Feat/features batch v3.8.0

.gitignore

@@ -153,3 +153,9 @@ http-client.private.env.json
 
 # Feature-triage ephemeral artifact (regenerated each run)
 _ideia/_triage.json
+
+# Private workflow / skill / command implementations
+# These contain proprietary multi-phase logic and should not be committed
+.agents/workflows/implement-features-ag.md
+.agents/skills/implement-features/
+.claude/commands/implement-features-cc.md

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Added
 
+- **feat(zed):** Zed IDE Docker support — when OmniRoute runs in Docker and Zed is on the host, the Import flow now returns a 422 with `zedDockerEnvironment: true` and the dashboard auto-expands a Manual Token Import panel (new `POST /api/providers/zed/manual-import` endpoint with Zod validation). Includes Docker detection utility (`/.dockerenv` + cgroup heuristics) and a setup guide at [`docs/providers/ZED-DOCKER.md`](docs/providers/ZED-DOCKER.md). ([#2306])
 - **feat(workflow):** `/implement-features` gains pre-flight triage script (`scripts/features/feature-triage.mjs`) classifying open feature requests into 8 buckets — fresh issues (<14d) stay dormant to give the community time to react, engagement override (≥5 👍 or ≥3 unique non-bot commenters) absorbs early, already-delivered detection via merged PRs + CHANGELOG + git log closes issues with version + PR reference, stale `need_details/` (>30d) is closed politely, aged `defer/` (>90d) is re-evaluated, and externally-closed issues clean up `_ideia/` automatically. Idea files now carry a YAML frontmatter snapshot enabling incremental comment re-sync. 53 unit tests cover the new logic.
 - **feat(providers):** add GitHub Models as a free provider — GPT-5, o-series, DeepSeek-R1, Llama 4, Grok 3 with GitHub PAT auth and dynamic model fetch from `api.github.com`. ([#2344](https://github.com/diegosouzapw/OmniRoute/pull/2344) — thanks @oyi77)
 - **feat(providers):** add Hackclub AI as a free provider — 30+ models, no credit card required, optional API key auth with passthrough model support. ([#2339](https://github.com/diegosouzapw/OmniRoute/pull/2339) — thanks @oyi77)
@@ -20,6 +21,7 @@
 - **feat(providers):** improve Cohere provider support, expanding models and accurately updating OpenAI context limits. ([#2313](https://github.com/diegosouzapw/OmniRoute/pull/2313) — thanks @backryun)
 - **feat(claude-web):** implement session-based Claude Web executor with auto-refresh authentication — enables direct Claude Web API access without an API key. ([#2283](https://github.com/diegosouzapw/OmniRoute/pull/2283) — thanks @oyi77)
 - **feat(skills):** add 5 CLI skill manifests + AgentSkills / OmniSkills dashboard pages — enables external AI agents to discover and invoke OmniRoute capabilities. ([#2284](https://github.com/diegosouzapw/OmniRoute/pull/2284))
+- **feat(providers):** add llama.cpp as local provider — `llama-cpp` (alias `llamacpp`) added to `LOCAL_PROVIDERS` and `SELF_HOSTED_CHAT_PROVIDER_IDS`; default base URL `http://127.0.0.1:8080/v1`; no API key required; uses the default OpenAI-compatible executor ([#1980](https://github.com/diegosouzapw/OmniRoute/issues/1980))
 - **feat(providers):** bulk add API keys with Single/Bulk tabs.
 - **feat(provider):** add Gitlawb Opengateway provider (xiaomi-mimo + gmi-cloud) with hasFree flag support. ([#2314](https://github.com/diegosouzapw/OmniRoute/pull/2314) — thanks @oyi77)
 - **feat(ui):** comprehensive dashboard UX rework including simple/advanced modes for RTK/Caveman, human-readable error badges, InfoTooltip/PresetSlider shared components, sidebar subtitles, and provider category filters. ([#2315](https://github.com/diegosouzapw/OmniRoute/pull/2315), [#2316](https://github.com/diegosouzapw/OmniRoute/pull/2316) — thanks @dhaern, @oyi77)

bin/cli/commands/providers.mjs

@@ -1,4 +1,4 @@
-import { apiFetch } from "../api.mjs";
+import { apiFetch, isServerUp } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { printHeading } from "../io.mjs";
 import { getAvailableProviderCategories, loadAvailableProviders } from "../provider-catalog.mjs";
@@ -7,8 +7,10 @@ import {
   findProviderConnection,
   getProviderApiKey,
   listProviderConnections,
+  updateProviderApiKey,
   updateProviderTestResult,
 } from "../provider-store.mjs";
+import { encryptCredential } from "../encryption.mjs";
 import { openOmniRouteDb } from "../sqlite.mjs";
 import { t } from "../i18n.mjs";
 
@@ -301,6 +303,179 @@ export async function runValidateCommand(opts = {}) {
   }
 }
 
+export async function runProvidersRotateCommand(selector, opts = {}) {
+  if (!selector) {
+    console.error("Provider connection id or name is required.");
+    return 2;
+  }
+
+  // --- Resolve connection ---
+  const { db } = await openOmniRouteDb();
+  let connection;
+  try {
+    connection = findProviderConnection(db, selector);
+  } finally {
+    db.close();
+  }
+
+  if (!connection) {
+    console.error(`Provider connection not found: ${selector}`);
+    return 2;
+  }
+
+  // --- OAuth short-circuit ---
+  if (opts.oauth || connection.authType !== "apikey") {
+    console.log(t("providers.rotate.oauthHint", { provider: connection.provider }));
+    return 0;
+  }
+
+  // --- Source new key ---
+  let newKey;
+  if (opts.fromEnv) {
+    newKey = process.env[opts.fromEnv];
+    if (!newKey) {
+      console.error(t("providers.rotate.envVarEmpty", { var: opts.fromEnv }));
+      return 2;
+    }
+  } else if (opts.newKey) {
+    newKey = opts.newKey;
+  } else {
+    // Interactive prompt (echo-off not strictly needed for a key value, but best practice)
+    const readline = await import("node:readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    newKey = await new Promise((resolve) =>
+      rl.question(`New API key for ${connection.name}: `, (a) => { rl.close(); resolve(a.trim()); })
+    );
+    if (!newKey) {
+      console.error("No key provided.");
+      return 2;
+    }
+  }
+
+  // --- Dry-run ---
+  if (opts.dryRun) {
+    console.log(t("providers.rotate.dryRunResult", { name: connection.name, id: connection.id.slice(0, 8) }));
+    return 0;
+  }
+
+  // --- Confirm ---
+  if (!opts.yes) {
+    const readline = await import("node:readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) =>
+      rl.question(t("providers.rotate.confirmPrompt", { name: connection.name, id: connection.id.slice(0, 8) }), resolve)
+    );
+    rl.close();
+    if (!/^y(es|s)?$/i.test(answer)) {
+      console.log(t("common.cancelled"));
+      return 0;
+    }
+  }
+
+  // --- Write ---
+  const serverUp = await isServerUp();
+  if (serverUp) {
+    try {
+      const res = await apiFetch(`/api/providers/${encodeURIComponent(connection.id)}`, {
+        method: "PATCH",
+        body: { apiKey: newKey, testStatus: "unknown", lastError: null, rateLimitedUntil: null, backoffLevel: 0 },
+        retry: false,
+        acceptNotOk: true,
+      });
+      if (!res.ok) {
+        console.error(t("common.error", { message: `HTTP ${res.status}` }));
+        return 1;
+      }
+    } catch {
+      // Fall through to direct DB write
+      const { db: db2 } = await openOmniRouteDb();
+      try {
+        updateProviderApiKey(db2, connection.id, encryptCredential(newKey));
+      } finally {
+        db2.close();
+      }
+    }
+  } else {
+    const { db: db2 } = await openOmniRouteDb();
+    try {
+      updateProviderApiKey(db2, connection.id, encryptCredential(newKey));
+    } finally {
+      db2.close();
+    }
+  }
+
+  console.log(t("providers.rotate.success", { name: connection.name, id: connection.id.slice(0, 8) }));
+
+  // --- Post-rotation test ---
+  if (!opts.skipTest) {
+    const { db: db3 } = await openOmniRouteDb();
+    try {
+      const fresh = findProviderConnection(db3, connection.id);
+      if (fresh) {
+        const result = await runProviderTest(db3, fresh);
+        if (result.valid) {
+          console.log(t("providers.rotate.testPassed"));
+        } else {
+          console.error(t("providers.rotate.testFailed", { error: result.error }));
+        }
+      }
+    } finally {
+      db3.close();
+    }
+  }
+
+  return 0;
+}
+
+export async function runProvidersStatusCommand(opts = {}) {
+  const serverUp = await isServerUp();
+  if (!serverUp) {
+    console.error(t("providers.status.requiresServer"));
+    return 3;
+  }
+
+  const res = await apiFetch("/api/providers/expiration", { acceptNotOk: true, retry: false });
+  if (!res.ok) {
+    console.error(t("common.error", { message: `HTTP ${res.status}` }));
+    return 1;
+  }
+
+  const data = await res.json();
+  const list = data.list || [];
+
+  // Optional provider filter
+  const filter = opts.provider ? String(opts.provider).toLowerCase() : null;
+  const rows = filter ? list.filter((item) => item.provider?.toLowerCase().includes(filter)) : list;
+
+  if (opts.json || opts.output === "json") {
+    console.log(JSON.stringify({ count: rows.length, connections: rows }, null, 2));
+    return 0;
+  }
+
+  if (rows.length === 0) {
+    console.log(t("providers.status.noData"));
+    return 0;
+  }
+
+  console.log(t("providers.status.header"));
+  for (const item of rows) {
+    const shortId = (item.connectionId || item.id || "").slice(0, 8);
+    const expiry = item.expiresAt ? new Date(item.expiresAt).toLocaleDateString() : "-";
+    const expiryStatus = item.status || "unknown";
+    const testStatus = item.testStatus || "unknown";
+    const cooldown = item.rateLimitedUntil ? new Date(item.rateLimitedUntil).toLocaleString() : "-";
+    const expiryColor = statusColor(expiryStatus);
+    const testColor = statusColor(testStatus);
+    console.log(
+      `${shortId.padEnd(10)} ${String(item.provider || "").padEnd(14)} ${String(item.name || "").padEnd(24)} ` +
+      `${expiry.padEnd(12)} ${expiryColor}${expiryStatus.padEnd(8)}\x1b[0m ` +
+      `${testColor}${testStatus.padEnd(12)}\x1b[0m ${cooldown}`
+    );
+  }
+
+  return 0;
+}
+
 export function registerProviders(program) {
   const providers = program.command("providers").description(t("providers.title"));
 
@@ -357,6 +532,32 @@ export function registerProviders(program) {
       if (exitCode !== 0) process.exit(exitCode);
     });
 
+  providers
+    .command("rotate <idOrName>")
+    .description(t("providers.rotate.description"))
+    .option("--new-key <key>", t("providers.rotate.newKeyOpt"))
+    .option("--from-env <VAR>", t("providers.rotate.fromEnvOpt"))
+    .option("--oauth", t("providers.rotate.oauthOpt"))
+    .option("--yes", t("common.yesOpt"))
+    .option("--skip-test", t("providers.rotate.skipTestOpt"))
+    .option("--dry-run", t("providers.rotate.dryRunOpt"))
+    .action(async (idOrName, opts, cmd) => {
+      const globalOpts = cmd.parent.optsWithGlobals();
+      const exitCode = await runProvidersRotateCommand(idOrName, { ...opts, output: globalOpts.output });
+      if (exitCode !== 0) process.exit(exitCode);
+    });
+
+  providers
+    .command("status")
+    .description(t("providers.status.description"))
+    .option("--provider <name>", t("providers.status.providerOpt"))
+    .option("--json", "Print machine-readable JSON")
+    .action(async (opts, cmd) => {
+      const globalOpts = cmd.parent.optsWithGlobals();
+      const exitCode = await runProvidersStatusCommand({ ...opts, output: globalOpts.output });
+      if (exitCode !== 0) process.exit(exitCode);
+    });
+
   extendProvidersMetrics(providers);
 }
 

bin/cli/commands/serve.mjs

@@ -6,6 +6,7 @@ import { platform } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
+import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..", "..", "..");
@@ -330,7 +331,7 @@ async function onReady(dashboardPort, apiPort, noOpen) {
   \x1b[2m  Press Ctrl+C to stop\x1b[0m
   `);
 
-  if (!noOpen) {
+  if (!noOpen && !isTermux()) {
     try {
       const open = await import("open");
       await open.default(dashboardUrl);

bin/cli/locales/en.json

@@ -60,6 +60,28 @@
     },
     "metric_single": {
       "description": "Get a single metric value for a specific connection"
+    },
+    "rotate": {
+      "description": "Rotate the upstream API key for a provider connection",
+      "newKeyOpt": "New API key value (avoid: prefer --from-env)",
+      "fromEnvOpt": "Read new key from environment variable VAR",
+      "oauthOpt": "Trigger OAuth re-authentication flow instead",
+      "skipTestOpt": "Skip post-rotation connectivity test",
+      "dryRunOpt": "Print what would change without writing",
+      "confirmPrompt": "Replace API key for connection \"{name}\" ({id})? [y/N] ",
+      "dryRunResult": "[dry-run] Would rotate key for \"{name}\" ({id}). No changes made.",
+      "oauthHint": "OAuth connection — run: omniroute oauth {provider}",
+      "envVarEmpty": "Environment variable {var} is not set or is empty.",
+      "success": "Key rotated for \"{name}\". Run `providers test {id}` to verify.",
+      "testPassed": "Post-rotation test passed.",
+      "testFailed": "Post-rotation test failed: {error}"
+    },
+    "status": {
+      "description": "Show key health for all provider connections (age, expiry, cooldown)",
+      "providerOpt": "Filter by provider name",
+      "header": "ID         Provider       Name                     Expiry Status  Test Status  Cooldown Until",
+      "noData": "No provider connection data available.",
+      "requiresServer": "providers status requires the OmniRoute server to be running."
     }
   },
   "keys": {

bin/cli/locales/pt-BR.json

@@ -60,6 +60,28 @@
     },
     "metric_single": {
       "description": "Obter um único valor de métrica para uma conexão específica"
+    },
+    "rotate": {
+      "description": "Rotacionar a chave de API upstream de uma conexão de provedor",
+      "newKeyOpt": "Novo valor de chave de API (evite: prefira --from-env)",
+      "fromEnvOpt": "Ler nova chave da variável de ambiente VAR",
+      "oauthOpt": "Iniciar fluxo de reautenticação OAuth",
+      "skipTestOpt": "Pular teste de conectividade pós-rotação",
+      "dryRunOpt": "Exibir o que seria alterado sem gravar",
+      "confirmPrompt": "Substituir a chave de API da conexão \"{name}\" ({id})? [s/N] ",
+      "dryRunResult": "[dry-run] Rotacionaria a chave para \"{name}\" ({id}). Nenhuma alteração feita.",
+      "oauthHint": "Conexão OAuth — execute: omniroute oauth {provider}",
+      "envVarEmpty": "A variável de ambiente {var} não está definida ou está vazia.",
+      "success": "Chave rotacionada para \"{name}\". Execute `providers test {id}` para verificar.",
+      "testPassed": "Teste pós-rotação aprovado.",
+      "testFailed": "Teste pós-rotação falhou: {error}"
+    },
+    "status": {
+      "description": "Exibir saúde das chaves de todas as conexões de provedores (idade, validade, cooldown)",
+      "providerOpt": "Filtrar por nome do provedor",
+      "header": "ID         Provedor       Nome                     Validade Status  Status Teste  Cooldown Até",
+      "noData": "Nenhum dado de conexão de provedor disponível.",
+      "requiresServer": "providers status requer o servidor OmniRoute em execução."
     }
   },
   "keys": {

bin/cli/provider-store.mjs

@@ -251,6 +251,32 @@ export function removeProviderConnectionByProvider(db, provider) {
   return result.changes;
 }
 
+/**
+ * Replace the encrypted API key for a connection and clear any cooldown state.
+ * `encryptedKey` must already be passed through `encryptCredential()`.
+ */
+export function updateProviderApiKey(db, connectionId, encryptedKey) {
+  ensureProviderSchema(db);
+  const now = new Date().toISOString();
+  const result = db
+    .prepare(
+      `UPDATE provider_connections
+         SET api_key = @apiKey,
+             test_status = 'unknown',
+             last_error = NULL,
+             last_error_at = NULL,
+             last_error_type = NULL,
+             last_error_source = NULL,
+             error_code = NULL,
+             rate_limited_until = NULL,
+             backoff_level = 0,
+             updated_at = @updatedAt
+       WHERE id = @id`
+    )
+    .run({ id: connectionId, apiKey: encryptedKey, updatedAt: now });
+  return result.changes;
+}
+
 export function updateProviderTestResult(db, connectionId, result) {
   ensureProviderSchema(db);
   const now = new Date().toISOString();