+
+
📖 [Authorization](docs/architecture/AUTHZ_GUIDE.md) · [Guardrails](docs/security/GUARDRAILS.md) · [Compliance](docs/security/COMPLIANCE.md)
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 5e62c56b83..d262d12c67 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -28,8 +28,8 @@ OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWA
## fatihkabakk/tls-client-node 0.2.0
OmniRoute includes [`tls-client-node@0.2.0`](https://github.com/fatihkabakk/tls-client-node/tree/v0.2.0)
-as an optional runtime dependency. The package is source-available under Apache License 2.0
-with the Commons Clause License Condition v1.0. The following license and NOTICE blocks are
+as an optional runtime dependency. The package is source-available, not OSI-approved, under
+Apache License 2.0 with the Commons Clause License Condition v1.0. The following license and NOTICE blocks are
reproduced verbatim from the tagged primary sources.
### tls-client-node license
diff --git a/changelog.d/maintenance/11742-tls-client-license-provenance.md b/changelog.d/maintenance/11742-tls-client-license-provenance.md
index b0fcaf68df..3ec2878626 100644
--- a/changelog.d/maintenance/11742-tls-client-license-provenance.md
+++ b/changelog.d/maintenance/11742-tls-client-license-provenance.md
@@ -1 +1,3 @@
-- **security(deps):** pin `tls-client-node@0.2.0`, ship its exact Commons Clause/Apache and upstream BSD-4 notices, pin `bogdanfinn/tls-client` to v1.15.1, and verify every native binary against GitHub's official SHA-256 before loading it ([#11742](https://github.com/diegosouzapw/OmniRoute/pull/11742)).
+- **security(deps):** pin `tls-client-node@0.2.0`, ship its exact Commons Clause/Apache and upstream BSD-4 notices, pin `bogdanfinn/tls-client` to v1.15.1, and verify every supported native binary against GitHub's official SHA-256 before loading it ([#11742](https://github.com/diegosouzapw/OmniRoute/pull/11742)).
+- **fix(runtime):** serialize native TLS installation and client ownership, bound caller waits for startup/requests, and coordinate stream and lease cleanup across completion, error, cancellation, and process-exit hooks ([#11742](https://github.com/diegosouzapw/OmniRoute/pull/11742)).
+- **security(runtime):** fail closed on hostile thrown values and redact credentials, recognized filesystem paths, and stack frames from upstream HTTP/SSE errors and diagnostic logs in chat, provider validation, moderation, and OCR boundaries ([#11742](https://github.com/diegosouzapw/OmniRoute/pull/11742)).
diff --git a/config/quality/.license-allowlist.json b/config/quality/.license-allowlist.json
index 0f314dfa15..a4582965f4 100644
--- a/config/quality/.license-allowlist.json
+++ b/config/quality/.license-allowlist.json
@@ -76,13 +76,15 @@
"reviewAt": "v4.0.0"
},
"tls-client-node": {
- "license": "Custom: LICENSE (Apache-2.0 + Commons Clause)",
- "justification": "TEMPORARY bridge for a restrictive, source-available dependency: tls-client-node uses Apache-2.0 with the Commons Clause, which removes the right to Sell the software when a paid product or service derives entirely or substantially from its functionality. The shared native TLS transport serves six providers: chatgpt-web, claude-web, perplexity-web, grok-web, notion-web, and lmarena. Shipping the required notices does not grant commercial rights. Legal review is required before commercial deployment; replace with a permissive transport such as wreq-js or obtain separate permission before this exception expires.",
+ "version": "0.2.0",
+ "license": "Custom: LICENSE",
+ "justification": "TEMPORARY bridge for a restrictive, source-available dependency: tls-client-node uses Apache-2.0 with the Commons Clause, which removes the right to Sell the software when a paid product or service derives entirely or substantially from its functionality. The shared native TLS transport serves six providers: chatgpt-web, claude-web, perplexity-web, grok-web, notion-web, and lmarena. Shipping the required notices does not grant commercial rights. Legal review is required before commercial deployment; replace with a permissive transport such as wreq-js or obtain separate permission before this exception expires. Tracked by PR #11742.",
"risk": "medium",
"temporary": true,
"owner": "@diegosouzapw",
"reviewBy": "2026-09-30",
- "reviewAt": "v3.9.0"
+ "reviewAt": "v3.9.0",
+ "classification": "Apache-2.0 with Commons Clause; non-OSI source-available"
}
}
}
diff --git a/config/quality/eslint-suppressions.json b/config/quality/eslint-suppressions.json
index ff58151ba2..55aa0f9d3c 100644
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -706,11 +706,6 @@
"count": 1
}
},
- "open-sse/services/tlsClientBase.ts": {
- "@typescript-eslint/no-unused-vars": {
- "count": 1
- }
- },
"open-sse/services/tokenLimitCounter.ts": {
"@typescript-eslint/no-unused-vars": {
"count": 1
diff --git a/docs/diagrams/comparison-table.svg b/docs/diagrams/comparison-table.svg
index d75b8c2db1..577714bb38 100644
--- a/docs/diagrams/comparison-table.svg
+++ b/docs/diagrams/comparison-table.svg
@@ -1,4 +1,4 @@
-