Release/v3.8.0 — full changelog with 660+ commits (#2419)

* fix(cli-tools): guard modelId type before calling indexOf E2E shakedown v3.8.0: cli-tools quebrava com TypeError quando dynamicModels continha entradas sem .id (objeto retornado diretamente em vez de string). * fix(offline): avoid SSR/CSR hydration mismatch on navigator.onLine Replace useState+lazy-initializer with useSyncExternalStore so the server snapshot (() => false) and client snapshot (() => navigator.onLine) are declared separately. React hydrates with the server value and switches to the real online status client-side without a mismatch. * chore(i18n): add missing en.json keys for translator, cli-tools, memory, onboarding Adds 58 missing keys identified by the new dashboard audit script: - cliTools: 18 custom CLI builder keys (CustomCliCard) - translator: 24 keys covering stream transformer, live monitor, test bench - memory: 12 health/pagination/dialog keys - onboarding.tier: 8 keys for the tier tour walkthrough Also adds scripts/i18n/audit-dashboard-pages.mjs which scans all dashboard pages, reports t() calls referencing missing en.json keys, and flags candidate hardcoded JSX/attribute strings. * chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 1) Subagents refactored 8 high-impact dashboard pages, replacing 81 of the 407 hardcoded English/PT strings flagged by the audit with proper useTranslations() lookups. Added 73 corresponding keys to en.json across the home, apiManager, providers, settings, and usage namespaces. Pages affected: - BudgetTab (27 → 0) - HomePageClient (2 → 0) - RoutingTab (25 → 7) - ResilienceTab (38 → 18) - SystemStorageTab (42 → 21) - providers/[id] (17 → 15) - ApiManagerPageClient (14 → 13) - OneproxyTab (13 → 10) Also adds two helper scripts: - scripts/i18n/extract-keys-from-diff.mjs — extracts new keys from git diff - scripts/i18n/merge-keys.mjs — merges a pending-keys JSON into en.json Remaining hardcoded strings will be addressed in follow-up rounds. * chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 2) Continues round 1 (commit 8d34f4c65). Round-2 subagents refactored additional dashboard pages, replacing 77 more hardcoded strings with useTranslations() lookups. Added 79 corresponding keys to en.json across the a2aDashboard, agents, analytics, apiManager, cliTools, common, and settings namespaces. Pages affected: - a2a/page (new useTranslations + 6 keys) - agent-skills/page (new useTranslations + 9 keys) - AutoRoutingAnalyticsTab (new useTranslations + 6 keys) - AppearanceTab (8 → 6 remaining) - OneproxyTab (10 → 0) - ResilienceTab (18 → 0 missing key) - RoutingTab (7 → 0 missing key) - VisionBridgeSettingsTab (new useTranslations + 6 keys) - CopilotToolCard (7 → 0 missing key) - ApiManagerPageClient (13 → 0 missing key) - gamification/admin (new useTranslations + 7 keys) Hardcoded total: 326 → 249. Real missing keys: 0 (the 6 still flagged are false positives in exampleTemplates.tsx where t is passed as a parameter — keys exist at translator.templatePayloads.*). * chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 3) Round-3 subagents and manual edits refactored 9 more dashboard pages (plus 2 small extras), replacing ~80 hardcoded strings with useTranslations() lookups. Added 79 corresponding keys to en.json across analytics, cloudAgents, combos, common, health, settings, and usage namespaces. Pages affected: - analytics/ComboHealthTab (new useTranslations + 15 keys) - analytics/CompressionAnalyticsTab (new useTranslations + 11 keys) - settings/SystemStorageTab (21 → 0 missing key) - tokens/page (new useTranslations + 13 keys) - usage/BudgetTab (9 missing fixed) - health/page (manual: 6 keys) - cloud-agents/page (manual: 3 keys) - combos/page (manual: 1 key) Hardcoded total: 249 → 164. Real missing keys: 0 (6 remaining are exampleTemplates.tsx false positives). Also adds scripts/i18n/build-pending-from-missing.mjs which reads _audit.json and locates English values from HEAD to rebuild _pending-keys.json after race-condition resets between subagent edits. * chore(i18n): localize remaining dashboard settings labels Replace hardcoded labels in compression and resilience settings with translation lookups to continue the dashboard i18n cleanup. Add the v3.8.0 dashboard shakedown runbook to document the manual smoke-test process and known dev environment pitfalls. * chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 4) Round-4 subagent + manual key-resolution refactored remaining strings in 3 high-traffic settings/API tabs, plus extracted English values for keys that were already added as t() calls but lost during the previous en.json race-condition resets. Pages affected: - api-manager/ApiManagerPageClient (7 → 0 missing key) - settings/CompressionSettingsTab (8 → 0 missing key) - settings/MemorySkillsTab (8 → 0 missing key) - settings/ResilienceTab (4 more keys recovered) Hardcoded total: 164 → 140. Real missing keys: 0 (6 remaining are the exampleTemplates.tsx false positives — t passed as parameter). * chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 5) Round-5 agent began processing the remaining smaller dashboard files. Added 5 more keys to en.json for providers/[id]/page.tsx OAuth flow labels and the cross-OS auto-detection hint. Pages affected: - providers/[id]/page.tsx (5 keys) Hardcoded total: 140 → 136. Real missing keys: 0. * chore(i18n): resolve last 2 missing providers/[id] keys Adds providerDetailMyClaudeAccountPlaceholder and providerDetailPathAutoDetected — the final user-visible labels in the providers/[id] page that the round-5 subagent rewrote to t() calls without yet adding to en.json. Real missing keys: 0 (6 remaining are exampleTemplates.tsx false positives — t is passed as a parameter so the audit cannot resolve the namespace; keys do exist at translator.templatePayloads.*). * chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 6 — 10 parallel agents) Round-6 dispatched 10 parallel subagents covering all 57 remaining dashboard files. Each agent worked on a disjoint file set to avoid en.json race conditions. Added ~60 new i18n keys across 9 namespaces covering small UI labels, table headers, search placeholders, and empty-state messages. Major changes: - analytics: SearchAnalyticsTab, ProviderUtilizationTab, DiversityScoreCard, CompressionAnalyticsTab (new useTranslations + keys) - batch: BatchDetailModal, BatchListTab, FileDetailModal, FilesListTab (new useTranslations + keys) - settings: CliproxyapiSettingsTab, PayloadRulesTab, ModelCooldownsCard, AppearanceTab, PricingTab (mostly new useTranslations) - endpoint: TokenSaverCard, ApiEndpointsTab, EndpointPageClient - cache: CachePerformance, IdempotencyLayer, ReasoningCacheTab, MediaPageClient, page - combos: IntelligentComboPanel, page - playground: ChatPlayground, SearchPlayground - providers: ProviderCard - onboarding: TierFlowDiagram - changelog: ChangelogViewer - home: ProviderTopology, TierCoverageWidget, BootstrapBanner, BadgeToast - usage: BudgetTab, BudgetTelemetryCards, QuotaTable - quotaShare: QuotaSharePageClient - profile: page - leaderboard: page - skills: page Hardcoded total: 131 → 60. Real missing keys: 0 plus 1 false-positive for combos.modePack (lookup via prop-passed t). * chore(i18n): finalize round-6 keys for batch/cache/endpoint/usage Adds the remaining keys produced by parallel agents A4, A6, A8, A9: - common: batch-related labels (BatchDetailModal, BatchListTab, FileDetailModal, FilesListTab, page) + profile/leaderboard - cache: hit rate, latency, retry, avg chars - endpoint: token saver, API endpoints, copy URL, cloud/local labels - usage: noSpend, activeSessions, quotaAlerts, budget timing - skills: install/marketplace/filter - proxyRegistry/quotaShare/mcpDashboard: misc labels Hardcoded total: 60 → 48. Real missing keys: 0 (modePack remaining is a false positive — combos.modePack exists but the audit can't resolve it since IntelligentComboPanel receives t as a prop). * fix(playground): dedupe filteredModels to avoid duplicate React key warning The /v1/models endpoint can return the same model id twice (e.g., when a model is listed by both an alias and its canonical provider), which made the <Select> emit two <option> elements with the same key — triggering "Encountered two children with the same key, codex/gpt-5.5". Replace the chained filter + map with a single pass that skips ids already added. * fix(playground): guard against non-string model ids before .split/.startsWith The /v1/models endpoint can include synthetic entries (combos, locals, in-progress imports) with a null/undefined id. The playground used to call m.id.split("/") in the provider-discovery loop, which threw on the first non-string entry; the surrounding .catch(() => {}) silently swallowed the error, so the provider/model/account dropdowns ended up empty even though /v1/models returned thousands of valid entries. - Skip entries without a string id before split/startsWith. - Log the rejection in the .catch handler so future regressions are visible in DevTools instead of silently emptying the UI. * fix(playground): guard ChatPlayground filteredModels for non-string ids Same root cause as commit 49fe356b9: ChatPlayground filtered models with m.id.startsWith(...) which crashed on null/undefined ids returned by /v1/models (synthetic combo entries). Apply the same defensive guard and dedupe used in the parent page. * fix(claude): drop orphan tool_result after fixToolAdjacency strip (discussion #2410) Discussion #2410 reports Claude returning 400 for sequences like: assistant: tool_use(id=X) user: <plain text> ← breaks adjacency user: tool_result(id=X) The previous round added `fixToolAdjacency` (commit 44d9abac9) which correctly strips the orphan tool_use from the assistant message. But that left the now-unmatched tool_result intact, so the upstream rejected the request with: messages.N.content.M: unexpected `tool_use_id` found in `tool_result` blocks: X. Each tool_result block must have a corresponding tool_use block in the previous message. Fix: after running `fixToolAdjacency`, re-run `fixToolPairs` to drop the orphaned tool_result blocks. All three call sites updated: - contextManager.purifyHistory (both inside the binary-search loop and the final pass) - BaseExecutor message-prep (Claude path) - claudeCodeCompatible request signer Also tightens an unrelated dynamic-key access in readNestedString (claudeCodeCompatible) to satisfy the prototype- pollution scanner triggered by the post-tool semgrep hook. * fix(mitm): point runtime manager re-export to js entrypoint Use the emitted `.js` path for the runtime manager re-export so dynamic runtime loading resolves correctly outside the Turbopack alias handling. * docs: add AgentRouter setup guide (#2422) Integrated into release/v3.8.0 — AgentRouter setup guide docs. * feat: add new feature on combos - falloverBeforeRetry (#2417) Integrated into release/v3.8.0 — falloverBeforeRetry for per-model quota skipping in combos. * feat(batch): implement 10 feature requests harvested (#2414) Integrated into release/v3.8.0 — batch of 10 feature requests: llama.cpp local provider, upstream error exposure, Termux detection, providers rotate CLI, t3.chat web skeleton, Zed Docker integration, Kiro multi-account OAuth isolation, auto-combo cost blending, auto-combo context filter, combo provider-level exhaustion tracking (#1731). Conflicts with #2417 (falloverBeforeRetry) resolved. * fix(gamification): resolve SQL bug, auth gap, pagination, and anomaly scoring (#2421) Integrated into release/v3.8.0 — 6 critical gamification bug fixes: SQL SELECT in checkActionCountBadges, federation auth enforcement, leaderboard pagination offset, real z-score computation, addXp level calculation, and barrel index.ts * docs(changelog): add post-release entries for #2414 #2417 #2421 #2422 - feat(batch): T3-Chat-Web executor, exhaustedProviders set (#1731), Zed Docker - feat(combos): falloverBeforeRetry + setTry loop (#2417 — @hartmark) - fix(gamification): SQL SELECT bug, federation auth, pagination, z-score (#2421 — @oyi77) - docs: AgentRouter setup guide (#2422 — @leninejunior) * fix(security): resolve CodeQL random/password-hash alerts and sync docs & tests --------- Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com> Co-authored-by: Lenine Júnior <lenine@engrene.com.br> Co-authored-by: Markus Hartung <mail@hartmark.se> Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
2026-07-26 09:52:11 +03:00 · 2026-05-20 02:05:50 -03:00
parent f04c02c221
commit 6248699ce5
166 changed files with 7787 additions and 3833 deletions
--- a/bin/cli/commands/backup.mjs
+++ b/bin/cli/commands/backup.mjs
@@ -4,6 +4,7 @@ import {
  mkdirSync,
  readdirSync,
  readFileSync,
+  unlinkSync,
  writeFileSync,
 } from "node:fs";
 import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
@@ -11,6 +12,7 @@ import { dirname, join, extname, basename } from "node:path";
 import { resolveDataDir } from "../data-dir.mjs";
 import { apiFetch, isServerUp } from "../api.mjs";
 import { t } from "../i18n.mjs";
+import { backupSqliteFile } from "../sqlite.mjs";

 function getBackupDir() {
  return join(resolveDataDir(), "backups");
@@ -187,13 +189,6 @@ export async function runBackupCommand(opts = {}) {
  try {
    if (!existsSync(backupDir)) mkdirSync(backupDir, { recursive: true });

-    let Database;
-    try {
-      Database = (await import("better-sqlite3")).default;
-    } catch {
-      Database = null;
-    }
-
    let backedUp = 0;
    let skipped = 0;

@@ -207,14 +202,11 @@ export async function runBackupCommand(opts = {}) {
        const destName = opts.encrypt ? `${file.name}.enc` : file.name;
        const destPath = join(backupPath, destName);
        mkdirSync(dirname(destPath), { recursive: true });
-        if (file.name.endsWith(".sqlite") && Database) {
-          const db = new Database(sourcePath, { readonly: true });
+        if (file.name.endsWith(".sqlite")) {
          const tmpPath = destPath.replace(/\.enc$/, "");
-          await db.backup(tmpPath);
-          db.close();
+          await backupSqliteFile(sourcePath, tmpPath);
          if (opts.encrypt) {
            encryptFile(tmpPath, destPath, passphrase);
-            const { unlinkSync } = await import("node:fs");
            unlinkSync(tmpPath);
          }
        } else if (opts.encrypt) {
--- a/bin/cli/commands/doctor.mjs
+++ b/bin/cli/commands/doctor.mjs
@@ -7,6 +7,7 @@ import { pathToFileURL } from "node:url";
 import { resolveDataDir, resolveStoragePath } from "../data-dir.mjs";
 import { printHeading } from "../io.mjs";
 import { t } from "../i18n.mjs";
+import { readDatabaseHealth, readEncryptedCredentialSamples } from "../sqlite.mjs";

 const STATIC_SALT = "omniroute-field-encryption-v1";
 const KEY_LENGTH = 32;
@@ -78,14 +79,6 @@ function checkConfig(dataDir) {
  return ok("Config", `.env found at ${envFile}`, { envFile });
 }

-async function loadBetterSqlite() {
-  try {
-    return (await import("better-sqlite3")).default;
-  } catch (error) {
-    return { error };
-  }
-}
-
 function resolveMigrationsDir(rootDir) {
  const configured = process.env.OMNIROUTE_MIGRATIONS_DIR;
  const candidates = [
@@ -115,18 +108,9 @@ async function checkDatabase(dbPath, rootDir) {
    return warn("Database", `SQLite database not found at ${dbPath}`, { dbPath });
  }

-  const Database = await loadBetterSqlite();
-  if (Database.error) {
-    return fail("Database", "better-sqlite3 could not be loaded", {
-      error: Database.error instanceof Error ? Database.error.message : String(Database.error),
-    });
-  }
-
-  let db;
  try {
-    db = new Database(dbPath, { readonly: true, fileMustExist: true });
-    const quickCheck = db.prepare("PRAGMA quick_check").get();
-    const quickCheckValue = Object.values(quickCheck || {})[0];
+    const { quickCheckValue, hasMigrationTable, appliedMigrationVersions } =
+      await readDatabaseHealth(dbPath);
    if (quickCheckValue !== "ok") {
      return fail("Database", `SQLite quick_check failed: ${quickCheckValue}`, { dbPath });
    }
@@ -137,18 +121,11 @@ async function checkDatabase(dbPath, rootDir) {
      return ok("Database", "SQLite quick_check passed", { dbPath, migrations: "not_checked" });
    }

-    const table = db
-      .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
-      .get("_omniroute_migrations");
-    if (!table) {
+    if (!hasMigrationTable) {
      return warn("Database", "SQLite is readable, but migration table is missing", { dbPath });
    }

-    const appliedRows = db
-      .prepare("SELECT version FROM _omniroute_migrations")
-      .all()
-      .map((row) => row.version);
-    const applied = new Set(appliedRows);
+    const applied = new Set(appliedMigrationVersions);
    const pending = migrationFiles.filter((migration) => !applied.has(migration.version));

    if (pending.length > 0) {
@@ -164,8 +141,6 @@ async function checkDatabase(dbPath, rootDir) {
      dbPath,
      error: error instanceof Error ? error.message : String(error),
    });
-  } finally {
-    if (db) db.close();
  }
 }

@@ -203,42 +178,14 @@ async function checkStorageEncryption(dbPath) {
      : warn("Storage/encryption", "No STORAGE_ENCRYPTION_KEY configured; passthrough mode");
  }

-  const Database = await loadBetterSqlite();
-  if (Database.error) {
-    return fail("Storage/encryption", "Could not inspect encrypted credentials", {
-      error: Database.error instanceof Error ? Database.error.message : String(Database.error),
-    });
-  }
-
-  let db;
  try {
-    db = new Database(dbPath, { readonly: true, fileMustExist: true });
-    const hasProviderTable = db
-      .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
-      .get("provider_connections");
+    const { hasProviderTable, encryptedValues } = await readEncryptedCredentialSamples(dbPath);
    if (!hasProviderTable) {
      return secret
        ? ok("Storage/encryption", "Encryption key is configured; provider table not initialized")
        : warn("Storage/encryption", "No STORAGE_ENCRYPTION_KEY configured; passthrough mode");
    }

-    const rows = db
-      .prepare(
-        `SELECT api_key, access_token, refresh_token, id_token
-         FROM provider_connections
-         WHERE api_key LIKE 'enc:v1:%'
-            OR access_token LIKE 'enc:v1:%'
-            OR refresh_token LIKE 'enc:v1:%'
-            OR id_token LIKE 'enc:v1:%'
-         LIMIT 20`
-      )
-      .all();
-    const encryptedValues = rows.flatMap((row) =>
-      ["api_key", "access_token", "refresh_token", "id_token"]
-        .filter((key) => typeof row[key] === "string" && row[key].startsWith("enc:v1:"))
-        .map((key) => row[key])
-    );
-
    if (encryptedValues.length === 0) {
      return secret
        ? ok("Storage/encryption", "Encryption key is configured; no encrypted samples found")
@@ -268,8 +215,6 @@ async function checkStorageEncryption(dbPath) {
    return fail("Storage/encryption", "Encrypted credential check failed", {
      error: error instanceof Error ? error.message : String(error),
    });
-  } finally {
-    if (db) db.close();
  }
 }

--- a/bin/cli/commands/providers.mjs
+++ b/bin/cli/commands/providers.mjs
@@ -1,4 +1,4 @@
-import { apiFetch } from "../api.mjs";
+import { apiFetch, isServerUp } from "../api.mjs";
 import { emit } from "../output.mjs";
 import { printHeading } from "../io.mjs";
 import { getAvailableProviderCategories, loadAvailableProviders } from "../provider-catalog.mjs";
@@ -7,8 +7,10 @@ import {
  findProviderConnection,
  getProviderApiKey,
  listProviderConnections,
+  updateProviderApiKey,
  updateProviderTestResult,
 } from "../provider-store.mjs";
+import { encryptCredential } from "../encryption.mjs";
 import { openOmniRouteDb } from "../sqlite.mjs";
 import { t } from "../i18n.mjs";

@@ -301,6 +303,198 @@ export async function runValidateCommand(opts = {}) {
  }
 }

+export async function runProvidersRotateCommand(selector, opts = {}) {
+  if (!selector) {
+    console.error("Provider connection id or name is required.");
+    return 2;
+  }
+
+  // --- Resolve connection ---
+  const { db } = await openOmniRouteDb();
+  let connection;
+  try {
+    connection = findProviderConnection(db, selector);
+  } finally {
+    db.close();
+  }
+
+  if (!connection) {
+    console.error(`Provider connection not found: ${selector}`);
+    return 2;
+  }
+
+  // --- OAuth short-circuit ---
+  if (opts.oauth || connection.authType !== "apikey") {
+    console.log(t("providers.rotate.oauthHint", { provider: connection.provider }));
+    return 0;
+  }
+
+  // --- Source new key ---
+  let newKey;
+  if (opts.fromEnv) {
+    newKey = process.env[opts.fromEnv];
+    if (!newKey) {
+      console.error(t("providers.rotate.envVarEmpty", { var: opts.fromEnv }));
+      return 2;
+    }
+  } else if (opts.newKey) {
+    newKey = opts.newKey;
+  } else {
+    // Interactive prompt (echo-off not strictly needed for a key value, but best practice)
+    const readline = await import("node:readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    newKey = await new Promise((resolve) =>
+      rl.question(`New API key for ${connection.name}: `, (a) => {
+        rl.close();
+        resolve(a.trim());
+      })
+    );
+    if (!newKey) {
+      console.error("No key provided.");
+      return 2;
+    }
+  }
+
+  // --- Dry-run ---
+  if (opts.dryRun) {
+    console.log(
+      t("providers.rotate.dryRunResult", { name: connection.name, id: connection.id.slice(0, 8) })
+    );
+    return 0;
+  }
+
+  // --- Confirm ---
+  if (!opts.yes) {
+    const readline = await import("node:readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) =>
+      rl.question(
+        t("providers.rotate.confirmPrompt", {
+          name: connection.name,
+          id: connection.id.slice(0, 8),
+        }),
+        resolve
+      )
+    );
+    rl.close();
+    if (!/^y(es|s)?$/i.test(answer)) {
+      console.log(t("common.cancelled"));
+      return 0;
+    }
+  }
+
+  // --- Write ---
+  const serverUp = await isServerUp();
+  if (serverUp) {
+    try {
+      const res = await apiFetch(`/api/providers/${encodeURIComponent(connection.id)}`, {
+        method: "PATCH",
+        body: {
+          apiKey: newKey,
+          testStatus: "unknown",
+          lastError: null,
+          rateLimitedUntil: null,
+          backoffLevel: 0,
+        },
+        retry: false,
+        acceptNotOk: true,
+      });
+      if (!res.ok) {
+        console.error(t("common.error", { message: `HTTP ${res.status}` }));
+        return 1;
+      }
+    } catch {
+      // Fall through to direct DB write
+      const { db: db2 } = await openOmniRouteDb();
+      try {
+        updateProviderApiKey(db2, connection.id, encryptCredential(newKey));
+      } finally {
+        db2.close();
+      }
+    }
+  } else {
+    const { db: db2 } = await openOmniRouteDb();
+    try {
+      updateProviderApiKey(db2, connection.id, encryptCredential(newKey));
+    } finally {
+      db2.close();
+    }
+  }
+
+  console.log(
+    t("providers.rotate.success", { name: connection.name, id: connection.id.slice(0, 8) })
+  );
+
+  // --- Post-rotation test ---
+  if (!opts.skipTest) {
+    const { db: db3 } = await openOmniRouteDb();
+    try {
+      const fresh = findProviderConnection(db3, connection.id);
+      if (fresh) {
+        const result = await runProviderTest(db3, fresh);
+        if (result.valid) {
+          console.log(t("providers.rotate.testPassed"));
+        } else {
+          console.error(t("providers.rotate.testFailed", { error: result.error }));
+        }
+      }
+    } finally {
+      db3.close();
+    }
+  }
+
+  return 0;
+}
+
+export async function runProvidersStatusCommand(opts = {}) {
+  const serverUp = await isServerUp();
+  if (!serverUp) {
+    console.error(t("providers.status.requiresServer"));
+    return 3;
+  }
+
+  const res = await apiFetch("/api/providers/expiration", { acceptNotOk: true, retry: false });
+  if (!res.ok) {
+    console.error(t("common.error", { message: `HTTP ${res.status}` }));
+    return 1;
+  }
+
+  const data = await res.json();
+  const list = data.list || [];
+
+  // Optional provider filter
+  const filter = opts.provider ? String(opts.provider).toLowerCase() : null;
+  const rows = filter ? list.filter((item) => item.provider?.toLowerCase().includes(filter)) : list;
+
+  if (opts.json || opts.output === "json") {
+    console.log(JSON.stringify({ count: rows.length, connections: rows }, null, 2));
+    return 0;
+  }
+
+  if (rows.length === 0) {
+    console.log(t("providers.status.noData"));
+    return 0;
+  }
+
+  console.log(t("providers.status.header"));
+  for (const item of rows) {
+    const shortId = (item.connectionId || item.id || "").slice(0, 8);
+    const expiry = item.expiresAt ? new Date(item.expiresAt).toLocaleDateString() : "-";
+    const expiryStatus = item.status || "unknown";
+    const testStatus = item.testStatus || "unknown";
+    const cooldown = item.rateLimitedUntil ? new Date(item.rateLimitedUntil).toLocaleString() : "-";
+    const expiryColor = statusColor(expiryStatus);
+    const testColor = statusColor(testStatus);
+    console.log(
+      `${shortId.padEnd(10)} ${String(item.provider || "").padEnd(14)} ${String(item.name || "").padEnd(24)} ` +
+        `${expiry.padEnd(12)} ${expiryColor}${expiryStatus.padEnd(8)}\x1b[0m ` +
+        `${testColor}${testStatus.padEnd(12)}\x1b[0m ${cooldown}`
+    );
+  }
+
+  return 0;
+}
+
 export function registerProviders(program) {
  const providers = program.command("providers").description(t("providers.title"));

@@ -357,6 +551,35 @@ export function registerProviders(program) {
      if (exitCode !== 0) process.exit(exitCode);
    });

+  providers
+    .command("rotate <idOrName>")
+    .description(t("providers.rotate.description"))
+    .option("--new-key <key>", t("providers.rotate.newKeyOpt"))
+    .option("--from-env <VAR>", t("providers.rotate.fromEnvOpt"))
+    .option("--oauth", t("providers.rotate.oauthOpt"))
+    .option("--yes", t("common.yesOpt"))
+    .option("--skip-test", t("providers.rotate.skipTestOpt"))
+    .option("--dry-run", t("providers.rotate.dryRunOpt"))
+    .action(async (idOrName, opts, cmd) => {
+      const globalOpts = cmd.parent.optsWithGlobals();
+      const exitCode = await runProvidersRotateCommand(idOrName, {
+        ...opts,
+        output: globalOpts.output,
+      });
+      if (exitCode !== 0) process.exit(exitCode);
+    });
+
+  providers
+    .command("status")
+    .description(t("providers.status.description"))
+    .option("--provider <name>", t("providers.status.providerOpt"))
+    .option("--json", "Print machine-readable JSON")
+    .action(async (opts, cmd) => {
+      const globalOpts = cmd.parent.optsWithGlobals();
+      const exitCode = await runProvidersStatusCommand({ ...opts, output: globalOpts.output });
+      if (exitCode !== 0) process.exit(exitCode);
+    });
+
  extendProvidersMetrics(providers);
 }

--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -6,6 +6,7 @@ import { platform } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
+import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";

 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..", "..", "..");
@@ -330,7 +331,7 @@ async function onReady(dashboardPort, apiPort, noOpen) {
  \x1b[2m  Press Ctrl+C to stop\x1b[0m
  `);

-  if (!noOpen) {
+  if (!noOpen && !isTermux()) {
    try {
      const open = await import("open");
      await open.default(dashboardUrl);
--- a/bin/cli/locales/en.json
+++ b/bin/cli/locales/en.json
@@ -60,6 +60,28 @@
    },
    "metric_single": {
      "description": "Get a single metric value for a specific connection"
+    },
+    "rotate": {
+      "description": "Rotate the upstream API key for a provider connection",
+      "newKeyOpt": "New API key value (avoid: prefer --from-env)",
+      "fromEnvOpt": "Read new key from environment variable VAR",
+      "oauthOpt": "Trigger OAuth re-authentication flow instead",
+      "skipTestOpt": "Skip post-rotation connectivity test",
+      "dryRunOpt": "Print what would change without writing",
+      "confirmPrompt": "Replace API key for connection \"{name}\" ({id})? [y/N] ",
+      "dryRunResult": "[dry-run] Would rotate key for \"{name}\" ({id}). No changes made.",
+      "oauthHint": "OAuth connection — run: omniroute oauth {provider}",
+      "envVarEmpty": "Environment variable {var} is not set or is empty.",
+      "success": "Key rotated for \"{name}\". Run `providers test {id}` to verify.",
+      "testPassed": "Post-rotation test passed.",
+      "testFailed": "Post-rotation test failed: {error}"
+    },
+    "status": {
+      "description": "Show key health for all provider connections (age, expiry, cooldown)",
+      "providerOpt": "Filter by provider name",
+      "header": "ID         Provider       Name                     Expiry Status  Test Status  Cooldown Until",
+      "noData": "No provider connection data available.",
+      "requiresServer": "providers status requires the OmniRoute server to be running."
    }
  },
  "keys": {
--- a/bin/cli/locales/pt-BR.json
+++ b/bin/cli/locales/pt-BR.json
@@ -60,6 +60,28 @@
    },
    "metric_single": {
      "description": "Obter um único valor de métrica para uma conexão específica"
+    },
+    "rotate": {
+      "description": "Rotacionar a chave de API upstream de uma conexão de provedor",
+      "newKeyOpt": "Novo valor de chave de API (evite: prefira --from-env)",
+      "fromEnvOpt": "Ler nova chave da variável de ambiente VAR",
+      "oauthOpt": "Iniciar fluxo de reautenticação OAuth",
+      "skipTestOpt": "Pular teste de conectividade pós-rotação",
+      "dryRunOpt": "Exibir o que seria alterado sem gravar",
+      "confirmPrompt": "Substituir a chave de API da conexão \"{name}\" ({id})? [s/N] ",
+      "dryRunResult": "[dry-run] Rotacionaria a chave para \"{name}\" ({id}). Nenhuma alteração feita.",
+      "oauthHint": "Conexão OAuth — execute: omniroute oauth {provider}",
+      "envVarEmpty": "A variável de ambiente {var} não está definida ou está vazia.",
+      "success": "Chave rotacionada para \"{name}\". Execute `providers test {id}` para verificar.",
+      "testPassed": "Teste pós-rotação aprovado.",
+      "testFailed": "Teste pós-rotação falhou: {error}"
+    },
+    "status": {
+      "description": "Exibir saúde das chaves de todas as conexões de provedores (idade, validade, cooldown)",
+      "providerOpt": "Filtrar por nome do provedor",
+      "header": "ID         Provedor       Nome                     Validade Status  Status Teste  Cooldown Até",
+      "noData": "Nenhum dado de conexão de provedor disponível.",
+      "requiresServer": "providers status requer o servidor OmniRoute em execução."
    }
  },
  "keys": {
--- a/bin/cli/provider-store.mjs
+++ b/bin/cli/provider-store.mjs
@@ -251,6 +251,32 @@ export function removeProviderConnectionByProvider(db, provider) {
  return result.changes;
 }

+/**
+ * Replace the encrypted API key for a connection and clear any cooldown state.
+ * `encryptedKey` must already be passed through `encryptCredential()`.
+ */
+export function updateProviderApiKey(db, connectionId, encryptedKey) {
+  ensureProviderSchema(db);
+  const now = new Date().toISOString();
+  const result = db
+    .prepare(
+      `UPDATE provider_connections
+         SET api_key = @apiKey,
+             test_status = 'unknown',
+             last_error = NULL,
+             last_error_at = NULL,
+             last_error_type = NULL,
+             last_error_source = NULL,
+             error_code = NULL,
+             rate_limited_until = NULL,
+             backoff_level = 0,
+             updated_at = @updatedAt
+       WHERE id = @id`
+    )
+    .run({ id: connectionId, apiKey: encryptedKey, updatedAt: now });
+  return result.changes;
+}
+
 export function updateProviderTestResult(db, connectionId, result) {
  ensureProviderSchema(db);
  const now = new Date().toISOString();
--- a/bin/cli/sqlite.mjs
+++ b/bin/cli/sqlite.mjs
@@ -1,33 +1,42 @@
 import fs from "node:fs";
 import { resolveDataDir, resolveStoragePath } from "./data-dir.mjs";
 import { ensureProviderSchema } from "./provider-store.mjs";
-import { ensureSettingsSchema } from "./settings-store.mjs";
+import { ensureSettingsSchema, hashManagementPassword, updateSettings } from "./settings-store.mjs";
+
+async function loadBetterSqlite() {
+  try {
+    return (await import("better-sqlite3")).default;
+  } catch {
+    throw new Error("better-sqlite3 is not installed. Run npm install before using setup.");
+  }
+}
+
+function createSqliteNativeError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (message.includes("NODE_MODULE_VERSION") || message.includes("ERR_DLOPEN_FAILED")) {
+    return new Error(
+      "better-sqlite3 native binding is incompatible with this Node.js runtime. " +
+        "Run `npm rebuild better-sqlite3` in the OmniRoute project and try again."
+    );
+  }
+  return error;
+}
+
+async function openSqliteDatabase(dbPath, options = {}) {
+  const Database = await loadBetterSqlite();
+  try {
+    return new Database(dbPath, options);
+  } catch (error) {
+    throw createSqliteNativeError(error);
+  }
+}

 export async function openOmniRouteDb() {
  const dataDir = resolveDataDir();
  const dbPath = resolveStoragePath(dataDir);
  fs.mkdirSync(dataDir, { recursive: true });

-  let Database;
-  try {
-    Database = (await import("better-sqlite3")).default;
-  } catch {
-    throw new Error("better-sqlite3 is not installed. Run npm install before using setup.");
-  }
-
-  let db;
-  try {
-    db = new Database(dbPath);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes("NODE_MODULE_VERSION") || message.includes("ERR_DLOPEN_FAILED")) {
-      throw new Error(
-        "better-sqlite3 native binding is incompatible with this Node.js runtime. " +
-          "Run `npm rebuild better-sqlite3` in the OmniRoute project and try again."
-      );
-    }
-    throw error;
-  }
+  const db = await openSqliteDatabase(dbPath);

  db.pragma("journal_mode = WAL");
  ensureSettingsSchema(db);
@@ -35,3 +44,113 @@ export async function openOmniRouteDb() {

  return { db, dataDir, dbPath };
 }
+
+export async function withReadonlySqlite(dbPath, callback) {
+  const db = await openSqliteDatabase(dbPath, { readonly: true, fileMustExist: true });
+  try {
+    return await callback(db);
+  } finally {
+    db.close();
+  }
+}
+
+export async function backupSqliteFile(sourcePath, destPath) {
+  const db = await openSqliteDatabase(sourcePath, { readonly: true });
+  try {
+    await db.backup(destPath);
+  } finally {
+    db.close();
+  }
+}
+
+export async function readDatabaseHealth(dbPath) {
+  return withReadonlySqlite(dbPath, (db) => {
+    const quickCheck = db.prepare("PRAGMA quick_check").get();
+    const quickCheckValue = Object.values(quickCheck || {})[0];
+    const hasMigrationTable = !!db
+      .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
+      .get("_omniroute_migrations");
+    const appliedMigrationVersions = hasMigrationTable
+      ? db
+          .prepare("SELECT version FROM _omniroute_migrations")
+          .all()
+          .map((row) => row.version)
+      : [];
+
+    return { quickCheckValue, hasMigrationTable, appliedMigrationVersions };
+  });
+}
+
+export async function readEncryptedCredentialSamples(dbPath) {
+  return withReadonlySqlite(dbPath, (db) => {
+    const hasProviderTable = !!db
+      .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
+      .get("provider_connections");
+    if (!hasProviderTable) {
+      return { hasProviderTable: false, encryptedValues: [] };
+    }
+
+    const rows = db
+      .prepare(
+        `SELECT api_key, access_token, refresh_token, id_token
+         FROM provider_connections
+         WHERE api_key LIKE 'enc:v1:%'
+            OR access_token LIKE 'enc:v1:%'
+            OR refresh_token LIKE 'enc:v1:%'
+            OR id_token LIKE 'enc:v1:%'
+         LIMIT 20`
+      )
+      .all();
+
+    const encryptedValues = rows.flatMap((row) =>
+      ["api_key", "access_token", "refresh_token", "id_token"]
+        .filter((key) => typeof row[key] === "string" && row[key].startsWith("enc:v1:"))
+        .map((key) => row[key])
+    );
+
+    return { hasProviderTable: true, encryptedValues };
+  });
+}
+
+export async function readManagementPasswordState(dbPath = resolveStoragePath(resolveDataDir())) {
+  if (!fs.existsSync(dbPath)) {
+    return { exists: false, hasPassword: false };
+  }
+
+  return withReadonlySqlite(dbPath, (db) => {
+    const hasSettingsTable = !!db
+      .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
+      .get("key_value");
+    if (!hasSettingsTable) {
+      return { exists: true, hasPassword: false };
+    }
+    const row = db
+      .prepare("SELECT value FROM key_value WHERE namespace = 'settings' AND key = ?")
+      .get("password");
+    let password = row?.value;
+    if (typeof password === "string") {
+      try {
+        password = JSON.parse(password);
+      } catch {}
+    }
+    return {
+      exists: true,
+      hasPassword: typeof password === "string" && password.length > 0,
+    };
+  });
+}
+
+export async function resetManagementPassword(
+  password,
+  dbPath = resolveStoragePath(resolveDataDir())
+) {
+  const db = await openSqliteDatabase(dbPath);
+  try {
+    db.pragma("journal_mode = WAL");
+    ensureSettingsSchema(db);
+    const hashedPassword = await hashManagementPassword(password);
+    updateSettings(db, { password: hashedPassword, requireLogin: true });
+  } finally {
+    db.close();
+  }
+}
--- a/bin/reset-password.mjs
+++ b/bin/reset-password.mjs
@@ -14,16 +14,12 @@
 */

 import { createInterface } from "node:readline";
-import { resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { existsSync } from "node:fs";
-import bcrypt from "bcryptjs";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
+import { resolveDataDir, resolveStoragePath } from "./cli/data-dir.mjs";
+import { readManagementPasswordState, resetManagementPassword } from "./cli/sqlite.mjs";

 // Resolve data directory — same logic as the server
-const DATA_DIR = process.env.DATA_DIR || resolve(__dirname, "..", "data");
-const DB_PATH = resolve(DATA_DIR, "settings.db");
+const DATA_DIR = resolveDataDir();
+const DB_PATH = resolveStoragePath(DATA_DIR);

 const rl = createInterface({
  input: process.stdin,
@@ -34,37 +30,19 @@ function ask(question) {
  return new Promise((resolve) => rl.question(question, resolve));
 }

-function generateSecretDigest(input) {
-  // Use bcrypt with a salt round of 10 to match login/route.ts expectations
-  // and resolve CodeQL js/insufficient-password-hash warning.
-  return bcrypt.hashSync(input, 10);
-}
-
 console.log("\n🔑 OmniRoute — Password Reset\n");

 async function main() {
  // Check if database exists
-  if (!existsSync(DB_PATH)) {
+  const passwordState = await readManagementPasswordState(DB_PATH);
+  if (!passwordState.exists) {
    console.error(`❌ Database not found at: ${DB_PATH}`);
    console.error(`   Make sure OmniRoute has been started at least once.`);
    console.error(`   Or set DATA_DIR env var to your data directory.\n`);
    process.exit(1);
  }

-  let Database;
-  try {
-    Database = (await import("better-sqlite3")).default;
-  } catch {
-    console.error("❌ better-sqlite3 not installed. Run: npm install");
-    process.exit(1);
-  }
-
-  const db = new Database(DB_PATH);
-
-  // Check current settings
-  const row = db.prepare("SELECT value FROM settings WHERE key = 'password'").get();
-
-  if (row) {
+  if (passwordState.hasPassword) {
    console.log("ℹ️  A password is currently set.");
  } else {
    console.log("ℹ️  No password is currently set.");
@@ -74,7 +52,6 @@ async function main() {

  if (!password || password.length < 8) {
    console.error("\n❌ Password must be at least 8 characters.\n");
-    db.close();
    rl.close();
    process.exit(1);
  }
@@ -83,28 +60,11 @@ async function main() {

  if (password !== confirm) {
    console.error("\n❌ Passwords do not match.\n");
-    db.close();
    rl.close();
    process.exit(1);
  }

-  const hashed = generateSecretDigest(password);
-
-  // Upsert the password
-  const stmt = db.prepare(`
-    INSERT INTO settings (key, value) VALUES ('password', ?)
-    ON CONFLICT(key) DO UPDATE SET value = excluded.value
-  `);
-  stmt.run(hashed);
-
-  // Also ensure requireLogin is true
-  const loginStmt = db.prepare(`
-    INSERT INTO settings (key, value) VALUES ('requireLogin', 'true')
-    ON CONFLICT(key) DO UPDATE SET value = excluded.value
-  `);
-  loginStmt.run();
-
-  db.close();
+  await resetManagementPassword(password, DB_PATH);
  rl.close();

  console.log("\n✅ Password reset successfully!");