Release v3.8.4

.dockerignore

@@ -41,20 +41,16 @@ blob-report
 # Issue #2348: The Dashboard Docs viewer reads markdown from `/app/docs` at
 # runtime. The previous `docs/*` block hid every file except openapi.yaml,
 # so the in-product help screen failed with ENOENT for every page.
-# We now keep the English markdown tree but drop the bulky assets
-# (translations, screenshots, raster diagrams) that account for ~45 MB
-# of the ~50 MB docs directory. The Docs viewer reads the default-locale
-# (English) sources at runtime, so translations are not required in the
-# container image.
+# We now keep the English markdown tree but drop bulky i18n mirrors (~45 MB).
+# v3.8.3+ (fumadocs-mdx): `npm run build` webpack-bundles docs — keep assets referenced
+# from English markdown (docs/diagrams/exported/*.svg, docs/screenshots/*.png).
 docs/i18n/**
-docs/screenshots/**
-docs/diagrams/exported/**
+# Raster sources under docs/diagrams/ only (exported SVGs are required at build time).
 docs/diagrams/**/*.png
 docs/diagrams/**/*.jpg
 docs/diagrams/**/*.jpeg
 docs/diagrams/**/*.gif
 docs/diagrams/**/*.webp
-docs/diagrams/**/*.svg
 # Note: `*.md` matches the root only (Go filepath.Match does not cross /),
 # so nested docs/**/*.md is implicitly kept without a re-include rule.
 *.md

.env.example

@@ -82,10 +82,32 @@ PORT=20128
 # Default: 20129
 # LIVE_WS_PORT=20129
 
-# Disable the real-time WebSocket server.
+# Bind address for the live WebSocket server.
+# Default: 127.0.0.1 (loopback only). Set to 0.0.0.0 to expose on LAN —
+# remember to also configure LIVE_WS_ALLOWED_ORIGINS when doing so.
+# LIVE_WS_HOST=127.0.0.1
+
+# Comma-separated extra origins allowed to open a live WebSocket. The
+# loopback dashboard origins are already permitted by default; use this
+# var when fronting the server with a domain (e.g. https://omni.local).
+# LIVE_WS_ALLOWED_ORIGINS=https://omni.local,https://dashboard.example.com
+
+# Disable the standalone live WebSocket helper used by scripts/start-ws-server.mjs.
+# Used by: scripts/start-ws-server.mjs (CI/embedded harness toggle).
+# OMNIROUTE_DISABLE_LIVE_WS=0
+
+# Enable the real-time dashboard WebSocket server.
 # Used by: src/server/ws/liveServer.ts, scripts/start-ws-server.mjs
-# Default: false | Set to 1 or true to disable.
-# OMNIROUTE_DISABLE_LIVE_WS=false
+# Default: ON. Set to 0 or false to disable startup of the live WS server.
+# Combine with LIVE_WS_HOST / LIVE_WS_ALLOWED_ORIGINS above when exposing
+# beyond loopback.
+# OMNIROUTE_ENABLE_LIVE_WS=1
+
+# Per-(token,IP) relay rate limit, requests/minute. In-memory, per instance.
+# 0 or negative disables the IP-dimension gate (per-token DB limit still applies).
+# Default: 30
+# Used by: src/app/api/v1/relay/chat/completions/route.ts
+# RELAY_IP_PER_MINUTE=30
 
 # Use Turbopack in local dev. Next 16.2.4 can fail to compile next/font/google
 # through the custom dev runner without this on Windows.
@@ -110,6 +132,11 @@ OMNIROUTE_USE_TURBOPACK=1
 # Used by: src/lib/credentialHealth/scheduler.ts
 # OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK=false
 
+# Set to "true" to emit `[ProxyFetch]` debug logs from the Vercel relay path
+# in open-sse/utils/proxyFetch.ts. Off by default to avoid leaking routing
+# hints in production logs.
+# OMNIROUTE_PROXY_FETCH_DEBUG=true
+
 # Docker production port mappings (docker-compose.prod.yml only).
 # These set the HOST-side published ports. Container ports use PORT/API_PORT.
 # PROD_DASHBOARD_PORT=20130
@@ -644,6 +671,11 @@ CODEX_USER_AGENT="codex-cli/0.132.0 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
+# Optional override for the Kiro social device-code OAuth clientId. Kiro's
+# device endpoint accepts any non-empty string and behaves like a User-Agent
+# rather than a secret. Only override if AWS ever starts enforcing this field.
+# Used by: src/lib/oauth/constants/oauth.ts (KIRO_CONFIG.socialClientId).
+# KIRO_OAUTH_CLIENT_ID=kiro-cli
 QODER_USER_AGENT="Qoder-Cli"
 QWEN_USER_AGENT="QwenCode/0.15.11 (linux; x64)"
 CURSOR_USER_AGENT="Cursor/3.4"
@@ -997,6 +1029,21 @@ APP_LOG_TO_FILE=true
 # Used by: src/shared/utils/featureFlags.ts
 # ENABLE_CC_COMPATIBLE_PROVIDER=false
 
+# ── 9router embedded service ──
+# Override the host/port where the embedded 9router instance listens.
+# Rarely needed — defaults match the bootstrap config (127.0.0.1:20130).
+# Used by: open-sse/executors/ninerouter.ts
+# NINEROUTER_HOST=127.0.0.1
+# NINEROUTER_PORT=20130
+
+# ── Embedded service WebSocket proxy ──
+# Standalone WebSocket proxy that tunnels WS connections to embedded services.
+# Binds to loopback by default. Only change EMBED_WS_PROXY_HOST if you know
+# what you are doing — exposing this to non-loopback bypasses local-only policy.
+# Used by: src/lib/services/embedWsProxy.ts
+# EMBED_WS_PROXY_HOST=127.0.0.1
+# EMBED_WS_PROXY_PORT=20131
+
 # ── CLIProxyAPI bridge (legacy) ──
 # Connection settings for external CLIProxyAPI instances.
 # Used by: open-sse/executors/cliproxyapi.ts
@@ -1142,6 +1189,35 @@ APP_LOG_TO_FILE=true
 # ONEPROXY_MAX_PROXIES=500
 # ONEPROXY_MIN_QUALITY_THRESHOLD=50
 
+# ── Free Proxy Pool (1proxy source) ──
+# Used by: src/lib/freeProxyProviders/oneproxy.ts
+# Set FREE_PROXY_1PROXY_ENABLED=false to disable this source.
+# FREE_PROXY_1PROXY_ENABLED=true
+# FREE_PROXY_1PROXY_API_URL=https://1proxy-api.aitradepulse.com/api/v1/proxies/advanced
+# FREE_PROXY_1PROXY_MAX=500
+# FREE_PROXY_1PROXY_MIN_QUALITY=50
+
+# ── Free Proxy Pool (Proxifly source) ──
+# Used by: src/lib/freeProxyProviders/proxifly.ts
+# Enabled by default; set to false to disable.
+# FREE_PROXY_PROXIFLY_ENABLED=true
+# FREE_PROXY_PROXIFLY_QUANTITY=100
+# FREE_PROXY_PROXIFLY_ANONYMITY=elite
+
+# ── Free Proxy Pool (IPLocate source) ──
+# Used by: src/lib/freeProxyProviders/iplocate.ts
+# Opt-in only; must set FREE_PROXY_IPLOCATE_ENABLED=true to activate.
+# FREE_PROXY_IPLOCATE_ENABLED=false
+# FREE_PROXY_IPLOCATE_BASE_URL=https://raw.githubusercontent.com/iplocate/free-proxy-list/main/protocols
+
+# ── Vercel Relay ──
+# Used by: src/app/api/settings/proxy/vercel-deploy/route.ts
+# Hides the "Deploy Relay" button when set to false.
+# NEXT_PUBLIC_VERCEL_RELAY_ENABLED=true
+# VERCEL_API_BASE=https://api.vercel.com
+# Default project name pre-filled in the Vercel Relay deploy modal.
+# NEXT_PUBLIC_VERCEL_RELAY_DEFAULT_PROJECT=omniroute-relay
+
 # ── Tailscale tunnel binaries ──
 # Optional explicit paths to tailscale/tailscaled binaries used by the
 # dashboard's tunnel manager. Used by: src/lib/tailscaleTunnel.ts.

.github/workflows/ci.yml

@@ -284,9 +284,15 @@ jobs:
       - run: npm run check:node-runtime
       - name: Run c8 over shard ${{ matrix.shard }}/4
         run: |
+          # `--temp-directory` (writable via NODE_V8_COVERAGE) is what the merge
+          # job reads with `c8 report --temp-directory ...`. Using `--output-dir`
+          # only produces the final json *report* and leaves the raw v8 files in
+          # `coverage/tmp`, so uploading `coverage-shard/` was empty. Pin the temp
+          # dir so the raw coverage files live there and the artifact upload picks
+          # them up regardless of `--test-force-exit` timing.
           npx c8 \
             --reporter=json \
-            --output-dir=coverage-shard \
+            --temp-directory=coverage-shard \
             --exclude=tests/** \
             --exclude=**/*.test.* \
             node --import tsx --test --test-force-exit --test-concurrency=4 \

.github/workflows/docker-publish.yml

@@ -8,14 +8,22 @@ on:
       - "v*"
     paths-ignore:
       - ".github/workflows/**"
+  # Use 'released' instead of 'published' so editing/re-publishing old releases
+  # does NOT re-trigger this workflow. 'released' fires only on the initial
+  # release publication (and pre-release → release transition).
   release:
-    types: [published]
+    types: [released]
   workflow_dispatch:
     inputs:
       version:
-        description: "Version tag to build (e.g. 2.6.0)"
+        description: "Version tag to build (e.g. 3.8.4)"
         required: true
         type: string
+      promote_latest:
+        description: "Also tag :latest (only if this is the highest semver)"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -32,61 +40,151 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
+          # Need full tag history for semver comparison when deciding :latest.
+          fetch-depth: 0
+
+      - name: Resolve version, latest-promotion, and skip flag
+        id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
+          INPUT_VERSION: ${{ inputs.version }}
+          PROMOTE_INPUT: ${{ inputs.promote_latest }}
+        run: |
+          set -euo pipefail
+
+          # 1) Resolve version string from the trigger (all inputs come via env).
+          case "$EVENT_NAME" in
+            workflow_dispatch)
+              VERSION="${INPUT_VERSION#v}"
+              ;;
+            push)
+              if [ "$REF_TYPE" = "tag" ]; then
+                VERSION="${REF_NAME#v}"
+              else
+                # Push to main → build & tag as `main` only. Never touch :latest.
+                VERSION="main"
+              fi
+              ;;
+            release)
+              VERSION="${REF_NAME#v}"
+              ;;
+            *)
+              VERSION="${REF_NAME#v}"
+              ;;
+          esac
+          # Sanity-check: only allow [A-Za-z0-9._-] in VERSION (defense in depth).
+          if ! printf '%s' "$VERSION" | grep -qE '^[A-Za-z0-9._-]+$'; then
+            echo "Refusing to use unsafe VERSION value: $VERSION" >&2
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+          # 2) Decide whether to promote :latest.
+          PROMOTE="false"
+          if [ "$VERSION" = "main" ]; then
+            PROMOTE="false"
+          elif printf '%s' "$VERSION" | grep -qE -- '-(rc|alpha|beta|pre|next)'; then
+            echo "Pre-release identifier detected — skipping :latest."
+            PROMOTE="false"
+          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            PROMOTE="${PROMOTE_INPUT:-false}"
+          else
+            git fetch --tags --quiet || true
+            HIGHEST=$(git tag -l 'v[0-9]*' | sed 's/^v//' | grep -vE -- '-(rc|alpha|beta|pre|next)' | sort -V | tail -1 || echo "")
+            if [ -n "$HIGHEST" ] && [ "$VERSION" = "$HIGHEST" ]; then
+              PROMOTE="true"
+            else
+              echo "Version $VERSION is not the highest semver tag (highest=${HIGHEST:-<none>}). Not promoting :latest."
+            fi
+          fi
+          echo "promote_latest=$PROMOTE" >> "$GITHUB_OUTPUT"
+
+          # 3) Skip if this exact version is already published in Docker Hub.
+          #    `main` is always rebuilt (mutable floating tag).
+          SKIP="false"
+          if [ "$VERSION" != "main" ]; then
+            if docker manifest inspect "diegosouzapw/omniroute:${VERSION}" >/dev/null 2>&1; then
+              echo "Image diegosouzapw/omniroute:${VERSION} already exists on Docker Hub — skipping rebuild."
+              SKIP="true"
+            fi
+          fi
+          echo "skip=$SKIP" >> "$GITHUB_OUTPUT"
+
+          echo "Publishing diegosouzapw/omniroute:$VERSION (promote_latest=$PROMOTE, skip=$SKIP)"
 
       - name: Set up QEMU (for multi-arch builds)
+        if: steps.version.outputs.skip != 'true'
         uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
+        if: steps.version.outputs.skip != 'true'
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
+        if: steps.version.outputs.skip != 'true'
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
+        if: steps.version.outputs.skip != 'true'
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract version from release tag or input
-        id: version
+      - name: Compute image tags
+        id: tags
+        if: steps.version.outputs.skip != 'true'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          PROMOTE_LATEST: ${{ steps.version.outputs.promote_latest }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="${{ inputs.version }}"
-          else
-            VERSION="${GITHUB_REF_NAME}"
-            VERSION="${VERSION#v}"
+          set -euo pipefail
+          TAGS="${IMAGE_NAME}:${VERSION}"
+          TAGS="${TAGS}"$'\n'"ghcr.io/diegosouzapw/omniroute:${VERSION}"
+          if [ "$PROMOTE_LATEST" = "true" ]; then
+            TAGS="${TAGS}"$'\n'"${IMAGE_NAME}:latest"
+            TAGS="${TAGS}"$'\n'"ghcr.io/diegosouzapw/omniroute:latest"
           fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Publishing Docker image: $IMAGE_NAME:$VERSION"
+          {
+            echo "tags<<EOF"
+            echo "$TAGS"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+          echo "Tags to push:"
+          echo "$TAGS"
 
       - name: Build and push multi-arch image
+        if: steps.version.outputs.skip != 'true'
         uses: docker/build-push-action@v7
         with:
           context: .
           target: runner-base
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: |
-            ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
-            ${{ env.IMAGE_NAME }}:latest
-            ghcr.io/diegosouzapw/omniroute:${{ steps.version.outputs.version }}
-            ghcr.io/diegosouzapw/omniroute:latest
+          tags: ${{ steps.tags.outputs.tags }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           no-cache: false
         env:
           DOCKER_BUILDKIT_INLINE_CACHE: 1
 
       - name: Inspect image
+        if: steps.version.outputs.skip != 'true' && steps.version.outputs.version != 'main'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          docker buildx imagetools inspect "${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}"
+          docker buildx imagetools inspect "${IMAGE_NAME}:${VERSION}"
 
       - name: Update Docker Hub description
+        # Only refresh README/description when we actually promote :latest
+        # (avoids overwriting from main pushes or back-fill builds).
+        if: steps.version.outputs.skip != 'true' && steps.version.outputs.promote_latest == 'true'
         uses: peter-evans/dockerhub-description@v5
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}