fix(quota): enforce.ts não fail-open em limite 0/negativo/não-finito (hardening do #4830)

.env.example

@@ -551,6 +551,16 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # heuristic in instrumentation-node.ts.  Default: unset (tests skip background).
 #OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS=1
 
+# Proactive connection-cooldown recovery (#8): re-validates connections whose
+# transient `rate_limited_until` window has elapsed OUTSIDE the request hot path,
+# so the first request after a cooldown does not pay the probe latency. Lazy
+# recovery in getProviderCredentials still applies regardless. Used by:
+# src/lib/quota/connectionRecovery.ts.
+# Tick cadence (ms). Default 60000, floor 5000.
+# OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS=60000
+# Disable the proactive recovery scheduler entirely (default: false).
+# OMNIROUTE_DISABLE_CONNECTION_RECOVERY=false
+
 # Background job interval for budget reset checks (ms).  Default: 600000 (10m).
 # Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
 #OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
@@ -598,6 +608,11 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: scripts/postinstall.mjs.
 #OMNIROUTE_SKIP_POSTINSTALL=0
 
+# Operator-supplied JSON credentials for the offline compression-eval CLI
+# (parsed with JSON.parse; leave unset for a dry run). Developer tooling only.
+# Used by: scripts/compression-eval/index.ts.  Default: {} (empty).
+#OMNIROUTE_EVAL_CREDENTIALS={}
+
 # Skip the DB healthcheck entirely on startup (useful for short-lived tasks / tests).
 # Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts.  Set to 1 to disable.  Default: 0.
 #OMNIROUTE_SKIP_DB_HEALTHCHECK=0
@@ -792,7 +807,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.158 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.187 (external, cli)"
 
 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -801,7 +816,7 @@ CLAUDE_USER_AGENT="claude-cli/2.1.158 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.132.0 (Windows 10.0.26200; x64)"
+CODEX_USER_AGENT="codex-cli/0.142.0 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
@@ -823,7 +838,13 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.132.0
+# CODEX_CLIENT_VERSION=0.142.0
+
+# Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
+# from the Codex Responses stream. These frames break the OpenAI SDK's
+# responses.stream() with a 502 "Controller is already closed". Off by default;
+# set to true/1/yes to enable. Used by: open-sse/executors/codex.ts.
+# OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS=true
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 13. CLI FINGERPRINT COMPATIBILITY (Anti-Detection)
@@ -950,6 +971,15 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # OMNIROUTE_CIRCUIT_BREAKER_LOCAL_THRESHOLD=2
 # OMNIROUTE_CIRCUIT_BREAKER_LOCAL_RESET_MS=15000
 
+# ── Context-cache pin health gate ──
+# Used by: open-sse/services/combo.ts. When a context-cache pin points at a
+# provider that is durably unhealthy, the pin is dropped to allow failover.
+# PIN_DROP_BACKOFF_LEVEL gates how deep a connection's backoff must be before the
+# pin is considered durably unhealthy; PIN_DROP_GRACE_MS is the anti-flap window
+# that tolerates brief transient cooldowns before dropping the pin.
+# PIN_DROP_BACKOFF_LEVEL=2
+# PIN_DROP_GRACE_MS=20000
+
 # ── Stream idle detection ──
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
@@ -1200,6 +1230,34 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/executors/cloudflare-ai.ts
 # CLOUDFLARE_ACCOUNT_ID=
 
+# ── Deno Deploy proxy relay (#4643 / 9router#1437) ──
+# Override the Deno Deploy REST API base used by the proxy-pool relay deployer.
+# Default: https://api.deno.com/v2 (omit unless mocking).
+# Used by: src/app/api/settings/proxy/deno-deploy/route.ts
+# DENO_DEPLOY_API_BASE=https://api.deno.com/v2
+
+# Default Deno Deploy app name suggested in the "Deploy Relay" modal.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx
+# NEXT_PUBLIC_DENO_RELAY_DEFAULT_PROJECT=omniroute-deno-relay
+
+# Set to "false" to hide the Deno Deploy relay option from the Proxy Pool tab.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
+# NEXT_PUBLIC_DENO_RELAY_ENABLED=true
+
+# ── Cloudflare Workers proxy relay (#4640 / 9router#1360) ──
+# Override the Cloudflare REST API base used by the proxy-pool relay deployer.
+# Default: https://api.cloudflare.com/client/v4 (omit unless mocking).
+# Used by: src/app/api/settings/proxy/cloudflare-deploy/route.ts
+# CLOUDFLARE_API_BASE=https://api.cloudflare.com/client/v4
+
+# Default worker project name suggested in the "Deploy Relay" modal.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx
+# NEXT_PUBLIC_CLOUDFLARE_RELAY_DEFAULT_PROJECT=omniroute-relay
+
+# Set to "false" to hide the Cloudflare Workers relay option from the Proxy Pool tab.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
+# NEXT_PUBLIC_CLOUDFLARE_RELAY_ENABLED=true
+
 # ── Cloudflare Tunnel (cloudflared) ──
 # Custom path to cloudflared binary for tunnel management.
 # Used by: src/lib/cloudflaredTunnel.ts

.github/workflows/ci.yml

@@ -846,6 +846,7 @@ jobs:
           path: |
             coverage/coverage-summary.json
             coverage/coverage-report.md
+            coverage/lcov.info
           if-no-files-found: warn
 
   sonarqube:

.github/workflows/quality.yml

@@ -40,6 +40,8 @@ jobs:
       - run: npm run check:fetch-targets
       - run: npm run check:openapi-routes
       - run: npm run check:docs-symbols
+      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
+        run: npm run check:docs-all
       - run: npm run check:deps
       - run: npm run check:file-size
       - run: npm run check:error-helper
@@ -49,6 +51,7 @@ jobs:
       - run: npm run check:known-symbols
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
+      - run: npm run check:test-runner-api
       - run: npm run check:any-budget:t11
       - name: Typecheck (core)
         run: npm run typecheck:core
@@ -82,3 +85,48 @@ jobs:
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
           node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"
+
+  fast-vitest:
+    name: Vitest (fast-path)
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-lint-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - run: npm run test:vitest
+
+  fast-unit:
+    name: Unit Tests fast-path (${{ matrix.shard }}/2)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+    env:
+      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-lint-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - run: >
+          node --max-old-space-size=4096 --import tsx
+          --import ./tests/_setup/isolateDataDir.ts
+          --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2
+          tests/unit/*.test.ts
+          "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"

CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ---
 
+## [3.8.36] — TBD
+
+_In development — bullets added per PR; finalized at release._
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. (thanks @kenlin8827)
+
+### 🔧 Bug Fixes
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
@@ -19,6 +31,7 @@
 - **Dashboard**: remove the dead, unconditional `useLiveRequests()` call from `HomePageClient.tsx` — it crashed the `/home` page in production builds with `ReferenceError: useLiveRequests is not defined` (#4759, #4745) and opened the live-dashboard WebSocket even when Provider Topology was hidden (#4596). The live feed remains owned by the settings-gated `HomeProviderTopologySection` ([#4761](https://github.com/diegosouzapw/OmniRoute/pull/4761) — thanks @diegosouzapw).
 - **Providers dashboard**: dedupe provider nodes by id when adding a compatible provider (`upsertProviderNodeById`) so the same provider can no longer appear twice and no-op adds don't invalidate the compatible-provider memo ([#4768](https://github.com/diegosouzapw/OmniRoute/pull/4768) — closes #4746, thanks @diegosouzapw).
 - **Storage VACUUM**: the scheduled VACUUM job now follows the Storage page settings (`scheduledVacuum` / `vacuumHour`) as the single source of truth; the legacy env-flag control path was removed ([#4726](https://github.com/diegosouzapw/OmniRoute/pull/4726) — thanks @rdself).
+- **Storage SQLite tuning**: `Cache Size` is now a positive KiB setting (for example, `16384`) that applies to SQLite as `PRAGMA cache_size = -16384`; Page Size and Cache Size changes are applied to the live database instead of being persisted only in the settings table.
 - **Tiers**: no-auth providers are now counted as free, and the free-tier filter returns an empty set instead of falling through to every provider ([#4753](https://github.com/diegosouzapw/OmniRoute/pull/4753) — thanks @megamen32 / @diegosouzapw).
 - **Combos**: auto-promote `zeroLatencyOptimizationsEnabled` so legacy configs (pre-3.8.33 `fallbackCompressionMode="lite"`) round-trip cleanly on the first GUI edit ([#4774](https://github.com/diegosouzapw/OmniRoute/pull/4774) — thanks @KooshaPari / @diegosouzapw).
 

README.md

@@ -574,7 +574,7 @@ Dashboard at `http://localhost:20128` · API at `http://localhost:20128/v1`.
 
 **2) Connect a FREE provider (no signup)**
 
-Dashboard → **Providers** → connect **Kiro AI** (free Claude unlimited) or **OpenCode Free** (no auth) → done.
+Dashboard → **Providers** → connect **Kiro AI** (free Claude, ~50 credits/month per account) or **OpenCode Free** (no auth) → done.
 
 **3) Point your coding tool**
 
@@ -743,7 +743,7 @@ podman compose --profile base up -d
 **$0 forever:**
 
 ```
-1. kr/claude-sonnet-4.5   (Kiro — unlimited)
+1. kr/claude-sonnet-4.5   (Kiro — ~50 credits/mo per acct)
 2. if/kimi-k2-thinking    (Qoder — unlimited)
 3. pol/gpt-5              (Pollinations — no key)
 4. lc/longcat-flash-lite  (50M tok/day backup)
@@ -800,7 +800,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | `DATA_DIR`        | `~/.omniroute` | Database & config storage        |
 
 **Will I be charged by OmniRoute?** No — it's free, open-source software on your machine. You only pay paid providers directly. OmniRoute has no billing system.
-**Are FREE providers really unlimited?** Yes — Kiro, Qoder, Pollinations, LongCat, Cloudflare. No catch.
+**Are FREE providers really unlimited?** Mostly — Qoder, Pollinations, LongCat, and Cloudflare are free with no per-account credit cap. Kiro is free too but capped at ~50 credits/month per account. Stack multiple free providers in a combo and auto-fallback keeps you serving for $0.
 **Will compression hurt quality?** No — it only compresses the **input**; code, URLs, JSON are always protected.
 **Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 231 providers.
 

bin/_ops-common.sh

@@ -0,0 +1,70 @@
+# bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts.
+#
+# Sourced (not executed) by rollback.sh / snapshot-data.sh / restore-data.sh /
+# restore-policies.sh / cold-start-bench.sh. The runbook context lives in
+# docs/INCIDENT_RESPONSE.md and docs/PERF_BUDGETS.md.
+#
+# Path resolution mirrors the app (src/lib/db/core.ts): the SQLite store is
+# $DATA_DIR/storage.sqlite and managed backups go to $DATA_DIR/db_backups
+# (overridable via DB_BACKUPS_DIR), so snapshots created here are interchangeable
+# with the ones the server writes on migrations.
+
+# Recompute the data-dir-derived paths. Called once on source, and again by
+# scripts that accept a --data-dir override.
+ops_set_data_dir() {
+  OMNIROUTE_DATA_DIR="$1"
+  OMNIROUTE_SQLITE="${OMNIROUTE_DATA_DIR}/storage.sqlite"
+  OMNIROUTE_BACKUPS_DIR="${DB_BACKUPS_DIR:-${OMNIROUTE_DATA_DIR}/db_backups}"
+}
+ops_set_data_dir "${DATA_DIR:-$HOME/.omniroute}"
+
+ops_log() { printf '[%s] %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2; }
+ops_die() {
+  printf '[%s] ERROR: %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2
+  exit 1
+}
+
+ops_require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || ops_die "required command not found: $1"
+}
+
+# ops_confirm "<prompt>" — return 0 to proceed. Honors ASSUME_YES=1 (set by the
+# --yes flag) and REFUSES a destructive action on a non-interactive stdin unless
+# ASSUME_YES is set, so an unattended/CI invocation can never silently destroy data.
+ops_confirm() {
+  local prompt="$1" reply
+  if [ "${ASSUME_YES:-0}" = "1" ]; then return 0; fi
+  if [ ! -t 0 ]; then
+    ops_die "refusing a destructive action without a TTY; pass --yes to proceed non-interactively"
+  fi
+  read -r -p "$prompt [y/N] " reply
+  case "$reply" in
+    [yY] | [yY][eE][sS]) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# ops_find_snapshot <id> — resolve a snapshot identifier (a snapshot dir name,
+# a bare timestamp/sha, or an explicit path) to a directory containing
+# storage.sqlite. Echoes the resolved dir or dies.
+ops_find_snapshot() {
+  local id="$1" cand
+  [ -n "$id" ] || ops_die "snapshot id required (a timestamp/sha, dir name, or path)"
+  for cand in \
+    "$id" \
+    "$id/" \
+    "$OMNIROUTE_BACKUPS_DIR/$id" \
+    "$OMNIROUTE_BACKUPS_DIR/snapshot_$id"; do
+    if [ -f "${cand%/}/storage.sqlite" ]; then
+      printf '%s\n' "${cand%/}"
+      return 0
+    fi
+  done
+  # Fall back to a prefix match against snapshot_* dirs (e.g. a short sha/date).
+  if [ -d "$OMNIROUTE_BACKUPS_DIR" ]; then
+    for cand in "$OMNIROUTE_BACKUPS_DIR"/snapshot_*"$id"*; do
+      [ -f "$cand/storage.sqlite" ] && { printf '%s\n' "$cand"; return 0; }
+    done
+  fi
+  ops_die "no snapshot matching '$id' under $OMNIROUTE_BACKUPS_DIR (run bin/snapshot-data.sh first)"
+}

bin/cli/runtime/nativeDeps.mjs

@@ -12,7 +12,7 @@ import { spawnSync } from "node:child_process";
 import { platform } from "node:os";
 import { resolveDataDir } from "../data-dir.mjs";
 
-const BETTER_SQLITE3_VERSION = "12.9.0";
+const BETTER_SQLITE3_VERSION = "12.10.1";
 
 function runtimeDir() {
   return join(resolveDataDir(), "runtime");

bin/cli/runtime/sqliteRuntime.mjs

@@ -6,7 +6,7 @@ import { pathToFileURL } from "node:url";
 import { validateBinaryMagic, platformBinaryLabel } from "./magicBytes.mjs";
 
 const RUNTIME_DIR = join(homedir(), ".omniroute", "runtime");
-const BETTER_SQLITE3_VERSION = "better-sqlite3@^12.6.2";
+const BETTER_SQLITE3_VERSION = "better-sqlite3@^12.10.1";
 
 let resolvedCached = null;