Fix/codex quota header leak

.env.example

@@ -486,6 +486,12 @@ NEXT_PUBLIC_CLOUD_URL=
 # Values: true/loopback (trust loopback proxy peers), private/lan (also trust LAN peers).
 # OMNIROUTE_TRUST_PROXY=
 
+# Client IP trust for login lockout/audit: additional exact proxy IPs or CIDRs.
+# Loopback is trusted by default. Only list controlled proxies that overwrite XFF
+# or append their immediate peer; block direct public access to the backend.
+# Example for a dedicated Docker bridge: 172.19.0.0/16
+# OMNIROUTE_TRUSTED_PROXY_IPS=
+
 # Public callback URL for asynchronous image/audio jobs (kie.ai, etc.).
 # Used by: open-sse/utils/kieTask.ts — overrides callbackUrlFromBaseUrl().
 # Honor order: KIE_CALLBACK_URL → OMNIROUTE_KIE_CALLBACK_URL → OMNIROUTE_PUBLIC_URL.
@@ -504,19 +510,11 @@ NEXT_PUBLIC_CLOUD_URL=
 # open-sse/services/usage.ts.
 #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/
 #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com
-#OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota
-#OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit
-#OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace
+# Official OpenCode Go usage endpoint, authenticated with the connection API key.
+# Override only for relays or test fixtures.
+#OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/usage
 #OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings
 
-# OpenCode Go dashboard quota scraping. Prefer configuring these per connection
-# in Dashboard → Providers → OpenCode Go. Env vars are useful for headless
-# deployments or shared server defaults. The cookie is sensitive.
-#OPENCODE_GO_WORKSPACE_ID=wrk_...
-#OMNIROUTE_OPENCODE_GO_WORKSPACE_ID=wrk_...
-#OPENCODE_GO_AUTH_COOKIE=auth=...
-#OMNIROUTE_OPENCODE_GO_AUTH_COOKIE=auth=...
-
 # OpenCode Go/Zen VPS egress (#5997): on a datacenter VPS, Cloudflare in front of
 # opencode.ai/zen/go 403s chat requests that lack OpenCode CLI identity headers.
 # When your clients don't already send them, set this to synthesize the CLI headers
@@ -994,7 +992,7 @@ CLAUDE_USER_AGENT="claude-cli/2.1.207 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.144.1 (Windows 10.0.26200; x64)"
+CODEX_USER_AGENT="codex-cli/0.153.4 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.54.0"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
@@ -1015,7 +1013,7 @@ CURSOR_USER_AGENT="Cursor/3.4"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.144.1
+# CODEX_CLIENT_VERSION=0.153.4
 
 # Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
 # from the Codex Responses stream. These frames break the OpenAI SDK's
@@ -1173,6 +1171,19 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # STREAM_READINESS_TIMEOUT_MS=80000  # Time to receive the first non-ping SSE event
 # STREAM_READINESS_MAX_TIMEOUT_MS=180000 # Cap for adaptive first-event extensions
 #                                         # (large/tool-heavy/high-reasoning requests).
+# ── Early SSE keepalive / stream default (fork.4) ──
+# How long a streaming route waits for the handler before committing a 200 SSE
+# keepalive. Before the commit an upstream failure still reaches the client as a real
+# HTTP status; after it, the status is pinned to 200 and the error can only be sent
+# in-band. Must stay under Codex CLI reqwest's ~5s idle-read timeout: values >4500 or
+# <0 fall back to the default. Set 2000 to restore the pre-fork.4 behavior.
+# OMNIROUTE_KEEPALIVE_THRESHOLD_MS=4000
+#
+# Default stream resolution for clients that omit `stream` and send a wildcard Accept
+# (python-httpx et al.). "legacy" streams them; "json" routes them through the
+# non-streaming path, where upstream 502/429 statuses survive to the client.
+# A per-key streamDefaultMode always overrides this.
+# OMNIROUTE_STREAM_DEFAULT_MODE=legacy
 # OMNIROUTE_AGENT_GOAL_POLICY_ENABLED=true             # Kill-switch for the /goal heuristic below.
 #                                                       # Set to false to fully disable detection —
 #                                                       # readiness timeouts and stream recovery are
@@ -1293,6 +1304,10 @@ APP_LOG_TO_FILE=true
 # not the cgroup limit, so leaving it to a RAM heuristic can oversize the heap and
 # get the container OOM-killed. (#2939)
 # OMNIROUTE_MEMORY_MB=512
+# Maximum concurrent background fact-extraction jobs. Keep at 1 on small VPS instances.
+# OMNIROUTE_MEMORY_EXTRACTION_CONCURRENCY=1
+# Maximum queued background fact-extraction jobs. New jobs are dropped when this is full.
+# OMNIROUTE_MEMORY_EXTRACTION_QUEUE_MAX=100
 
 # Heap-pressure shed threshold (MB) — chatCore returns 503 when V8 heapUsed exceeds
 # it, to avoid hard OOM under concurrent large-context load.

.github/workflows/fork-image-fenix007.yml

@@ -0,0 +1,156 @@
+name: Fork Image (fenix007)
+
+# Builds the stable-branch fork image (v3.8.48 + our patch set) and publishes it
+# to GHCR. Tag scheme deliberately avoids the upstream "v*" pattern so the
+# inherited release workflows (docker-publish, electron-release) never fire.
+#
+# Platforms build in separate jobs (like upstream docker-publish.yml): the
+# Dockerfile's shared apt cache mounts deadlock when two platforms build
+# concurrently in one buildx invocation.
+on:
+  push:
+    branches: [stable]
+    tags:
+      - "*-fork.*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  IMAGE_NAME: ghcr.io/fenix007/omniroute
+
+jobs:
+  build:
+    name: Build ${{ matrix.arch }}
+    if: github.repository == 'fenix007/OmniRoute'
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Resolve fork version label
+        id: fork-version
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [ "$REF_TYPE" = "tag" ]; then
+            printf 'version=%s\n' "$REF_NAME" >> "$GITHUB_OUTPUT"
+          else
+            printf 'version=fork · sha-%s\n' "${GITHUB_SHA:0:7}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # target mirrors upstream docker-publish.yml's main image (plain tag =
+      # runner-base; the -web variant is not built here).
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          target: runner-base
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+          tags: ${{ env.IMAGE_NAME }}
+          build-args: |
+            OMNIROUTE_FORK_VERSION=${{ steps.fork-version.outputs.version }}
+          cache-from: type=gha,scope=fork-${{ matrix.arch }}
+          cache-to: type=gha,scope=fork-${{ matrix.arch }},mode=max
+
+      - name: Export digest
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          mkdir -p /tmp/digests
+          touch "/tmp/digests/${DIGEST#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v6
+        with:
+          name: digests-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    name: Merge manifest and tag
+    if: github.repository == 'fenix007/OmniRoute'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v7
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=stable,enable=${{ github.ref == 'refs/heads/stable' }}
+            type=sha,prefix=sha-
+            type=ref,event=tag
+          labels: |
+            org.opencontainers.image.title=omniroute
+            org.opencontainers.image.description=OmniRoute stable fork (v3.8.48 + fenix007 patch set)
+            org.opencontainers.image.url=https://github.com/fenix007/OmniRoute
+            org.opencontainers.image.source=https://github.com/fenix007/OmniRoute
+            org.opencontainers.image.licenses=MIT
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          tags=()
+          while IFS= read -r tag; do
+            [ -n "$tag" ] && tags+=(-t "$tag")
+          done <<< "$DOCKER_METADATA_OUTPUT_TAGS"
+          refs=()
+          for d in *; do
+            refs+=("${IMAGE_NAME}@sha256:${d}")
+          done
+          docker buildx imagetools create "${tags[@]}" "${refs[@]}"
+
+      - name: Inspect image
+        run: docker buildx imagetools inspect "${IMAGE_NAME}:${{ steps.meta.outputs.version }}"

Dockerfile

@@ -1,5 +1,9 @@
 # ── Common base with runtime deps ──────────────────────────────────────────
-FROM node:24-trixie-slim AS base
+# Pinned to the node version upstream built the working v3.8.48 images with
+# (NODE_VERSION=24.18.0 in diegosouzapw/omniroute:3.8.48). Newer node:24 minors
+# SIGABRT better-sqlite3 12.11.1 (this base's lockfile) inside the Next.js
+# build worker on both amd64 and arm64.
+FROM node:24.18.0-trixie-slim AS base
 WORKDIR /app
 
 # `apt-get upgrade` pulls the security-patched versions of the Debian (trixie)
@@ -98,6 +102,11 @@ ENV OMNIROUTE_MITM_STUB=1
 ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
 
+# Tagged fork builds expose their release identifier in the client bundle so the
+# admin sidebar can distinguish the frozen upstream base from the deployed patch set.
+ARG OMNIROUTE_FORK_VERSION=""
+ENV NEXT_PUBLIC_OMNIROUTE_FORK_VERSION=${OMNIROUTE_FORK_VERSION}
+
 COPY . ./
 RUN --mount=type=cache,id=next-cache,target=/app/.build/next/cache \
   mkdir -p /app/data && npm run build