fix(context): calibrate the chars/4 guard estimate with provider-reported prompt_tokens

.env.example

@@ -22,9 +22,12 @@ JWT_SECRET=
 API_KEY_SECRET=
 
 # Initial admin login password — CHANGE THIS before first use!
-# Used by: bootstrap only — sets the initial dashboard password on first boot.
+# Used by: src/lib/auth/managementPassword.ts — sets the dashboard password at startup
+# while none is saved yet; ignored once a password is saved.
 # After first login you can change it from Dashboard → Settings → Security.
-# Default: CHANGEME (insecure, for local dev only)
+# CHANGEME (this template's value) is publicly known. npm and source installs copy this
+# file to .env, so replace CHANGEME there before first boot, or set INITIAL_PASSWORD=
+# (empty) there to create the password in the dashboard's onboarding wizard instead.
 INITIAL_PASSWORD=CHANGEME
 
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -552,20 +555,36 @@ ALLOW_API_KEY_REVEAL=false
 # CORS_ORIGIN=https://your-frontend.example.com  # legacy single-origin alias
 # CORS_ALLOW_ALL=false
 
-# Allow provider URLs pointing to private/local networks (localhost, 192.168.x.x, etc.).
-# REQUIRED for self-hosted providers: LM Studio, Ollama, vLLM, Llamafile, Triton, etc.
-# Used by: src/shared/network/outboundUrlGuard.ts — disables SSRF guard for provider calls.
-# Default: false (blocked)  |  Set true to enable local providers.
+# Turns off the outbound URL guard's host checks, cloud-metadata block included, on the
+# provider paths that follow the guard mode: URL validation, model discovery, provider-node
+# base URLs (including remote rerank nodes), and the proxy-fallback test, among other
+# provider-adjacent outbound paths such as remote image/media fetch. It also allows
+# private webhook targets, except cloud-metadata/link-local endpoints, which stay
+# blocked even with this flag on. Local providers work with the defaults:
+# OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS below (default true) already allows local and LAN
+# URLs. A value saved from the dashboard toggle takes precedence over this variable.
+# Details: docs/reference/ENVIRONMENT.md.
+# Used by: src/shared/network/outboundUrlGuardPolicy.ts
+# Default: false
 # OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS=true
 
-# Allow adding/validating providers on local/private addresses (127.0.0.1, localhost, LAN).
-# Used by: src/shared/network/outboundUrlGuard.ts — scopes to the provider validation path and
-# still blocks cloud-metadata (169.254.169.254, metadata.google.internal). Default: true
-# (OmniRoute is local-first). Set false to enforce strict public-only blocking.
+# Allow provider URLs on local and private addresses (127.0.0.1, localhost, LAN).
+# Default: true (OmniRoute is local-first); the guard then blocks cloud-metadata
+# endpoints — all of 169.254.0.0/16 plus the known metadata hostnames. Set false to
+# block private and loopback hosts too (public-only mode). The guard checks the
+# hostname or IP literal as written first; in public-only mode the safe-fetch
+# wrapper (validation, model discovery) also resolves the name and refuses
+# private answers.
+# Built-in local providers skip these checks for key validation and chat.
+# A value saved from the dashboard toggle takes precedence over this variable.
+# Used by: src/shared/network/outboundUrlGuardPolicy.ts
 # OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS=false
 
-# Legacy alias toggling the SSRF guard. Used by: src/shared/network/outboundUrlGuard.ts
-# When unset, OmniRoute uses the per-feature defaults. Set to "false"/"0" to disable.
+# Legacy alias; its dashboard toggle (a DB override) is read before this environment value.
+# "false", "0", "no", or "off" in either turns the host checks off the way
+# OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS=true does, even when that flag's dashboard toggle
+# is saved off. Other values leave the guard to the two flags above.
+# Used by: src/shared/network/outboundUrlGuardPolicy.ts
 # OUTBOUND_SSRF_GUARD_ENABLED=true
 
 # ── Self-hosted unified OpenAI-compatible entry (RIC-738, D4) ────────────────────
@@ -888,6 +907,12 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Set to 1 only for legacy diagnostics. Values above 256 are capped.
 # OMNIROUTE_PROXY_DISPATCHER_CONNECTIONS=32
 
+# HTTP/2 negotiation for Undici upstream dispatchers (direct, HTTP/SOCKS proxies,
+# relays and their retries). Explicit false/0/no/off forces HTTP/1.1.
+# Does not control wreq TLS fingerprinting or provider-specific transports.
+# Restart OmniRoute after changing this value; dispatchers are cached.
+# OMNIROUTE_UPSTREAM_HTTP2_ENABLED=true
+
 # SOCKS5 handshake (connect) timeout in ms (default 10000, capped at 120000).
 # Raise it when a single residential gateway host is hit by high concurrency
 # (e.g. 100 simultaneous requests): the real SOCKS5 handshake can exceed 10s
@@ -1686,6 +1711,8 @@ CURSOR_USER_AGENT="Cursor/3.4"
 # FETCH_TIMEOUT_MS=600000            # Total request timeout (default: 600000 = 10 min)
 #                                     # Also drives anthropic-compatible-cc-* X-Stainless-Timeout.
 # FETCH_HEADERS_TIMEOUT_MS=600000    # Time to receive response headers
+# Maximum response-header wait (ms) for streaming requests. Default: 110000; 0 disables.
+# OMNIROUTE_FETCH_START_TIMEOUT_CAP_MS=110000
 # FETCH_BODY_TIMEOUT_MS=600000       # Time to receive full response body
 # FETCH_CONNECT_TIMEOUT_MS=30000     # TCP connection establishment (default: 30s)
 # FETCH_KEEPALIVE_TIMEOUT_MS=4000    # Keep-alive socket idle timeout (default: 4s)
@@ -2234,6 +2261,13 @@ APP_LOG_TO_FILE=true
 # Default: 2592000000 (30 days)
 # OMNIROUTE_SYNCED_CATALOG_STALE_AFTER_MS=2592000000
 
+# Response cache for GET /api/usage/analytics (#15629). Only responses that took at
+# least MIN_COMPUTE_MS to build are kept, per query string, for TTL_MS.
+# Used by: src/lib/usage/analyticsResponseCache.ts
+# Default: 60000 (60 seconds; 0 disables) and 1000 (1 second)
+# OMNIROUTE_ANALYTICS_CACHE_TTL_MS=60000
+# OMNIROUTE_ANALYTICS_CACHE_MIN_COMPUTE_MS=1000
+
 # ── NanoBanana (Image Generation) ──
 # Polling config for async image generation jobs.
 # Used by: open-sse/handlers/imageGeneration.ts
@@ -2488,6 +2522,13 @@ APP_LOG_TO_FILE=true
 # never used for routing). "true" (or 1, yes) enables it.
 # PROXY_POOL_EGRESS_OBSERVATION=false
 
+# Opt-in: skip the scheduler probe for proxies already proven by recent
+# production traffic (single provider, no recent proxy failure). Default: off.
+# PROXY_HEALTH_PASSIVE_SKIP=false
+# Window in ms of production traffic the passive skip looks at (60000..599999).
+# Default: 300000 (5min).
+# PROXY_PASSIVE_WINDOW_MS=300000
+
 # Allow OAuth and provider validation flows to bypass a pinned proxy and connect
 # directly when proxy reachability pre-checks fail. Default: false.
 # Also configurable from Dashboard > Settings > Feature Flags.
@@ -2874,9 +2915,8 @@ APP_LOG_TO_FILE=true
 # hosted outside localhost, e.g. a LAN box or Tailscale peer running TEI/Infinity/vLLM.
 # OFF by default: routing to a remote host changes egress identity, so it must be an
 # explicit operator decision. Loopback/private nodes (localhost, 127.0.0.1,
-# 172.16-31.x) are always allowed and unaffected by this flag. Remote nodes must also
-# pass the provider outbound URL policy (see OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS);
-# cloud-metadata hosts are never routed to.
+# 172.16-31.x) are always allowed and unaffected by this flag. A remote node's base URL
+# must also pass the provider outbound URL policy (see OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS).
 # RERANK_REMOTE_PROVIDER_NODES=false
 
 # ── Free Proxy Pool (auto-sync scheduler) ──
@@ -3017,6 +3057,8 @@ APP_LOG_TO_FILE=true
 # OMNIROUTE_TRANSLATION_MODEL=gpt-4o-mini
 # Per-request timeout in milliseconds (default 60000).
 # OMNIROUTE_TRANSLATION_TIMEOUT_MS=60000
+# Optional reasoning control, sent as-is to the translation backend when set (e.g. none).
+# OMNIROUTE_TRANSLATION_REASONING_EFFORT=
 # Number of parallel translation requests (default 4).
 # OMNIROUTE_TRANSLATION_CONCURRENCY=4
 

.env.selfhost.example

@@ -23,11 +23,15 @@ APP_BIND_HOST=127.0.0.1
 
 # ── Auth ──────────────────────────────────────────────────────────────
 # false = the dashboard and /v1 proxy are open to APP_BIND_HOST's network.
-# true  = every request needs an API key / dashboard login. The dashboard
-#         auto-creates INITIAL_PASSWORD on first boot (read it from the logs:
-#         `docker logs omniroute | grep -i password`). # EDIT ME — set true.
+# true  = /v1 requests need an API key (a logged-in dashboard session also works);
+#         the dashboard needs login once a password
+#         exists. Create the login password in the onboarding wizard on first visit
+#         (skipping that step turns dashboard login off, even with
+#         REQUIRE_API_KEY=true); after you submit it, the wizard asks for
+#         a one-time token from `docker logs omniroute | grep BOOTSTRAP`.
+#         # EDIT ME — set true.
 REQUIRE_API_KEY=false
-# INITIAL_PASSWORD=                  # uncomment to pre-seed the dashboard password
+# INITIAL_PASSWORD=strong-password-here # fill in to pre-seed the dashboard password (an empty value behaves like unset)
 
 # ── Memory ceiling (V8 old-space) ──────────────────────────────────────
 # 1024 = dashboard + light chat. Coding agents (long POST /v1/responses

.github/workflows/ci.yml

@@ -741,6 +741,10 @@ jobs:
       - run: npm run build
         env:
           OMNIROUTE_USE_TURBOPACK: "1"
+      - name: Verify colocated compression worker
+        run: node --import tsx/esm --test tests/integration/compression-worker-standalone.int.test.ts
+        env:
+          RUN_STANDALONE_INT: "1"
       - name: Archive Next.js build for downstream jobs
         # Use tar so the archive preserves paths relative to CWD (.build/next/...).
         # upload-artifact path-stripping is ambiguous when exclude patterns are used;
@@ -1066,7 +1070,7 @@ jobs:
       - name: Upload test results to Trunk (advisory)
         if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true
-        uses: trunk-io/analytics-uploader@817e1a2ec58d888825699ee15ea172809bb3f226 # v2.1.3
+        uses: trunk-io/analytics-uploader@14c0f18990953eecd01c9c5afe3cc63a73b6c371 # v2.1.5
         with:
           junit-paths: trunk-junit/**/*.xml
           org-slug: omniroute
@@ -1399,7 +1403,7 @@ jobs:
       - name: Upload test results to Trunk (advisory)
         if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true
-        uses: trunk-io/analytics-uploader@817e1a2ec58d888825699ee15ea172809bb3f226 # v2.1.3
+        uses: trunk-io/analytics-uploader@14c0f18990953eecd01c9c5afe3cc63a73b6c371 # v2.1.5
         with:
           junit-paths: junit-e2e-results.xml
           org-slug: omniroute

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:javascript-typescript"

.github/workflows/docker-publish.yml

@@ -584,7 +584,7 @@ jobs:
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.38.1
+        uses: github/codeql-action/upload-sarif@v4.38.2
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image

.github/workflows/quality.yml

@@ -230,16 +230,20 @@ jobs:
             route-guard-membership test-discovery test-runner-api
             mutation-test-coverage any-budget:t11 build-scope pack-policy
             complexity-ratchets model-lifecycle
-            cycles lockfile duplication dead-code type-coverage compression-budget
+            lockfile duplication dead-code type-coverage compression-budget
             # #8781: open-sse workspace typecheck gate — the workspace imports @/ which
             # escapes to src/ via undeclared path aliases. See check-open-sse-typecheck.mjs.
             open-sse-typecheck
             # Hard Rule #16 — AI/bot attribution in PR commits, title or body (#14436). Reads the PR
             # from GITHUB_EVENT_PATH; no-op on non-PR events. ci.yml only runs on PRs to main.
             ai-attribution
           )
+          # Ratchet-mode gates append --ratchet. `cycles` belongs here since #15281
+          # (69cb18dca8): check-cycles.mjs exits 1 on ANY cycle without --ratchet, and
+          # the frozen ceiling lives in quality-baseline.json → metrics.cycles — same
+          # `check:cycles:ratchet` semantics ci.yml runs (base-red #15306).
           ratchet_gates=(
-            secrets vuln-ratchet workflows openapi-breaking
+            secrets vuln-ratchet workflows openapi-breaking cycles
           )
           failed=()
           for g in "${gates[@]}"; do
@@ -405,7 +409,7 @@ jobs:
       - name: Upload test results to Trunk (advisory)
         if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true
-        uses: trunk-io/analytics-uploader@817e1a2ec58d888825699ee15ea172809bb3f226 # v2.1.3
+        uses: trunk-io/analytics-uploader@14c0f18990953eecd01c9c5afe3cc63a73b6c371 # v2.1.5
         with:
           junit-paths: trunk-junit/**/*.xml
           org-slug: omniroute