docs/ops/CONTRIBUTION_GOLDEN_PATH.md). The full unit suite,
+Vitest, the 60% coverage gate, and the production build all run in CI on this PR:
+
+- [ ] Change type: provider / routing / UI / i18n / CLI / DB / build-deploy / other
+- [ ] Focused tests and category gates from the golden path
+- [ ] `npm run lint`
+- [ ] New production code ships with new automated tests in this PR
+- [ ] Docs updated for every new endpoint, env var, CLI command, or setting
+- [ ] New UI strings added to the i18n catalogs
+
+## Tests Added Or Updated
+
+- List every changed or added automated test file.
+
+## Reviewer Notes
+
+- Risky areas, migrations, feature flags, or manual validation reviewers should know about.

.github/actions/npm-ci-retry/README.md

@@ -1,6 +1,6 @@
 # npm ci with retry
 
-This action installs the checkout dependencies with up to three attempts and restores a node_modules tree only when its complete cache key matches. Node, the lockfile, project npm configuration, postinstall helpers and the action itself participate in the key.
+This action installs the checkout dependencies with up to three attempts and restores a node_modules tree only when its complete cache key matches. Node, npm, lockfile, project npm configuration, postinstall helpers and the action itself participate in the key. Cached and freshly installed trees still pass the existing native-runtime verification.
 
 The installation step sets `ONNXRUNTIME_NODE_INSTALL=skip` before invoking npm. ONNX Runtime reads this environment variable directly, so skipping its additional CUDA installation does not depend on npm forwarding the custom `.npmrc` key. The repository retains that key temporarily; its npm warning can therefore remain.
 

.github/actions/npm-ci-retry/action.yml

@@ -12,6 +12,26 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Select the lockfile-compatible npm version
+      id: npm
+      shell: bash
+      run: |
+        set -euo pipefail
+        expected=$(node -p "require('./config/ci/toolchain.json').npm")
+        if ! [[ "$expected" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "Invalid pinned npm version" >&2
+          exit 1
+        fi
+        if [ "$(npm --version)" != "$expected" ]; then
+          npm install --global "npm@$expected" --no-audit --no-fund
+        fi
+        actual=$(npm --version)
+        if [ "$actual" != "$expected" ]; then
+          echo "npm version differs from the lockfile toolchain" >&2
+          exit 1
+        fi
+        echo "version=$actual" >> "$GITHUB_OUTPUT"
+
     - name: Resolve Node version for the cache key
       id: node
       shell: bash
@@ -35,7 +55,7 @@ runs:
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: node_modules
-        key: node-modules-${{ runner.os }}-${{ runner.arch }}-${{ steps.node.outputs.version }}-${{ hashFiles('package-lock.json', '.npmrc', 'scripts/build/postinstall.mjs', 'scripts/build/postinstallSupport.mjs', 'scripts/build/colocateOptionals.mjs', 'scripts/build/wreqJsNative.mjs', 'scripts/build/fixPlaywrightAndroid.mjs', 'scripts/build/native-binary-compat.mjs', 'scripts/build/betterSqlitePrebuildTarget.mjs', '.github/actions/npm-ci-retry/action.yml') }}
+        key: node-modules-v3-${{ runner.os }}-${{ runner.arch }}-${{ steps.node.outputs.version }}-${{ steps.npm.outputs.version }}-${{ hashFiles('package-lock.json', '.npmrc', 'scripts/build/postinstall.mjs', 'scripts/build/postinstallSupport.mjs', 'scripts/build/colocateOptionals.mjs', 'scripts/build/wreqJsNative.mjs', 'scripts/build/fixPlaywrightAndroid.mjs', 'scripts/build/native-binary-compat.mjs', 'scripts/build/betterSqlitePrebuildTarget.mjs', 'scripts/ci/verify-ci-install.mjs', '.github/actions/npm-ci-retry/action.yml') }}
 
     - name: npm ci (with retry)
       if: steps.node-modules.outputs.cache-hit != 'true'
@@ -68,6 +88,13 @@ runs:
           delay_seconds=$((delay_seconds * 2))
         done
 
+    # Both cache hits and successful installs must execute the native runtimes.
+    # A package directory alone cannot prove ABI compatibility or a usable binary.
+    - name: Verify installed native runtimes
+      id: verify-install
+      shell: bash
+      run: node scripts/ci/verify-ci-install.mjs
+
     - name: node_modules restored from cache
       if: steps.node-modules.outputs.cache-hit == 'true'
       shell: bash

.github/labels.yml

@@ -0,0 +1,41 @@
+# Declarative GitHub labels for the 3.8.5x -> 3.9.0 LTS release rail.
+#
+# Synced by `npm run labels:sync` (scripts/release/sync-labels.mjs): dry-run by
+# default, `-- --apply` to create/update. Only the labels listed here are managed;
+# labels missing from this file are never touched or deleted.
+#
+# Pre-existing operational labels (`queue`, `release-freeze`, `base-red`, ...) are
+# intentionally NOT listed — they keep their current meaning and colors.
+#
+# Model: docs/ops/RELEASE_STRATEGY.md
+#
+# Fields: name (required), color (QUOTED 6-digit hex - unquoted values like 5319E7 or
+# 012345 are parsed by YAML as numbers), description (<= 100 chars).
+
+- name: v4-feature
+  color: "1D76DB"
+  description: Feature PR held for the v4 channel (develop); re-targeted when it opens
+
+- name: lts
+  color: "0E8A16"
+  description: Belongs to the v3 LTS line (stable/v3) - fixes, security, provider updates
+
+- name: forward-port
+  color: "C5DEF5"
+  description: Fix forward-ported from stable/v3 to develop with original-author credit
+
+- name: channel:latest
+  color: "2EA44F"
+  description: Ships on the npm `latest` dist-tag (v3 until 4.0 GA)
+
+- name: channel:next
+  color: "FBCA04"
+  description: Ships on the npm `next` dist-tag (v4 release candidates)
+
+- name: channel:nightly
+  color: "5319E7"
+  description: Ships on the npm `nightly` dist-tag (v4 develop builds)
+
+- name: preview-artifact
+  color: "BFDADC"
+  description: Requests a PR preview build artifact (dormant until the 3.8.58 rehearsal)

.github/pull_request_template.md

@@ -7,6 +7,16 @@
 - Closes #
 - Related to #
 
+## Target Branch
+
+See the [Release Strategy](../docs/ops/RELEASE_STRATEGY.md), the
+[Contribution Golden Path](../docs/ops/CONTRIBUTION_GOLDEN_PATH.md) and the
+[ROADMAP](../ROADMAP.md):
+
+- [ ] Base is the active `release/v3.8.x` branch (the highest open `release/v*`), not `main`
+- [ ] New feature? From 3.8.55 on it is held with the `v4-feature` label for the v4 channel
+- Focused templates: append `?template=feature.md` or `?template=bugfix.md` to the compare URL
+
 ## Validation
 
 Choose the change type and focused loop from the

.github/workflows/base-ci-repair.yml

@@ -0,0 +1,29 @@
+name: Release base repair
+on:
+  push:
+    branches: [fix/release-v3.8.52-basereds]
+permissions:
+  contents: read
+jobs:
+  regression:
+    runs-on: ubuntu-latest
+    timeout-minutes: 12
+    env:
+      CI: "true"
+      OMNIROUTE_SKIP_SYSTEM_TRUST: "1"
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+      NEXT_TELEMETRY_DISABLED: "1"
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+      OMNIROUTE_MAX_TEST_WORKERS: "2"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: "24"
+      - name: Verify old failure and final guarded transport
+        run: node scripts/check/base-ci-repair.mjs
+      - name: Clean owned state
+        if: always()
+        run: rm -rf -- .ci-work/base-ci-repair

.github/workflows/build.yml

@@ -50,9 +50,15 @@ jobs:
         run: |
           npm run build:release
         env:
-          NODE_OPTIONS: "--max-old-space-size=12288"
-          OMNIROUTE_BUILD_MEMORY_MB: "12288"
-          OMNIROUTE_USE_TURBOPACK: "1"
+          # Hosted artifact builds run with less memory than the opt-in 64 GB
+          # CI build slot. Keep Webpack here without overriding the latter's
+          # separately measured Turbopack policy (#16169). Validated 2026-10-18 on the
+          # hosted runner (run 39151150605): webpack compiled in 7.1 min, job 17 min.
+          # This is the floor docker-publish.yml must not go below
+          # (tests/unit/docker-publish-build-heap-14325.test.ts).
+          NODE_OPTIONS: "--max-old-space-size=10240"
+          OMNIROUTE_BUILD_MEMORY_MB: "10240"
+          OMNIROUTE_USE_TURBOPACK: "0"
 
       - name: Archive build outputs
         run: |