docs(security): document full LOCAL_ONLY route set + GHSA advisory + audit path (#5599)

CLAUDE.md

@@ -540,7 +540,7 @@ the stale-enforcement added in Fase 6A.3.
 18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
 19. Never develop on the shared main checkout. Every development task runs in its own git worktree on its own dedicated branch, and you MUST confirm the base branch with the operator (e.g. via `AskUserQuestion`) before creating the worktree/branch — never assume `main` or the currently checked-out branch. A `git checkout` in the shared checkout silently destroys other sessions' uncommitted work. Tear down only the worktrees/branches you created (by name, never `fix/*`/`feat/*` wildcards), leave other sessions' worktrees untouched, and end on the branch you started on (the active `release/vX.Y.Z`, never `main`). See Git Workflow → "Worktree isolation".
 20. PII redaction/sanitization is **opt-in — never on by default**. OmniRoute proxies for self-hosted/local LLMs where the operator owns the data, so mutating request/response payloads by default would silently corrupt legitimate traffic. The two data-mutating PII feature flags **MUST** keep `defaultValue: "false"` in `src/shared/constants/featureFlagDefinitions.ts`: `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response + streaming). All three application points — `src/lib/guardrails/piiMasker.ts` (request guardrail), `src/lib/piiSanitizer.ts` (response), `src/lib/streamingPiiTransform.ts` (SSE) — are gated on these flags; with both off the `pii-masker` guardrail still runs but never mutates payloads (data passes through untouched). Flipping either default to `"true"` requires explicit operator approval. The regression guard is `tests/unit/pii-opt-in-default.test.ts` (asserts both definition defaults + behavioral pass-through). Opt-in is per-operator via env or the settings/DB override (`src/lib/db/featureFlags.ts`), never a silent default. See `docs/security/GUARDRAILS.md`.
-21. **Release-freeze — the release branch is frozen to campaign merges while a `/generate-release` is running.** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a) and closes it once the release PR squash-merges to `main`. Before merging **any** PR into the active `release/vX.Y.Z` branch, every campaign workflow (`/review-issues`, `/review-prs`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active, **HOLD the merge** (leave the PR ready and open; do NOT merge to the release branch), tell the operator, and resume once the freeze lifts. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they *are* the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`.
+21. **Release-freeze — the release branch is frozen to campaign merges while a `/generate-release` is running.** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a) and closes it once the release PR squash-merges to `main`. Before merging **any** PR into the active `release/vX.Y.Z` branch, every campaign workflow (`/review-issues`, `/review-prs`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active, **HOLD the merge** (leave the PR ready and open; do NOT merge to the release branch), tell the operator, and resume once the freeze lifts. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they _are_ the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`.
 
 ---
 

bin/cli/commands/setup-claude.mjs

@@ -75,7 +75,7 @@ export async function syncClaudeProfilesFromModels(models, opts = {}) {
   const profiles = [];
 
   for (const m of models) {
-    const id = typeof m === "string" ? m : m.id ?? "";
+    const id = typeof m === "string" ? m : (m.id ?? "");
     if (!id) {
       skipped++;
       continue;
@@ -115,7 +115,9 @@ export async function syncClaudeProfilesFromModels(models, opts = {}) {
  */
 export async function runSetupClaudeCommand(opts = {}) {
   const port = Number(opts.port ?? process.env.PORT ?? 20128) || 20128;
-  const baseUrl = (opts.remote ?? `http://localhost:${port}`).replace(/\/+$/, "").replace(/\/v1$/, "");
+  const baseUrl = (opts.remote ?? `http://localhost:${port}`)
+    .replace(/\/+$/, "")
+    .replace(/\/v1$/, "");
   const apiKey = opts.apiKey ?? opts["api-key"] ?? process.env.OMNIROUTE_API_KEY ?? "";
   const claudeHome = opts.claudeHome ?? opts["claude-home"] ?? join(os.homedir(), ".claude");
   const profilesRoot = join(claudeHome, "profiles");
@@ -163,7 +165,9 @@ export async function runSetupClaudeCommand(opts = {}) {
     if (skipped > 0) printInfo(`${skipped} models skipped (no matching profile pattern)`);
     console.log("\nTo use a profile:");
     console.log("  omniroute launch --profile <name>     # e.g. omniroute launch --profile glm52");
-    console.log("  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)");
+    console.log(
+      "  # or: CLAUDE_CONFIG_DIR=~/.claude/profiles/<name> claude  (export ANTHROPIC_AUTH_TOKEN first)"
+    );
   } else {
     console.log(`\n[dry-run] ${written} profiles would be written (${skipped} skipped)`);
   }
@@ -182,7 +186,10 @@ export function registerSetupClaude(program) {
     .option("--remote <url>", "Remote OmniRoute URL, e.g. http://192.168.0.15:20128")
     .option("--api-key <key>", "OmniRoute API key (defaults to OMNIROUTE_API_KEY env var)")
     .option("--claude-home <dir>", "Claude home dir (default: ~/.claude)")
-    .option("--only <patterns>", "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)")
+    .option(
+      "--only <patterns>",
+      "Comma-separated substrings — only matching model IDs (e.g. glm,kimi)"
+    )
     .option("--dry-run", "Print what would be written without touching the filesystem")
     .action(async (opts) => {
       const exitCode = await runSetupClaudeCommand(opts);

bin/cli/commands/setup-codex.mjs

@@ -39,29 +39,83 @@ export function categoriseModel(modelId) {
     { re: /kmc\/kimi-k2\.6/, name: "kimi-k26", ctx: 131072, compact: 112000, toolLimit: 32768 },
     { re: /glm\/glm-5\.2-max/, name: "glm52max", ctx: 131072, compact: 112000, toolLimit: 32768 },
     { re: /glm\/glm-5\.2$/, name: "glm52", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5-pro/, name: "mimo-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/qwen3\.7-plus/, name: "qwen37plus", ctx: 32768, compact: 28000, toolLimit: 16384 },
+    {
+      re: /opencode-go\/mimo-v2\.5-pro/,
+      name: "mimo-pro",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
+    {
+      re: /opencode-go\/qwen3\.7-plus/,
+      name: "qwen37plus",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
   ];
 
   // ── Good models (high effort) ─────────────────────────────────────────────
   const goodPatterns = [
-    { re: /ollamacloud\/deepseek-v4-pro/, name: "deepseek-pro", ctx: 131072, compact: 112000, toolLimit: 32768 },
-    { re: /opencode-go\/mimo-v2\.5$/, name: "mimo", ctx: 131072, compact: 112000, toolLimit: 32768 },
+    {
+      re: /ollamacloud\/deepseek-v4-pro/,
+      name: "deepseek-pro",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
+    {
+      re: /opencode-go\/mimo-v2\.5$/,
+      name: "mimo",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 32768,
+    },
   ];
 
   // ── Simple models (no effort) ─────────────────────────────────────────────
   const simplePatterns = [
     { re: /ollamacloud\/gemma4:31b/, name: "gemma4", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/nemotron-3-super/, name: "nemotron", ctx: 32768, compact: 28000, toolLimit: 16384 },
-    { re: /ollamacloud\/gpt-oss:20b/, name: "gptoss", ctx: 32768, compact: 28000, toolLimit: 16384 },
+    {
+      re: /ollamacloud\/nemotron-3-super/,
+      name: "nemotron",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
+    {
+      re: /ollamacloud\/gpt-oss:20b/,
+      name: "gptoss",
+      ctx: 32768,
+      compact: 28000,
+      toolLimit: 16384,
+    },
   ];
 
   // ── Fast models (low effort) ──────────────────────────────────────────────
   const fastPatterns = [
-    { re: /ollamacloud\/deepseek-v4-flash/, name: "deepseek-flash", ctx: 65536, compact: 56000, toolLimit: 16384 },
-    { re: /ollamacloud\/gemini-3-flash/, name: "gemini-flash", ctx: 1000000, compact: 850000, toolLimit: 32768 },
+    {
+      re: /ollamacloud\/deepseek-v4-flash/,
+      name: "deepseek-flash",
+      ctx: 65536,
+      compact: 56000,
+      toolLimit: 16384,
+    },
+    {
+      re: /ollamacloud\/gemini-3-flash/,
+      name: "gemini-flash",
+      ctx: 1000000,
+      compact: 850000,
+      toolLimit: 32768,
+    },
     { re: /glm\/glm-5-turbo/, name: "glm5turbo", ctx: 131072, compact: 112000, toolLimit: 16384 },
-    { re: /glm\/glm-4\.7-flash/, name: "glm47flash", ctx: 131072, compact: 112000, toolLimit: 16384 },
+    {
+      re: /glm\/glm-4\.7-flash/,
+      name: "glm47flash",
+      ctx: 131072,
+      compact: 112000,
+      toolLimit: 16384,
+    },
   ];
 
   for (const p of thinkingPatterns) {
@@ -146,7 +200,11 @@ export function fallbackCodexProfile(modelId, model) {
   const ctx =
     typeof model === "string"
       ? 128000
-      : firstPositiveNumber(model.context_length, model.max_context_window_tokens, model.max_input_tokens) ?? 128000;
+      : (firstPositiveNumber(
+          model.context_length,
+          model.max_context_window_tokens,
+          model.max_input_tokens
+        ) ?? 128000);
   const maxOutput =
     typeof model === "string"
       ? null
@@ -316,10 +374,7 @@ export function registerSetupCodex(program) {
       "--api-key <key>",
       "OmniRoute API key for the remote instance (defaults to OMNIROUTE_API_KEY env var)"
     )
-    .option(
-      "--codex-home <dir>",
-      "Directory where profile files are written (default: ~/.codex)"
-    )
+    .option("--codex-home <dir>", "Directory where profile files are written (default: ~/.codex)")
     .option(
       "--only <patterns>",
       "Comma-separated substrings — only generate profiles for matching model IDs (e.g. glm,kimi)"