Release v3.8.26

.github/workflows/ci.yml

@@ -88,6 +88,15 @@ jobs:
       # coverage mergeado). Tamanho de arquivo e duplicação têm gates dedicados.
       - name: Ratchet check
         run: node scripts/quality/check-quality-ratchet.mjs --summary .artifacts/quality-ratchet.md
+      # Fase 6A.5: require-tighten — ADVISORY por enquanto (continue-on-error). Reporta
+      # quando uma métrica MELHOROU sem o baseline ter sido apertado no mesmo PR (força
+      # capturar ganhos permanentes). As métricas coverage.* carregam tightenSlack para
+      # o gap anti-flake (CI mergeado > baseline) não disparar falso-positivo. Promover a
+      # BLOQUEANTE no fim do ciclo removendo o `continue-on-error` (ver a nota
+      # _require_tighten_advisory em config/quality/quality-baseline.json).
+      - name: Require-tighten (advisory — flip to blocking at cycle-end)
+        continue-on-error: true
+        run: node scripts/quality/check-quality-ratchet.mjs --require-tighten
       # Catraca de duplicação (jscpd@4 sobre src+open-sse). Roda neste job (paralelo)
       # para não pesar no caminho crítico do lint.
       - name: Duplication ratchet
@@ -188,6 +197,30 @@ jobs:
       - name: i18n translation drift (warn)
         run: node scripts/i18n/check-translation-drift.mjs --warn
 
+  docs-lint:
+    name: Docs Lint (prose — advisory)
+    runs-on: ubuntu-latest
+    # Advisory (warning-first): prose/markdown style must not block merges while the
+    # existing doc corpus is brought up to style. Promote to blocking once it converges.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - name: markdownlint (docs + root, advisory)
+        run: npx --yes markdownlint-cli2 "docs/**/*.md" "*.md" "!docs/i18n" "!docs/research" || true
+      - name: Vale prose lint (Microsoft style, advisory)
+        # Non-fatal: a Vale/reviewdog setup error must not turn this advisory job red.
+        continue-on-error: true
+        uses: errata-ai/vale-action@reviewdog
+        with:
+          files: docs
+          fail_on_error: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   i18n-ui-coverage:
     name: i18n UI Coverage
     runs-on: ubuntu-latest
@@ -511,10 +544,11 @@ jobs:
           path: coverage-shards/
           merge-multiple: true
       - name: Merge + report + gate
-        # Merging 8 shards of raw v8 coverage is memory-heavy; the default Node
-        # heap OOMs (exit 134). Raise it for the c8 merge/report step.
+        # Merging 8 shards of raw v8 coverage is memory-heavy; the 6 GB heap can
+        # still OOM on large PR runs. Keep this job focused on the gate and
+        # JSON summary that downstream ratchets consume.
         env:
-          NODE_OPTIONS: --max-old-space-size=6144
+          NODE_OPTIONS: --max-old-space-size=8192
         run: |
           mkdir -p coverage
           if [ ! -d coverage-shards ] || ! find coverage-shards -maxdepth 1 -type f -name '*.json' | grep -q .; then
@@ -532,9 +566,7 @@ jobs:
             --temp-directory coverage-shards \
             --reports-dir coverage \
             --reporter=text-summary \
-            --reporter=html \
             --reporter=json-summary \
-            --reporter=lcov \
             --exclude=tests/** \
             --exclude=**/*.test.* \
             --check-coverage \
@@ -563,7 +595,6 @@ jobs:
           name: coverage-report
           path: |
             coverage/coverage-summary.json
-            coverage/lcov.info
             coverage/coverage-report.md
           if-no-files-found: warn
 

.github/workflows/nightly-llm-security.yml

@@ -43,16 +43,35 @@ jobs:
   garak:
     name: garak probes (skip without provider secret)
     runs-on: ubuntu-latest
-    if: ${{ secrets.PROMPTFOO_PROVIDER_KEY != '' }}
+    # NOTE: the `secrets` context is NOT available in a job-level `if:` — referencing
+    # it there makes GitHub reject the file on push (startup_failure on every push).
+    # Map the secret into a job-level env and gate each step on a presence check, so
+    # the job stays green and simply skips the probes when the secret is absent.
+    env:
+      PROMPTFOO_PROVIDER_KEY: ${{ secrets.PROMPTFOO_PROVIDER_KEY }}
     steps:
+      - name: Gate on provider secret
+        id: gate
+        run: |
+          if [ -n "$PROMPTFOO_PROVIDER_KEY" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::PROMPTFOO_PROVIDER_KEY not set — skipping garak probes (advisory)."
+          fi
       - uses: actions/checkout@v6
+        if: steps.gate.outputs.run == 'true'
       - uses: actions/setup-node@v6
+        if: steps.gate.outputs.run == 'true'
         with: { node-version: "24", cache: npm }
       - run: npm ci
+        if: steps.gate.outputs.run == 'true'
       - name: Build CLI bundle
+        if: steps.gate.outputs.run == 'true'
         env: { JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation }
         run: npm run build:cli
       - name: Start OmniRoute
+        if: steps.gate.outputs.run == 'true'
         env:
           JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
           PORT: "20128"
@@ -64,13 +83,16 @@ jobs:
             sleep 2
           done
       - uses: actions/setup-python@v5
+        if: steps.gate.outputs.run == 'true'
         with: { python-version: "3.12" }
       - run: pip install garak
+        if: steps.gate.outputs.run == 'true'
       - name: garak limited probes
+        if: steps.gate.outputs.run == 'true'
         env:
           OPENAI_API_KEY: ${{ secrets.PROMPTFOO_PROVIDER_KEY }}
           OPENAI_BASE_URL: http://localhost:20128/v1
         run: garak --model_type openai --model_name gpt-4o-mini --probes promptinject,dan,leakreplay --report_prefix garak-omniroute || true
       - name: Stop server
-        if: always()
+        if: always() && steps.gate.outputs.run == 'true'
         run: kill "$(cat server.pid)" || true

.github/workflows/nightly-mutation.yml

@@ -0,0 +1,37 @@
+name: Nightly Mutation
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stryker:
+    name: Stryker mutation testing (8 critical modules — advisory)
+    runs-on: ubuntu-latest
+    # Mutation testing is expensive (~200-500 mutants, 30-90 min). It runs only
+    # on the nightly schedule / manual dispatch, never on PRs. The score is NOT
+    # yet enforced as a ratchet (wired in a later INT phase) — for now the job
+    # just produces the HTML/JSON report and uploads it as an artifact.
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: npm
+      - run: npm ci
+      - name: Run Stryker (advisory)
+        id: stryker
+        continue-on-error: true
+        run: npx stryker run
+      - name: Upload mutation report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mutation-report
+          path: reports/mutation/
+          if-no-files-found: warn
+          retention-days: 14

.github/workflows/wiki-sync.yml

@@ -0,0 +1,69 @@
+name: Wiki Sync
+
+# Keeps the GitHub wiki in sync with docs/ on every release that lands on main.
+# The wiki has no native generator and historically drifts (it sat at "212+ providers /
+# 14 strategies / 37 MCP tools" while code was at 226 / 15 / 87, and new docs like
+# SUPPLY_CHAIN never appeared). This runs scripts/docs/sync-wiki.mjs, which:
+#   - ADDS any docs/ page missing from the wiki (curated; internal reports excluded),
+#   - syncs the four cover-page counts on Home.md.
+# It does NOT overwrite existing wiki pages by default: several docs sources still carry
+# stale counts (e.g. ARCHITECTURE.md says "177 providers" while the wiki cover is 226),
+# so blind overwrite would regress the wiki. Full content parity (--update-existing) is
+# gated on regenerating those sources — see docs/ops/DOCUMENTATION_AUDIT_REPORT.md.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "README.md"
+      - "AGENTS.md"
+      - "src/shared/constants/routingStrategies.ts"
+      - "config/i18n.json"
+      - "open-sse/mcp-server/server.ts"
+      - "scripts/docs/sync-wiki.mjs"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: wiki-sync
+  cancel-in-progress: false
+
+jobs:
+  sync-wiki:
+    name: Sync wiki with docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Clone wiki
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          git clone "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.wiki.git" wiki
+
+      - name: Sync wiki (add missing pages + cover counts)
+        run: node scripts/docs/sync-wiki.mjs --wiki-dir wiki
+
+      - name: Commit & push if changed
+        run: |
+          cd wiki
+          if [ -n "$(git status --porcelain)" ]; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git add -A
+            git commit -m "docs(wiki): auto-sync pages + cover counts with docs"
+            git push
+            echo "Wiki updated."
+          else
+            echo "Wiki already in sync — nothing to push."
+          fi

.gitignore

@@ -23,6 +23,11 @@ coverage/
 .build/**
 .out/**
 
+# Stryker mutation testing — ephemeral sandbox + generated reports (never commit)
+.stryker-tmp/
+reports/mutation/
+stryker-output-*.json
+
 
 # Memory Bank and Cursor rules (local-only AI agent context)
 memory-bank/
@@ -203,8 +208,11 @@ pr_reviews*.json
 
 # internal setup prompts with personal credentials — never commit
 CODEX-SETUP-PROMPT.md
-# Quality ratchet — métricas efêmeras (baseline é commitado, métricas não)
-quality-metrics.json
+# Quality ratchet — métricas efêmeras (baseline commitado em config/quality/; métricas não)
+config/quality/quality-metrics.json
+
+# Runtime logs (diretório local, nunca versionado)
+/logs/
 -home-diegosouzapw-dev-automações-bots-yt-downloader-20260504 .txt
 -home-diegosouzapw-dev-automações-bots-yt-downloader-20260410 .txt
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute.md

.markdownlint.json

@@ -0,0 +1,14 @@
+{
+  "_comment": "Advisory markdown lint for docs/ + root *.md. Rules that conflict with the existing doc style (heavy inline HTML, long lines, centered headings) are disabled so the gate stays signal-not-noise. Run: npm run lint:md",
+  "default": true,
+  "MD013": false,
+  "MD033": false,
+  "MD041": false,
+  "MD024": { "siblings_only": true },
+  "MD026": false,
+  "MD036": false,
+  "MD040": false,
+  "MD029": false,
+  "MD007": { "indent": 2 },
+  "MD046": false
+}

.mcp.json.example

@@ -0,0 +1,17 @@
+{
+  "$comment_purpose": "OPT-IN agent-lsp / LSP-in-the-loop (Quality Gates Fase 7 Task 15). Copy this file to `.mcp.json` to enable. It exposes a TypeScript language server to coding agents (Claude Code, etc.) so they get diagnostics / hover / go-to-definition / blast-radius BEFORE writing code — turning 'invented symbol' review-catches into impossible-at-edit-time. Pairs with `npm run typecheck:core` as a compile-before-claim check.",
+  "$comment_safety": "Shipped as `.example` (NOT `.mcp.json`) on purpose so it never auto-loads an unvetted server into everyone's session. Pick an MCP<->LSP bridge you trust and have verified locally, then drop in its package + args below. A broken MCP entry only logs a connection error; it does not break agent sessions. The underlying language server is `typescript-language-server` (npm, mature) — install via `npm i -g typescript-language-server typescript` or rely on npx.",
+  "mcpServers": {
+    "typescript-lsp": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "<your-mcp-lsp-bridge>",
+        "--lsp",
+        "typescript-language-server",
+        "--stdio"
+      ],
+      "$note": "Replace <your-mcp-lsp-bridge> with the concrete MCP<->LSP adapter you chose. It must speak MCP on stdio and proxy to `typescript-language-server --stdio`. Scope it to this repo's tsconfig (open-sse/tsconfig.json / tsconfig.json) for accurate diagnostics."
+    }
+  }
+}

.vale.ini

@@ -0,0 +1,15 @@
+# Advisory prose lint for OmniRoute docs (Vale — https://vale.sh).
+# Warning-first: surfaces vague language, passive voice, and terminology drift without
+# blocking CI. The Microsoft style is pulled by the CI step (vale sync / vale-action).
+# Project terms live in the OmniRoute vocabulary so they never read as misspellings.
+StylesPath = .vale/styles
+MinAlertLevel = warning
+Packages = Microsoft
+Vocab = OmniRoute
+
+[*.md]
+BasedOnStyles = Vale, Microsoft
+
+# Code-heavy reference docs and auto-generated catalogs are noisy under prose rules.
+[docs/reference/PROVIDER_REFERENCE.md]
+BasedOnStyles = Vale

.vale/styles/Vocab/OmniRoute/accept.txt

@@ -0,0 +1,50 @@
+OmniRoute
+combo
+combos
+[Cc]ombo
+[Aa]uto-[Cc]ombo
+MCP
+A2A
+ACP
+RTK
+Caveman
+Troglodita
+Qdrant
+FTS5
+SQLite
+LowDB
+OAuth
+PKCE
+SSE
+JSON-RPC
+LKGP
+P2C
+Antigravity
+Codex
+Kiro
+Qoder
+Pollinations
+LongCat
+Cerebras
+DeepSeek
+Groq
+Cline
+OpenCode
+Termux
+Electron
+Fumadocs
+Notion
+Obsidian
+WebDAV
+IPv4
+IPv6
+SOCKS5
+loopback
+backoff
+changelog
+i18n
+locale
+locales
+roadmap
+[Ww]ildcard
+upstream

@omniroute/opencode-plugin/package.json

@@ -3,19 +3,16 @@
   "version": "0.1.0",
   "description": "OpenCode plugin for the OmniRoute AI Gateway. Drives dynamic model discovery, /connect auth flow, and multi-instance OmniRoute providers via the official @opencode-ai/plugin contract.",
   "type": "module",
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.js",
+  "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "require": {
-        "types": "./dist/index.d.cts",
-        "default": "./dist/index.cjs"
-      }
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./runtime": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
     }
   },
   "files": [