diff --git a/.agents/skills/capture-release-evidences/SKILL.md b/.agents/skills/capture-release-evidences/SKILL.md
new file mode 100644
index 0000000000..e52cd9d159
--- /dev/null
+++ b/.agents/skills/capture-release-evidences/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: capture-release-evidences-cx
+description: Automatically run a browser-automation agent to visually validate all new UI features from the current release and capture evidence WebP recordings of the changes.
+---
+
+# Capture Release Evidences Workflow
+
+Use this workflow to automatically drive a browser-automation agent to explore the newly deployed or locally running application and record evidence of the UI changes introduced in the latest release.
+
+> **Tool mapping note (v3.8):** The `browser_subagent` tool referenced below is specific to an earlier agent runtime. In Claude Code, substitute with the available browser MCP tools (e.g. `mcp__claude-in-chrome__*`) for navigation/screenshots, plus the `Write` tool for saving artifacts. The high-level steps remain the same regardless of the browser-automation surface in use.
+
+## Prerequisites
+
+- OmniRoute must be actively running and accessible (e.g. locally at `http://localhost:20128` or on the Local VPS at `http://192.168.0.15:20128`).
+- The user must provide the target URL to be tested, or default to `http://192.168.0.15:20128`.
+
+## Workflow Steps
+
+### 1. Identify Target Features
+
+Review the `CHANGELOG.md` for the latest version to map out the new UI elements. For example:
+
+- **CLI Tools Settings**
+- **New Provider/Model Listings (e.g., Gemini 3.1, Qoder PAT)**
+- **New Feature Modals**
+
+### 2. Run the Browser Subagent
+
+For each identified feature, invoke the `browser_subagent` using the `default_api:browser_subagent` tool.
+**Important Task Guidelines for the Subagent:**
+
+- `TaskName`: Give it a clear name like "Validate CLIProxyAPI Tool Tab".
+- `TaskSummary`: "Navigate to the CLI Tools tab and verify the new Integration settings."
+- `Task`: Provide unambiguous instructions for the subagent, such as: "Navigate to http://192.168.0.15:20128/dashboard. Click on the 'Settings' or 'CLI Tools' nav link. Scroll down to find the CLIProxyAPI integration card. Hover over it to trigger UI state. Verify the components render correctly and exit."
+- `RecordingName`: Ensure it describes the feature (e.g. `v3_4_5_cli_proxy_api`). This is required and strictly automatically saved as a WebP artifacts video by the system.
+
+_(Note: The `browser_subagent` automatically creates a WebP recording named by the `RecordingName` parameter. No additional tools for screenshots are needed.)_
+
+### 3. Generate Report Artifact
+
+After the `browser_subagent` finishes its sessions, generate a final Markdown artifact (using `Write` and `IsArtifact=true`) to present the recordings inline to the user using the `` syntax.
+
+### Example Invocation
+
+\```json
+{
+"TaskName": "Validating Qoder PAT Configuration UI",
+"TaskSummary": "Validates the Qoder provider configuration modal",
+"Task": "Go to http://192.168.0.15:20128/dashboard. Click on the 'Providers' tab. Find 'Qoder' in the list. Click 'Add Token' or 'Configure'. Type 'test_token' and submit. Return when done.",
+"RecordingName": "qoder_pat_ui_validation"
+}
+\```
diff --git a/.agents/skills/deploy-vps-akamai/SKILL.md b/.agents/skills/deploy-vps-akamai/SKILL.md
new file mode 100644
index 0000000000..a0f0cd25c6
--- /dev/null
+++ b/.agents/skills/deploy-vps-akamai/SKILL.md
@@ -0,0 +1,45 @@
+---
+name: deploy-vps-akamai-cx
+description: Deploy the latest OmniRoute code to the Akamai VPS (69.164.221.35)
+---
+
+# Deploy to Akamai VPS Workflow
+
+Deploy OmniRoute to the Akamai VPS using `npm pack + scp` + PM2.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` only for independent commands. Do not parallelize dependent build, copy, install, restart, and verification steps.
+- Report each remote result explicitly before finishing.
+
+**Akamai VPS:** `69.164.221.35`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+```
+
+### 2. Copy to Akamai VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@69.164.221.35:/tmp/
+```
+
+```bash
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'AKAMAI HTTP %{http_code}\n' http://69.164.221.35:20128/
+```
diff --git a/.agents/skills/deploy-vps-both/SKILL.md b/.agents/skills/deploy-vps-both/SKILL.md
new file mode 100644
index 0000000000..867fba8f9a
--- /dev/null
+++ b/.agents/skills/deploy-vps-both/SKILL.md
@@ -0,0 +1,56 @@
+---
+name: deploy-vps-both-cx
+description: Deploy the latest OmniRoute code to BOTH the Akamai VPS and the Local VPS
+---
+
+# Deploy to VPS (Both) Workflow
+
+Deploy OmniRoute to the production VPSs using `npm pack + scp` + PM2.
+
+**Akamai VPS:** `69.164.221.35`
+**Local VPS:** `192.168.0.15`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+**PM2 entry:** `/usr/lib/node_modules/omniroute/app/server.js`
+
+> [!IMPORTANT]
+> The npm registry rejects packages > 100MB, so deployment uses **npm pack + scp**.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` only for independent commands.
+- Build/package once first. After the artifact exists, copy/install/verify on Akamai and Local may run in parallel if they do not depend on each other.
+- Report each VPS result explicitly before finishing.
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+```
+
+### 2. Copy to both VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@69.164.221.35:/tmp/ && scp omniroute-*.tgz root@192.168.0.15:/tmp/
+```
+
+```bash
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+```
+
+```bash
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'AKAMAI HTTP %{http_code}\n' http://69.164.221.35:20128/
+curl -s -o /dev/null -w 'LOCAL HTTP %{http_code}\n' http://192.168.0.15:20128/
+```
diff --git a/.agents/skills/deploy-vps-local/SKILL.md b/.agents/skills/deploy-vps-local/SKILL.md
new file mode 100644
index 0000000000..6ba355a263
--- /dev/null
+++ b/.agents/skills/deploy-vps-local/SKILL.md
@@ -0,0 +1,45 @@
+---
+name: deploy-vps-local-cx
+description: Deploy the latest OmniRoute code to the Local VPS (192.168.0.15)
+---
+
+# Deploy to Local VPS Workflow
+
+Deploy OmniRoute to the Local VPS using `npm pack + scp` + PM2.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` only for independent commands. Do not parallelize dependent build, copy, install, restart, and verification steps.
+- Report each remote result explicitly before finishing.
+
+**Local VPS:** `192.168.0.15`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+```
+
+### 2. Copy to Local VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@192.168.0.15:/tmp/
+```
+
+```bash
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'LOCAL HTTP %{http_code}\n' http://192.168.0.15:20128/
+```
diff --git a/.agents/skills/generate-release/SKILL.md b/.agents/skills/generate-release/SKILL.md
new file mode 100644
index 0000000000..6632c2a434
--- /dev/null
+++ b/.agents/skills/generate-release/SKILL.md
@@ -0,0 +1,368 @@
+---
+name: generate-release-cx
+description: Create a new release, bump version up to the .10 patch threshold, update changelog, and manage Pull Requests
+---
+
+# Generate Release Workflow
+
+Bump version, finalize CHANGELOG, commit, open a **PR to main** and wait for user confirmation before tagging, publishing, and deploying.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` for independent reads, checks, and GitHub calls.
+- When the workflow says `notify_user` or `BlockedOnUser: true`, present the report/status in the final response and stop. Do not continue into the next phase until the user explicitly approves.
+
+> **VERSION RULE: Always use PATCH bumps (3.x.y → 3.x.y+1)**
+> NEVER use `npm version minor` or `npm version major`.
+> Always use: `npm version patch --no-git-tag-version`
+> The threshold rule: when `y` reaches 10, bump to `3.(x+1).0` — e.g. `3.8.10` → `3.9.0`.
+
+> **🔴 SINGLE BRANCH RULE**: The `release/vX.Y.Z` branch is the **ONLY** development branch for the entire release cycle. ALL work — bug fixes, feature implementations, PR integrations, issue resolutions — MUST be committed directly on this branch. Never create separate `fix/`, `feat/`, or topic branches. When running `/resolve-issues`, `/implement-features`, or `/review-prs`, always work on the current release branch.
+
+---
+
+## ⚠️ Two-Phase Flow
+
+```
+Phase 1 (automated): bump → docs → i18n → commit → push → open PR
+ ↕ 🛑 STOP: Notify user, wait for PR confirmation
+Phase 2 (post-merge): tag → publish → GitHub release → Docker → deploy
+```
+
+**NEVER push directly to main or create tags before the user confirms the PR.**
+
+---
+
+## Phase 0: Security Verification (MANDATORY)
+
+Before creating the release, you must ensure the codebase and supply chain are secure and free of known vulnerabilities.
+
+1. **Run Local Dependencies Audit:**
+
+ ```bash
+ npm audit
+ ```
+
+ _Fix any `high` or `critical` vulnerabilities identified._
+
+2. **Check GitHub CodeQL & Dependabot Alerts:**
+ Navigate to the repository's **Security** tab on GitHub, or use the project's `vulnerability-scanner` skill to analyze active alerts. Ensure all static analysis findings (e.g., prototype pollution, insecure randomness, ReDoS, shell injections) are addressed and logically committed on a target branch.
+
+---
+
+## Phase 1: Pre-Merge
+
+### 1. Create release branch
+
+```bash
+git checkout -b release/v3.x.y
+```
+
+### 2. Determine and sync version
+
+Check current version in `package.json`:
+
+```bash
+grep '"version"' package.json
+```
+
+> **🔴 BRANCH-VERSION PARITY RULE**: The logical version in `package.json` MUST exactly match the release branch name. For example, if you are on `release/v3.7.0`, the version in `package.json` MUST be `3.7.0`.
+>
+> - If this is the FIRST time generating a release for a new minor/major branch (e.g., bumping from 3.6.9 to 3.7.0), you MUST ensure the version is bumped to match the new branch logic.
+> - If you are just bumping a patch on the current branch (e.g., 3.6.9 to 3.6.10), use:
+> `npm version patch --no-git-tag-version`
+
+> **⚠️ ATOMIC COMMIT RULE — Version bump MUST happen before committing feature files.**
+>
+> **CORRECT order:**
+>
+> 1. `npm version patch --no-git-tag-version` ← bump first
+> 2. implement features / fix bugs
+> 3. `git add -A && git commit -m "chore(release): v3.x.y — all changes in ONE commit"`
+>
+> **OR if features are already staged:**
+>
+> 1. implement features (do NOT commit yet)
+> 2. `npm version patch --no-git-tag-version` ← bump before committing
+> 3. `git add -A && git commit -m "chore(release): v3.x.y — all changes in ONE commit"`
+>
+> **NEVER do this (creates version mismatch in git history):**
+>
+> - ~~commit features → then bump version → commit package.json separately~~
+>
+> This ensures that `git show v3.x.y` always contains both code changes and the version bump together.
+> The GitHub release tag will point to a commit that includes ALL changes for that version.
+
+### 3. Regenerate lock file (REQUIRED after version bump)
+
+**Mandatory** — skipping causes `@swc/helpers` lock mismatch and CI failures:
+
+```bash
+npm install
+```
+
+### 4. Finalize CHANGELOG.md
+
+> **🔴 NO MIXUPS RULE**: Ensure you do NOT mix the backlog of the previous version with the new one. The new version section must ONLY contain the features and fixes for the current release.
+
+Replace the `[Unreleased]` header with the new version and date.
+Keep an empty `## [Unreleased]` section above it, separated by a horizontal rule (`---`).
+
+```markdown
+## [Unreleased]
+
+---
+
+## [3.7.0] — 2026-04-19
+
+### ✨ New Features
+
+- ...
+
+### 🐛 Bug Fixes
+
+- ...
+
+---
+
+## [3.6.9] — 2026-04-19
+```
+
+### 5. Update openapi.yaml version ⚠️ MANDATORY
+
+> **CI will fail** if `docs/reference/openapi.yaml` version ≠ `package.json` version (`check:docs-sync` enforces this).
+
+// turbo
+
+```bash
+VERSION=$(node -p "require('./package.json').version")
+sed -i "s/ version: .*/ version: $VERSION/" docs/reference/openapi.yaml
+echo "✓ openapi.yaml → $VERSION"
+
+for dir in electron open-sse; do
+ if [ -d "$dir" ] && [ -f "$dir/package.json" ]; then
+ (cd "$dir" && npm version "$VERSION" --no-git-tag-version --allow-same-version > /dev/null)
+ echo "✓ $dir/package.json → $VERSION"
+ fi
+done
+# Re-run install to assert the workspace lockfile is updated
+npm install
+```
+
+### 6. Update README.md and i18n docs
+
+Manually perform these documentation updates (there is no `/update-docs` workflow — it was deprecated in v3.8):
+
+- Update feature table rows and "What's new in vX.Y.Z" section in `README.md`
+- Sync feature changes to all 40 language `docs/i18n/*/README.md` files (use the same row edits across each translated README)
+- Update the relevant `docs/.md` if architecture or counts changed
+- Re-run `npm run check:docs-sync` and `npm run check:docs-all` to catch drift
+
+### 7. Run tests
+
+// turbo
+
+```bash
+npm test
+```
+
+All tests must pass before creating the PR.
+
+### 8. Stage, commit, and push
+
+// turbo-all
+
+```bash
+git add -A
+git commit -m "chore(release): v3.x.y — summary of changes"
+git push origin release/v3.x.y
+```
+
+### 9. Open PR to main
+
+### 9. Open PR to main
+
+// turbo
+
+```bash
+VERSION=$(node -p "require('./package.json').version")
+
+# Extract the exact changelog entry for this version from the root CHANGELOG.md
+awk "/^## \\[$VERSION\\]/{flag=1; print; next} /^---/{if(flag) {flag=0; exit}} flag" CHANGELOG.md > /tmp/changelog_body.txt
+
+# Append test status and next steps
+echo "" >> /tmp/changelog_body.txt
+echo "### Tests" >> /tmp/changelog_body.txt
+echo "- All tests pass" >> /tmp/changelog_body.txt
+echo "" >> /tmp/changelog_body.txt
+echo "### ⚠️ After merging: run Phase 2 steps to tag, publish, and deploy." >> /tmp/changelog_body.txt
+
+gh pr create \
+ --repo diegosouzapw/OmniRoute \
+ --base main \
+ --head release/v$VERSION \
+ --title "Release v$VERSION" \
+ --body-file /tmp/changelog_body.txt
+```
+
+### 10. 🛑 STOP — Notify User & Await PR Confirmation
+
+**This is a mandatory stop point.** Present the report in the final response and stop. Do not continue to the next phase until the user explicitly approves.
+
+Inform the user:
+
+- PR URL
+- Summary of changes
+- Test results
+- List of files changed
+
+**DO NOT proceed to Phase 2 until the user confirms the PR looks good and merges it.**
+
+---
+
+## Phase 2: Post-Merge Validation (Local VPS)
+
+> Run these steps only AFTER the user has merged the PR into `main` and all CI jobs have passed.
+
+### 11. Deploy to Local VPS for Final Validation (MANDATORY)
+
+Before cutting the official git tag and publishing to the world, deploy the `main` branch to the Local VPS for a final homologation test.
+
+```bash
+git checkout main
+git pull origin main
+
+# Build and pack locally
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+
+# Deploy to LOCAL VPS (192.168.0.15)
+scp omniroute-*.tgz root@192.168.0.15:/tmp/
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+
+# Verify
+curl -s -o /dev/null -w "LOCAL: HTTP %{http_code}\n" http://192.168.0.15:20128/
+```
+
+### 12. 🛑 STOP — Notify User & Await Final OK
+
+**This is a mandatory stop point.**
+Inform the user that the `main` branch is now running on the Local VPS.
+Wait for the user to manually test and give the **OK**.
+**DO NOT proceed to Phase 3 until the user confirms the local deploy is stable.**
+
+---
+
+## Phase 3: Official Launch
+
+> Run these steps only AFTER the user gives the final OK from the Phase 2 local validation.
+
+### 13. Create Git Tag and GitHub Release (MANDATORY)
+
+// turbo
+
+```bash
+git checkout main
+git pull origin main
+VERSION=$(node -p "require('./package.json').version")
+
+# Extracts the changelog section for this version
+NOTES=$(awk "/^## \\[$VERSION\\]/{flag=1; next} /^---/{if(flag) {flag=0; exit}} flag" CHANGELOG.md | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+if [ -z "$NOTES" ]; then NOTES="OmniRoute v$VERSION Release"; fi
+
+git tag -a "v$VERSION" -m "Release v$VERSION"
+git push origin "v$VERSION"
+gh release create "v$VERSION" --repo diegosouzapw/OmniRoute --title "v$VERSION" --notes "$NOTES" --target main || gh release edit "v$VERSION" --repo diegosouzapw/OmniRoute --title "v$VERSION" --notes "$NOTES"
+```
+
+### 14. 🐳 Trigger Docker Hub build (MANDATORY — keep npm and Docker in sync)
+
+> **CRITICAL**: Docker Hub and npm MUST always publish the same version.
+> The Docker image is built automatically via GitHub Actions when a new tag is pushed.
+> After pushing the tag in step 13, **verify the workflow runs**:
+
+```bash
+# Verify the Docker workflow triggered
+gh run list --repo diegosouzapw/OmniRoute --workflow docker-publish.yml --limit 3
+
+# Wait for the Docker build to complete (usually 5–10 min)
+gh run watch --repo diegosouzapw/OmniRoute
+```
+
+### 15. Publish to NPM (Optional/Automated)
+
+Normally handled by CI, but if manual publish is required:
+
+```bash
+npm publish
+```
+
+### 16. Deploy to AKAMAI VPS (Production)
+
+Now that the release is officially cut, deploy it to the Akamai VPS.
+
+```bash
+# Deploy to AKAMAI VPS (69.164.221.35)
+scp omniroute-*.tgz root@69.164.221.35:/tmp/
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+
+# Verify
+curl -s -o /dev/null -w "AKAMAI: HTTP %{http_code}\n" http://69.164.221.35:20128/
+```
+
+## Phase 4: Release Monitoring & Artifact Validation
+
+> After triggering the official release, actively monitor the CI pipelines until all artifacts are successfully generated. If any pipeline fails, stop and apply the necessary corrections before continuing.
+
+### 18. Monitor CI Pipelines
+
+Wait for and verify the successful completion of the following automated jobs:
+
+1. **Docker Hub Publish**
+2. **Electron Build**
+3. **NPM Registry Publish** (Check with `npm info omniroute version`)
+
+```bash
+# Monitor Docker Hub workflow
+gh run list --repo diegosouzapw/OmniRoute --workflow docker-publish.yml --limit 1
+gh run watch
+
+# Monitor Electron build
+gh run list --repo diegosouzapw/OmniRoute --workflow electron-release.yml --limit 1
+gh run watch
+
+# Verify NPM version
+npm info omniroute version
+```
+
+### 19. Handle Failures (If Any)
+
+If a workflow fails:
+
+- Use `gh run view --log-failed` to identify the error.
+- Apply the fix on the `main` branch.
+- If necessary, re-trigger the workflow using `gh workflow run --repo diegosouzapw/OmniRoute --ref v3.x.y`
+
+### 20. Preserve release branch
+
+```bash
+# Branch is kept for historical purposes. Do not delete.
+```
+
+---
+
+## Notes
+
+- Ensure CHANGELOG, README and `docs/*` are current BEFORE this workflow — run `npm run check:docs-all` and `/version-bump` first (there is no `/update-docs` workflow anymore)
+- The `prepublishOnly` script runs `npm run build:cli` automatically during `npm publish`
+- After npm publish, verify with `npm info omniroute version`
+- Lock file sync errors are caused by skipping `npm install` after version bump
+- Use `gh auth switch -u diegosouzapw` if git push fails with wrong account
+
+## Known CI Pitfalls
+
+| CI failure | Cause | Fix |
+| ------------------------------------------------------------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
+| `[docs-sync] FAIL - OpenAPI version differs from package.json` | Skipped step 5 — `docs/reference/openapi.yaml` version not updated | Run step 5 (`sed -i ...`) and commit |
+| `[docs-sync] FAIL - CHANGELOG.md first section must be "## [Unreleased]"` | `## [Unreleased]` missing or not at top of CHANGELOG | Add `## [Unreleased]\n\n---\n` before the first versioned `## [x.y.z]` |
+| Electron Linux `.deb` build fails (`FpmTarget` error) | `fpm` Ruby gem not installed on `ubuntu-latest` runner | Already fixed in `electron-release.yml` (`gem install fpm` step) |
+| Docker Hub `502 error writing layer blob` | Transient Docker Hub network error during ARM64 push | Re-run the Docker publish workflow; no code change needed |
diff --git a/.agents/skills/implement-features/SKILL.md b/.agents/skills/implement-features/SKILL.md
new file mode 100644
index 0000000000..ff88804039
--- /dev/null
+++ b/.agents/skills/implement-features/SKILL.md
@@ -0,0 +1,713 @@
+---
+name: implement-features-cx
+description: Analyze open feature request issues, implement viable ones on dedicated branches, and respond to authors
+---
+
+# /implement-features — Feature Request Harvest, Research & Implementation Workflow
+
+## Overview
+
+A **5-phase** workflow that systematically harvests feature requests from GitHub issues, creates structured idea files, researches solutions across the internet and Git repositories, presents a consolidated report for user approval, then generates detailed implementation plans and executes them.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` for independent reads, checks, and GitHub calls.
+- Approval gates are hard stops. Present the report/plan in the final response and do not move to implementation phases until the user explicitly approves.
+- Keep harvest/research bounded enough to produce the approval report quickly; do not start implementation while still in report phases.
+
+**Output directory structure:**
+
+```
+_ideia/
+├── viable/ # Features approved for implementation
+│ ├── need_details/ # ❓ Good idea but waiting for author clarification (issues stay OPEN)
+│ │ └── 1015-warp-terminal-mitm.md
+│ ├── 1046-native-playground.md # ✅ Ready — researched and planned
+│ └── 1046-native-playground.requirements.md
+├── defer/ # ⏭️ Good ideas deferred for future cycles (issues CLOSED)
+│ └── 1041-smart-auto-combos.md
+└── notfit/ # ❌ Out of scope / already exists (issues CLOSED)
+ └── 945-telegram-integration.md
+
+_tasks/features-vX.Y.Z/ # Implementation plans (per-release)
+└── 1046-native-playground.plan.md
+```
+
+> **LIFECYCLE RULE:** `viable/` files are **DELETED** once the feature is implemented — they are not moved. Only unimplemented features live in `viable/` (or `viable/need_details/`). Files in `defer/` and `notfit/` remain as permanent reference.
+
+> **BRANCH RULE**: All implementation work MUST happen on the current `release/vX.Y.Z` branch. Never create separate `feat/` branches. If no release branch exists yet, create one first using `/generate-release` Phase 1 steps 1–5.
+
+---
+
+## Phase 1 — Harvest: Collect & Catalog Feature Ideas
+
+### 1.1 Identify the Repository
+
+// turbo
+
+- Run: `git -C remote get-url origin` to extract owner/repo.
+
+### 1.2 Ensure Release Branch Exists
+
+// turbo
+
+Before doing any work, ensure you are on the current release branch:
+
+```bash
+# Check current branch
+git branch --show-current
+
+# If on main, determine next version and create the release branch
+VERSION=$(node -p "require('./package.json').version")
+NEXT=$(node -p "const [a,b,c]=('$VERSION').split('.').map(Number); c>=9?a+'.'+(b+1)+'.0':a+'.'+b+'.'+(c+1)")
+git checkout -b release/v$NEXT
+npm version patch --no-git-tag-version
+npm install
+```
+
+If already on a `release/vX.Y.Z` branch, continue working there.
+
+### 1.3 Fetch ALL Open Feature Requests
+
+// turbo-all
+
+**⚠️ CRITICAL**: The JSON output of `gh issue list` can be truncated by the tool, silently hiding issues. You MUST use the two-step approach below.
+
+**Step 1 — Get Issue numbers only** (small output, never truncated):
+
+```bash
+# Fetch issues with feature/enhancement labels
+gh issue list --repo / --state open -l "enhancement" --limit 500 --json number --jq '.[].number'
+
+# Also check for [Feature] in title (common pattern when no labels are set)
+gh issue list --repo / --state open --limit 500 --json number,title --jq '.[] | select(.title | test("\\[Feature\\]|\\[feature\\]|feature request"; "i")) | .number'
+```
+
+- Merge both lists, deduplicate. Count and confirm the total.
+
+**Step 2 — Fetch full metadata for each Issue** (one call per issue):
+
+```bash
+gh issue view --repo / --json number,title,labels,body,comments,createdAt,author,assignees
+```
+
+- Read the **entire body** — including description, use cases, screenshots, mockups, and any embedded images.
+- Read **ALL comments** — community discussion, agreements, restrictions, owner responses, and linked PRs.
+- **Images**: If the body or comments contain image URLs (`` or `https://...png/jpg/gif`), note them — they may contain UI mockups, wireframes, or architecture diagrams that are essential to understanding the request.
+- You may batch these into parallel calls (up to 4 at a time).
+- Sort by oldest first (FIFO).
+
+### 1.4 Create Idea Files (initially in `_ideia/` root)
+
+For each feature request, create a structured idea file in `/_ideia/`:
+
+**Filename convention**: `-.md`
+Example: `1046-native-playground.md`, `1041-smart-auto-combos.md`
+
+#### 1.4a — If the idea file does NOT exist yet, create it:
+
+```markdown
+# Feature:
+
+> GitHub Issue: # — opened by @ on
+> Status: 📋 Cataloged | Priority: TBD
+
+## 📝 Original Request
+
+
+
+## 💬 Community Discussion
+
+
+
+### Participants
+
+- @ — Original requester
+- @ —
+- ...
+
+### Key Points
+
+-
+-
+-
+
+## 🎯 Refined Feature Description
+
+
+
+### What it solves
+
+-
+-
+
+### How it should work (high level)
+
+1.
+2.
+3. ...
+
+### Affected areas
+
+-
+
+## 📎 Attachments & References
+
+-
+
+## 🔗 Related Ideas
+
+-
+```
+
+#### 1.4b — If the idea file ALREADY exists, update it:
+
+- Append new comments from the issue to the **Community Discussion** section.
+- Update the **Refined Feature Description** if new information changes the understanding.
+- Add any new **Related Ideas** cross-references found.
+- **Do NOT overwrite** existing content — append and enrich it.
+
+### 1.5 Cross-Reference & Deduplication
+
+After processing all issues:
+
+- Scan all `_ideia/*.md` files for overlapping features.
+- If two features are substantially the same, add `🔗 Related Ideas` cross-references to both.
+- If one is a strict subset of another, note it in the smaller file: `> ℹ️ This feature is a subset of #. Consider implementing together.`
+
+---
+
+## Phase 2 — Research: Find Solutions & Build Requirements
+
+For each cataloged idea that is **viable** (aligns with the project's goals):
+
+### 2.1 Viability Pre-Check
+
+Before investing in research, quickly assess:
+
+- [ ] Does this feature align with the project's goals and architecture?
+- [ ] Is it technically feasible with the current codebase?
+- [ ] Does it duplicate existing functionality?
+- [ ] Would it introduce breaking changes or security risks?
+- [ ] Is there enough detail to understand what's needed?
+
+**Verdict options:**
+
+| Verdict | When | Action |
+| --------------------- | ------------------------------------- | --------------------------- |
+| ✅ **VIABLE** | Good idea, enough context | Proceed to Research |
+| ❓ **NEEDS DETAIL** | Good idea, insufficient spec | Skip research, ask author |
+| ⏭️ **DEFER** | Good idea, too complex for this cycle | Catalog only, skip research |
+| ❌ **NOT FIT** | Doesn't fit the project | Explain why |
+| 🔁 **ALREADY EXISTS** | Feature already implemented | Point to existing feature |
+
+### 2.2 Internet Research (for VIABLE features)
+
+For each viable feature, perform systematic research:
+
+**Step 1 — Web search for similar implementations:**
+
+```
+WebSearch("how to implement in ")
+WebSearch(" implementation nextjs typescript 2025 2026")
+WebSearch(" open source library npm")
+```
+
+**Step 2 — Find reference Git repositories:**
+
+```
+WebSearch("site:github.com stars:>100")
+WebSearch("github implementation recently updated 2026")
+```
+
+- Find **up to 10 relevant repositories**, sorted by most recently updated.
+- For each repository:
+ - Note the repo URL, star count, last commit date
+ - Read its README and relevant source files via `WebFetch`
+ - Extract the architectural approach, patterns used, and key code snippets
+
+**Step 3 — Read API docs and standards:**
+
+If the feature involves an external API, protocol, or standard:
+
+- Find and read the official documentation
+- Note version requirements, authentication patterns, rate limits
+
+### 2.3 Create Requirements File
+
+For each researched feature, create a requirements file alongside its idea file:
+
+**Filename**: `-.requirements.md`
+
+```markdown
+# Requirements:
+
+> Feature Idea: [#](./-.md)
+> Research Date:
+> Verdict: ✅ VIABLE
+
+## 🔍 Research Summary
+
+
+
+## 📚 Reference Implementations
+
+| # | Repository | Stars | Last Updated | Approach | Relevance |
+| --- | ---------------- | ----- | ------------ | -------- | ------------ |
+| 1 | [repo/name](url) | ⭐ N | YYYY-MM-DD | | High/Med/Low |
+| 2 | ... | | | | |
+
+### Key Patterns Found
+
+-
+-
+
+## 📐 Proposed Solution Architecture
+
+### Approach
+
+
+
+### New Files
+
+| File | Purpose |
+| --------------------- | ------------- |
+| `path/to/new/file.ts` | |
+
+### Modified Files
+
+| File | Changes |
+| -------------------------- | -------------- |
+| `path/to/existing/file.ts` | |
+
+### Database Changes
+
+-
+
+### API Changes
+
+-
+
+### UI Changes
+
+-
+
+## ⚙️ Implementation Effort
+
+- **Estimated complexity**: Low / Medium / High / Very High
+- **Estimated files changed**: ~N
+- **Dependencies needed**:
+- **Breaking changes**: Yes/No —
+- **i18n impact**:
+- **Test coverage needed**:
+
+## ⚠️ Open Questions
+
+-
+-
+
+## 🔗 External References
+
+-
+-
+```
+
+---
+
+## Phase 2.5 — Organize & Respond: Sort Files and Post GitHub Comments
+
+### 2.5.1 Create Directory Structure
+
+// turbo
+
+```bash
+mkdir -p /_ideia/viable
+mkdir -p /_ideia/viable/need_details
+mkdir -p /_ideia/defer
+mkdir -p /_ideia/notfit
+```
+
+### 2.5.2 Move Idea Files to Category Subdirectories
+
+After classification, move EVERY idea file to its correct subdirectory:
+
+```bash
+# ✅ VIABLE — move idea + requirements files
+mv _ideia/-*.md _ideia/viable/
+mv _ideia/-*.requirements.md _ideia/viable/
+
+# ❓ NEEDS DETAIL — viable but waiting for author response
+mv _ideia/-*.md _ideia/viable/need_details/
+
+# ⏭️ DEFER — move idea files only
+mv _ideia/-*.md _ideia/defer/
+
+# ❌ NOT FIT & 🔁 ALREADY EXISTS — move idea files only
+mv _ideia/-*.md _ideia/notfit/
+```
+
+No files should remain in `_ideia/` root after this step (except subdirectories).
+
+### 2.5.3 Post GitHub Comments by Category
+
+**Each category has a specific comment template and action:**
+
+---
+
+#### For 🔁 ALREADY EXISTS — Comment + CLOSE issue
+
+// turbo
+
+The feature already exists in the system. Explain WHERE it is and HOW to use it.
+
+```markdown
+Hi @! Thanks for the suggestion! 🙏
+
+Great news — this functionality **already exists** in OmniRoute:
+
+**📍 Where to find it:**
+
+**🔧 How to use it:**
+
+1.
+2.
+3.
+
+If you have any trouble finding or using it, feel free to ask in a Discussion. We're always happy to help!
+
+Closing this as the feature is already available. 🎉
+```
+
+```bash
+gh issue close --repo / --comment ""
+```
+
+---
+
+#### For ⏭️ DEFER — Comment + CLOSE issue
+
+// turbo
+
+Thank the user, explain the idea was cataloged, and that we'll study it before implementing.
+
+```markdown
+Hi @! Thanks for this thoughtful feature request! 🙏
+
+We really appreciate the detailed proposal. We've **cataloged your idea** and it's now part of our improvement backlog.
+
+Due to the **significant architectural impact** of this feature, we'll need to conduct thorough use-case studies and architectural analysis before we start development. This ensures we build it right and don't introduce regressions.
+
+**What happens next:**
+
+- Your idea is saved in our internal feature backlog
+- We'll conduct architecture studies when this area is prioritized
+- We'll notify you here when development begins
+
+Thank you for contributing to OmniRoute's roadmap! Your input helps shape the product. 🚀
+```
+
+```bash
+gh issue close --repo / --comment ""
+```
+
+---
+
+#### For ❌ NOT FIT — Comment + CLOSE issue
+
+// turbo
+
+Politely explain why the feature doesn't fit the project scope.
+
+```markdown
+Hi @! Thanks for the suggestion! 🙏
+
+After careful analysis, we've determined that this feature **falls outside OmniRoute's core scope** as a proxy/router.
+
+**Reason:**
+
+**Alternative:**
+
+We appreciate you thinking of ways to improve OmniRoute! If you'd like to discuss this further, feel free to open a Discussion. 🙏
+```
+
+```bash
+gh issue close --repo / --comment ""
+```
+
+---
+
+#### For ❓ NEEDS DETAIL — Comment (keep OPEN)
+
+// turbo
+
+Ask for the specific missing details needed.
+
+```markdown
+Hi @! Thanks for the feature request — it's an interesting idea and we'd love to explore it further. 🙏
+
+To move forward, we need a few more details:
+
+1.
+2.
+3.
+
+If you know of any **open-source projects or repositories** that implement something similar, please share links — it would help us design the best solution.
+
+Looking forward to your response! 🚀
+```
+
+---
+
+#### For ✅ VIABLE — Comment (keep OPEN)
+
+// turbo
+
+Thank the user, confirm we've cataloged their idea, and explain it may be implemented in future versions.
+
+```markdown
+Hi @! Thanks for the great feature suggestion! 🙏
+
+We've analyzed your request and it aligns well with OmniRoute's roadmap. We've **cataloged this feature** and it's in our implementation backlog.
+
+**Status:** 📋 Cataloged for future implementation
+
+This feature may be included in upcoming releases. We'll **respond to this issue and tag you** as soon as implementation begins so you can test it.
+
+Thank you for helping improve OmniRoute! 🚀
+```
+
+**⚠️ Do NOT close viable issues — they remain OPEN for tracking.**
+
+---
+
+## Phase 3 — Report: Present Findings to User
+
+### 3.1 🛑 MANDATORY STOP — Present Consolidated Report
+
+After completing Phase 1, Phase 2, and Phase 2.5, **STOP and present the following report** in the chat. Do NOT proceed to implementation.
+
+Present a structured report containing:
+
+#### 3.1a — Feature Summary Table
+
+| # | Issue | Title | Verdict | Location | Action |
+| --- | ----- | ----- | --------------- | ----------------------------- | ----------------------------- |
+| 1 | #N | Title | ✅ VIABLE | `_ideia/viable/` | Issue OPEN, comment posted |
+| 2 | #N | Title | ⏭️ DEFER | `_ideia/defer/` | Issue CLOSED with explanation |
+| 3 | #N | Title | ❌ NOT FIT | `_ideia/notfit/` | Issue CLOSED with explanation |
+| 4 | #N | Title | 🔁 EXISTS | `_ideia/notfit/` | Issue CLOSED with guidance |
+| 5 | #N | Title | ❓ NEEDS DETAIL | `_ideia/viable/need_details/` | Issue OPEN, questions posted |
+
+#### 3.1b — Viable Features Detail
+
+For each VIABLE feature, provide a brief paragraph:
+
+- What was found during research
+- The proposed approach
+- Key risks or unknowns
+- Which reference repositories were most useful
+
+#### 3.1c — Issues Requiring Author Feedback
+
+For features marked ❓ NEEDS DETAIL, list:
+
+- What specific information is missing
+- What examples or repository references would help
+
+#### 3.1d — Ask for User Confirmation
+
+End the report with:
+
+> **Ready to proceed with implementation?**
+>
+> - Reply **"sim"** or **"yes"** to generate full implementation plans for all VIABLE features.
+> - Reply with specific issue numbers to select only certain features.
+> - Reply **"não"** or **"no"** to stop here.
+
+---
+
+## Phase 4 — Plan: Generate Implementation Plans (after user says "yes")
+
+> **⚠️ Do NOT enter this phase without explicit user approval from Phase 3.**
+
+### 4.1 Create Task Directory
+
+```bash
+mkdir -p /_tasks/features-vX.Y.Z/
+```
+
+### 4.2 Generate One Implementation Plan Per Feature
+
+For each VIABLE feature approved by the user, create:
+
+**Filename**: `_tasks/features-vX.Y.Z/-.plan.md`
+
+```markdown
+# Implementation Plan:
+
+> Issue: #
+> Idea: [\_ideia/viable/-title.md](../../_ideia/viable/-title.md)
+> Requirements: [\_ideia/viable/-title.requirements.md](../../_ideia/viable/-title.requirements.md)
+> Branch: `release/vX.Y.Z`
+
+## Overview
+
+
+
+## Pre-Implementation Checklist
+
+- [ ] Read all related source files listed below
+- [ ] Confirm no conflicts with in-flight PRs
+- [ ] Verify database migration numbering
+
+## Implementation Steps
+
+### Step 1:
+
+**Files:**
+
+- `path/to/file.ts` —
+
+**Details:**
+
+
+### Step 2:
+
+...
+
+### Step N: Tests
+
+**New test files:**
+
+- `tests/unit/.test.mjs` —
+
+**Test cases:**
+
+- [ ]
+- [ ]
+
+### Step N+1: i18n
+
+**Translation keys to add:**
+
+- `.` — ""
+
+### Step N+2: Documentation
+
+- [ ] Update CHANGELOG.md
+- [ ] Update relevant docs/ files
+
+## Verification Plan
+
+1. Run `npm run build` — must pass
+2. Run `npm test` — all tests must pass
+3. Run `npm run lint` — no new errors
+4.
+
+## Commit Plan
+```
+
+feat: (#)
+
+```
+
+```
+
+### 4.3 Present Plans for Final Approval
+
+Present a summary of all generated plans:
+
+> **Implementation plans generated:**
+>
+> | # | Feature | Plan File | Steps | Effort |
+> | --- | ------- | ---------------------------------------- | ------- | ------ |
+> | 1 | | `_tasks/features-vX.Y.Z/N-title.plan.md` | N steps | Medium |
+>
+> Reply **"sim"** or **"yes"** to begin implementation of all features.
+> Reply with specific issue numbers to implement only certain ones.
+
+---
+
+## Phase 5 — Execute: Implement the Plans (after user says "yes")
+
+> **⚠️ Do NOT enter this phase without explicit user approval from Phase 4.**
+
+### 5.1 Implement Each Feature
+
+For each approved plan, execute it step by step:
+
+1. **Follow the plan** — implement exactly as specified in the `.plan.md` file
+2. **Build** — Run `npm run build` after each feature to verify compilation
+3. **Test** — Run `npm test` to ensure no regressions
+4. **Commit** — Commit with: `feat: (#)`
+5. **Update the plan** — Mark completed steps with `[x]` in the plan file
+6. **Continue** — Move to the next feature (do NOT switch branches)
+
+### 5.2 Respond to Authors (Update Viable Issues)
+
+For each implemented feature, **close the issue with a final comment**:
+
+````markdown
+✅ **Implemented in `release/vX.Y.Z`!**
+
+Hi @! Great news — your feature request has been implemented! 🎉
+
+**What was done:**
+
+-
+
+**How to try it:**
+
+```bash
+git fetch origin && git checkout release/vX.Y.Z
+npm install && npm run dev
+```
+````
+
+This will be included in the upcoming **vX.Y.Z** release. Feel free to reopen if you spot any issues! 🚀
+
+````
+
+```bash
+gh issue close --repo / --comment ""
+````
+
+Then **DELETE the idea file** — it has served its purpose:
+
+```bash
+# ✅ Implemented files are DELETED (not moved)
+rm _ideia/viable/-.md
+rm _ideia/viable/-.requirements.md # if exists
+```
+
+> **Why delete?** `viable/` only holds features that still NEED to be done. Once implemented, the commit history and CHANGELOG are the source of truth. Keeping the file would be confusing.
+
+### 5.3 Finalize & Push
+
+After implementing all approved features:
+
+1. **Update CHANGELOG.md** on the release branch with all new feature entries
+2. Push the release branch: `git push origin release/vX.Y.Z`
+3. Run `/generate-release` workflow Phase 1 steps 7–10 (tests → commit → push → open PR to main → wait for user)
+
+### 5.4 Final Summary Report
+
+Present a final summary report to the user:
+
+| Issue | Title | Verdict | Action | Commit |
+| ----- | ----- | --------------- | -------------------------------------------------- | --------- |
+| #N | Title | ✅ Implemented | Issue closed, idea file deleted | `abc1234` |
+| #N | Title | ⏭️ Deferred | Issue closed + saved in `_ideia/defer/` | — |
+| #N | Title | ❌ Not Fit | Issue closed + saved in `_ideia/notfit/` | — |
+| #N | Title | 🔁 Exists | Issue closed + saved in `_ideia/notfit/` | — |
+| #N | Title | ❓ Needs Detail | Issue OPEN, moved to `_ideia/viable/need_details/` | — |
+
+Include:
+
+- Total features harvested
+- Total ideas cataloged (`viable/need_details/` + `defer/` + `notfit/`)
+- Total features implemented (idea files deleted, issues closed)
+- Total features deferred
+- Total issues closed
+- Total issues left open (needs detail only — viable are closed after implementation)
+- Test results (pass/fail count)
diff --git a/.agents/skills/issue-triage/SKILL.md b/.agents/skills/issue-triage/SKILL.md
new file mode 100644
index 0000000000..696c3fef4e
--- /dev/null
+++ b/.agents/skills/issue-triage/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: issue-triage-cx
+description: How to respond to GitHub issues with insufficient information
+---
+
+# Issue Triage Workflow
+
+Respond to GitHub issues that need more information before they can be investigated.
+
+## Steps
+
+### 1. Identify issues needing triage
+
+```bash
+gh issue list --state open --limit 20
+```
+
+### 2. Evaluate each issue
+
+Check if the issue has:
+
+- Clear reproduction steps
+- Environment details (OS, Node.js version, OmniRoute version)
+- Error logs/screenshots
+- Expected vs actual behavior
+
+### 3. Respond with triage template
+
+For issues missing information:
+
+```markdown
+Thank you for reporting this issue! To help us investigate, please provide:
+
+1. **OmniRoute version**: (`omniroute --version`)
+2. **Node.js version**: (`node --version`)
+3. **Operating system**: (e.g., Ubuntu 24.04, macOS 15, Windows 11)
+4. **Installation method**: (npm, Docker, source)
+5. **Steps to reproduce**: (exact commands/actions that trigger the issue)
+6. **Error logs**: (paste relevant logs from the console)
+7. **Expected behavior**: (what should happen)
+
+This will help us debug and resolve your issue faster. 🙏
+```
+
+### 4. Label the issue
+
+Add appropriate labels: `needs-info`, `bug`, `enhancement`, `question`, etc.
+
+```bash
+gh issue edit --add-label "needs-info"
+```
diff --git a/.agents/skills/resolve-issues/SKILL.md b/.agents/skills/resolve-issues/SKILL.md
new file mode 100644
index 0000000000..a1658f09e0
--- /dev/null
+++ b/.agents/skills/resolve-issues/SKILL.md
@@ -0,0 +1,173 @@
+---
+name: resolve-issues-cx
+description: Fetch all open GitHub issues, analyze bugs, resolve what's possible, triage the rest, wait for user validation, then commit and release
+---
+
+# /resolve-issues — Automated Issue Resolution Workflow
+
+## Overview
+
+This workflow fetches all open issues from the project's GitHub repository, classifies them, analyzes bugs, proposes a resolution plan, waits for user validation, and ONLY THEN implements the fixes, commits, and closes the issues on the current release branch (`release/vX.Y.Z`). It does NOT merge or release automatically — the release branch is later merged via PR to main.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` for independent reads, checks, and GitHub calls.
+- The initial report/plan is a hard stop. Do not edit code, close issues, or commit until the user explicitly approves the report.
+- Keep classification and bug analysis bounded enough to produce the user-facing report before deep implementation work.
+
+> **BRANCH RULE**: All work MUST happen on the current `release/vX.Y.Z` branch. Never create separate `fix/` branches. If no release branch exists yet, create one first using `/generate-release` Phase 1 steps 1–5.
+
+> **⛔ PR PROHIBITION**: If a fix is associated with a contributor's PR, you MUST merge their PR — NEVER close it and re-implement the fix yourself. See `/review-prs` workflow for the full policy. The `gh pr close` command is FORBIDDEN unless the repository owner explicitly requests it.
+
+## Steps
+
+### 1. Identify the GitHub Repository
+
+// turbo
+
+- Run: `git -C remote get-url origin` to extract the owner/repo
+- Parse the owner and repo name from the URL
+
+### 2. Ensure Release Branch Exists
+
+// turbo
+
+Before doing any work, ensure you are on the current release branch:
+
+```bash
+# Check current branch
+git branch --show-current
+
+# If on main, determine next version and create the release branch
+VERSION=$(node -p "require('./package.json').version")
+NEXT=$(node -p "const [a,b,c]=('$VERSION').split('.').map(Number); c>=9?a+'.'+(b+1)+'.0':a+'.'+b+'.'+(c+1)")
+git checkout -b release/v$NEXT
+npm version patch --no-git-tag-version
+npm install
+```
+
+If already on a `release/vX.Y.Z` branch, continue working there.
+
+### 3. Fetch All Open Issues
+
+// turbo-all
+
+**⚠️ CRITICAL**: The JSON output of `gh issue list` can be truncated by the tool, silently hiding issues. You MUST use the two-step approach below to guarantee **all** issues are fetched.
+
+**Step 3a — Get Issue numbers only** (small output, never truncated):
+
+- Run: `gh issue list --repo / --state open --limit 500 --json number --jq '.[].number'`
+- This outputs one issue number per line. Count them and confirm total.
+
+**Step 3b — Fetch full metadata for each Issue** (one call per issue):
+
+- For each issue number from step 3a, run:
+ `gh issue view --repo / --json number,title,labels,body,comments,createdAt,author`
+- You may batch these into parallel calls (up to 4 at a time).
+- Sort by oldest first (FIFO).
+
+### 4. Classify Each Issue
+
+For each issue, determine its type:
+
+- **Bug** — Has `bug` label, or body contains error messages, stack traces, "doesn't work", "broken", "crash", "error"
+- **Feature Request** — Has `enhancement`/`feature` label, or body describes new functionality
+- **Question** — Has `question` label, or is asking "how to" something
+- **Other** — Anything else
+
+Focus ONLY on **Bugs** for resolution. Feature requests and questions should be skipped with a note in the final report.
+
+### 5. Deep-Read Each Bug Issue (One-by-One Analysis)
+
+**IMPORTANT**: Read each bug issue thoroughly, one at a time, before moving to the next. This is NOT a batch process — each issue needs focused attention.
+
+#### 5a. Understand the Problem
+
+For each bug issue, perform the full analysis:
+
+1. **Read the entire body** — including Description, Steps to Reproduce, Expected/Actual Behavior, Error Logs, and Screenshots
+2. **Read ALL comments** — including bot triage comments (Kilo, etc.) and owner/community responses. Pay attention to:
+ - Whether someone already responded with a fix
+ - Whether a community member confirmed the issue is resolved
+ - Whether the issue was marked as duplicate by a bot. **WARNING: DO NOT blindly trust bot duplicate labels (e.g., kilo-duplicate). Bots make mistakes. You MUST read the full conversation and do your own independent analysis to determine if it is truly a duplicate or a distinct bug.**
+3. **Identify the claimed error** — extract the exact error message, status code, and provider/model involved
+
+#### 5b. Check Information Sufficiency
+
+Verify the issue contains enough to act on:
+
+- [ ] Clear description of the problem
+- [ ] Steps to reproduce OR error logs
+- [ ] Provider/model/version information
+- [ ] Expected vs actual behavior
+
+#### 5c. Determine Issue Disposition
+
+For each bug, classify into one of 5 actions:
+
+| Disposition | When to Apply | Action |
+| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
+| **✅ CLOSE — Already Fixed** | Owner responded with fix + no user follow-up, OR community confirmed fix | Close with comment citing which version fixed it |
+| **✅ CLOSE — Duplicate** | You have independently verified the issue is a duplicate (do NOT rely solely on bot flags) + user provides no new info | Close referencing the original issue |
+| **✅ CLOSE — Stale** | We requested logs/info > 7 days ago with no reply | Close thanking the user, invite to reopen if needed |
+| **📝 RESPOND — Needs Info** | Issue is real but missing critical reproduction details | Comment asking for specifics per `/issue-triage` |
+| **📝 RESPOND — User Config** | Error is caused by unsupported env (Node version, wrong model path, missing API enablement) | Comment explaining the user-side fix |
+| **🔧 FIX — Code Change** | Root cause is confirmed in the codebase | Research, propose solution in report, wait for approval |
+
+#### 5d. For "FIX — Code Change" Issues
+
+Before coding, perform deep source analysis to formulate a plan:
+
+1. **Search the codebase** — `grep_search` for error strings, relevant function names, affected files
+2. **Search the web** — for upstream API changes, SDK updates, or breaking changes that explain the bug
+3. **Read the full source file** — don't rely on grep snippets; understand the surrounding logic
+4. **Verify the root cause** — confirm the bug is reproducible based on the code, not just a user misconfiguration
+5. **Formulate a proposed solution** — detail the exact files and lines you will change and how you will solve it.
+6. **Create an Implementation Plan file** — write your proposed solution to `_tasks/features-vX.Y.Z/-.plan.md` (e.g. `_tasks/features-v3.7.6/1810-auto-restore-probe-failed-db.plan.md`) where `vX.Y.Z` is the current branch version. The plan should contain an Overview, Pre-Implementation Checklist, and detailed Implementation Steps (Files, Changes).
+7. **DO NOT modify the codebase yet** — wait for user approval on your report and plan first.
+
+#### 5e. For "RESPOND" Issues
+
+Post a substantive comment that:
+
+- Acknowledges the specific error they reported
+- Explains the likely root cause
+- Provides concrete steps to resolve (version upgrade, env var fix, model path correction)
+- Asks for follow-up info if needed
+
+**Do NOT post generic template responses.** Every comment should reference the user's specific error messages and environment.
+
+### 6. Generate Report & Wait for Validation
+
+Present a summary report to the user detailing your proposed actions. For any bugs that need fixing, explicitly explain your proposed solution (files to change and logic) and point out that it will be implemented on the release branch (`release/vX.Y.Z`) after approval.
+
+| Issue | Title | Status | Proposed Action / Version |
+| ----- | ----- | ------------- | ----------------------------------------- |
+| #N | Title | ✅ Close | Already fixed / duplicate (explain why) |
+| #N | Title | 🔧 Propose | Explanation of the code fix to be applied |
+| #N | Title | 📝 Respond | Guidance comment to be posted |
+| #N | Title | ❓ Needs Info | Triage comment to be posted |
+| #N | Title | ⏭️ Skip | Feature request / not a bug |
+
+> **⚠️ IMPORTANT**: Do NOT implement code changes, commit, push, or close issues at this step.
+> Wait for the user to review the proposed fixes and respond with **OK** before proceeding.
+
+- If the user says **OK** or approves → Proceed to step 7
+- If the user requests changes → Adjust the proposed solution and present the report again
+- If the user rejects → Revert any accidental changes and stop
+
+### 7. Implement Fixes, Run Tests & Commit (only after user approval)
+
+After the user validates and gives the OK:
+
+1. **Implement the fixes** — modify the codebase according to the approved plan.
+2. **Run tests** — `npm run test:all` (or the specific test file) to ensure 100% pass.
+3. **Update CHANGELOG.md** with all new bug fix entries.
+4. **Commit** each fix individually on the release branch with message format: `fix: (#)`.
+5. **Push** the release branch: `git push origin release/vX.Y.Z`.
+6. **Close resolved issues immediately**. For each issue that was marked as Fixed, run:
+ `gh issue close --repo / --comment "Thank you for reporting! This issue has been fixed and will be included in the next release (vX.Y.Z)."`
+7. Likewise, close `Duplicate` issues referencing the original, close `Needs Info` if stale, and post the required comments.
+8. If the project runs automatic releases or needs a PR, proceed to run `/generate-release` workflow Phase 1 steps 7–10 (tests → commit → push → open PR to main → wait for user).
+
+If NO fixes were committed, skip closing and source control steps and just conclude the workflow.
diff --git a/.agents/skills/review-discussions/SKILL.md b/.agents/skills/review-discussions/SKILL.md
new file mode 100644
index 0000000000..13e7255069
--- /dev/null
+++ b/.agents/skills/review-discussions/SKILL.md
@@ -0,0 +1,126 @@
+---
+name: review-discussions-cx
+description: Read all open GitHub Discussions, summarize them, respond to pending ones, and create issues from actionable feature requests
+---
+
+# /review-discussions — GitHub Discussions Review & Response Workflow
+
+## Overview
+
+This workflow reads all open GitHub Discussions, generates a categorized summary, identifies which ones need a response, drafts and posts replies, and optionally creates issues from actionable feature requests. It follows the same flow used for Issues but adapted for the Discussions forum.
+
+> **Tool mapping note (v3.8):** Where steps below say `browser_subagent`, modern runtimes should substitute with the `gh` CLI — `gh api graphql` for reading discussions and mutations for posting comments. `WebFetch` is acceptable for read-only HTML scraping when GraphQL is overkill, but prefer `gh` for any write actions.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` for independent reads and GitHub/browser fetches.
+- The summary report is a hard stop. Do not post discussion replies or create issues until the user explicitly approves.
+
+// turbo-all
+
+## Steps
+
+### 1. Identify the GitHub Repository
+
+- Run: `git -C remote get-url origin` to extract the owner/repo
+- Parse the owner and repo name from the URL
+
+### 2. Fetch All Open Discussions
+
+- Use `WebFetch` to fetch `https://github.com///discussions`
+- Parse the discussion list to get all discussion titles, IDs, authors, categories, and dates
+- For each discussion, fetch the individual page to read the full content and all comments/replies
+
+### 3. Summarize All Discussions
+
+For each discussion, extract:
+
+- **Title** and **#Number**
+- **Author** (GitHub username)
+- **Category** (Announcements, General, Ideas, Q&A, Show and tell)
+- **Date** created
+- **Summary** of the original post (1-2 sentences)
+- **Comments count** and key participants
+- **Your previous response** (if any)
+- **Pending action** — whether a response or follow-up is needed
+
+### 4. Present Summary Report to User
+
+Present the full summary to the user organized by category, using a table:
+
+| # | Category | Title | Author | Date | Status |
+| --- | -------- | ----- | ------ | ------ | ----------------- |
+| #N | Ideas | Title | @user | Mar 23 | ⚠️ Needs response |
+| #N | Q&A | Title | @user | Mar 9 | ✅ Answered |
+| #N | General | Title | @user | Mar 19 | ⚠️ Needs response |
+
+Highlight:
+
+- **⚠️ Needs response** — No reply from maintainer, or a follow-up comment was left unanswered
+- **✅ Answered** — Maintainer already responded
+- **🐛 Bug reported** — A bug was mentioned that needs tracking
+- **💡 Actionable** — Contains a concrete feature request that could become an issue
+
+### 5. Draft & Post Responses
+
+For each discussion that needs a response, draft a reply following these guidelines:
+
+#### Response Style
+
+- **Friendly and professional** — Start with "Hey @username!"
+- **Acknowledge the contribution** — Thank the user for their input
+- **Be specific** — Reference existing features, settings, or dashboard pages if the feature already exists
+- **Provide workarounds** — If the request isn't implemented yet, suggest current alternatives
+- **Commit to action** — If the request is valid, state that you'll open an issue or add it to the roadmap
+- **Keep it concise** — 3-5 paragraphs max
+
+#### Posting via Browser
+
+- Use `browser_subagent` to navigate to each discussion and post the comment
+- **IMPORTANT**: When typing text in GitHub comment boxes via the browser, use only plain ASCII characters:
+ - Use regular hyphens `-` instead of em-dashes
+ - Use `->` instead of arrow symbols
+ - Do NOT use emoji Unicode characters (the browser keyboard may fail on them)
+ - Use `**bold**` and `\`code\`` markdown formatting
+- Click the green "Comment" button (or "Reply" for threaded replies) after typing
+- Verify the comment was posted by checking the page shows the new comment
+
+### 6. Create Issues from Actionable Feature Requests
+
+For discussions that contain concrete, actionable feature requests:
+
+1. Ask the user which ones should become issues
+2. For each approved request, create a GitHub issue via `browser_subagent`:
+ - Navigate to `https://github.com///issues/new`
+ - **Title**: ` - `
+ - **Body** should include:
+ - `## Feature Request` header
+ - `**Source:** Discussion #N by @author`
+ - `## Problem` — What limitation the user hit
+ - `## Proposed Solution` — How it could work
+ - `### Implementation Ideas` — Technical approach
+ - `### Current Workarounds` — What users can do today
+ - `## Additional Context` — Links to related issues/discussions
+ - Add `enhancement` label
+ - Click "Submit new issue" / "Create"
+3. After creation, go back to the original discussion and post a comment linking to the new issue:
+ - "I've opened Issue #N to track this feature request. Follow along there for updates!"
+
+### 7. Final Report
+
+Present a final summary to the user:
+
+| Discussion | Action Taken |
+| ---------- | ---------------------------------- |
+| #N — Title | Responded with workarounds |
+| #N — Title | Responded + created Issue #N |
+| #N — Title | Already answered, no action needed |
+| #N — Title | Responded to follow-up comment |
+
+## Notes
+
+- This workflow is **interactive** — always present the summary and wait for user approval before posting responses or creating issues
+- If the user says "pode responder" (or similar approval), proceed with posting all drafted responses
+- For discussions in non-English languages, respond in the same language as the original post
+- Always reference specific dashboard paths, config options, or code files when explaining existing features
+- When a discussion reveals a bug, note it separately from feature requests
diff --git a/.agents/skills/review-prs/SKILL.md b/.agents/skills/review-prs/SKILL.md
new file mode 100644
index 0000000000..bee9b8ae48
--- /dev/null
+++ b/.agents/skills/review-prs/SKILL.md
@@ -0,0 +1,268 @@
+---
+name: review-prs-cx
+description: Analyze open Pull Requests from the project's GitHub repository, generate a critical report, and optionally implement approved changes
+---
+
+# /review-prs — PR Review & Analysis Workflow
+
+## ⛔ ABSOLUTE PROHIBITION — Read Before Anything Else
+
+> **NEVER close a contributor's PR if you intend to use ANY of their code, ideas, or fixes.**
+>
+> **NEVER manually integrate contributor code into a release branch and then close their PR.**
+>
+> These actions are **STRICTLY FORBIDDEN** under all circumstances:
+>
+> 1. ❌ Closing a PR and cherry-picking/copying its code into a release branch
+> 2. ❌ Closing a PR "because of conflicts" and re-implementing the same fix yourself
+> 3. ❌ Closing a PR and committing a "similar" solution inspired by it
+> 4. ❌ Using `gh pr close` on any PR whose content was or will be used
+>
+> **Why**: Closing a PR after taking the contributor's work means they get ZERO credit on GitHub — no "Merged" badge, no contribution graph entry, no public record. This is effectively stealing their contribution. An audit found this happened to **37 PRs** in the past.
+>
+> **The ONLY acceptable flow**: Resolve conflicts IN the contributor's branch, push fixes TO their branch, then merge THEIR PR via `gh pr merge`. See Step 7 and Step 8 for the exact procedure.
+>
+> **When to close a PR**: ONLY when the user (repository owner) explicitly requests it, OR when the PR is clearly spam/malicious, OR when the author themselves asks to close it. In ALL other cases, leave it open.
+
+## Overview
+
+This workflow fetches all open PRs from the project's GitHub repository, performs a critical analysis of each one, generates a detailed report, and waits for user approval before proceeding with implementation. **All improvements are committed on the current release branch** (`release/vX.Y.Z`).
+
+> **BRANCH RULE**: PRs are ALWAYS merged into the current `release/vX.Y.Z` branch, NEVER directly into `main`. The release branch acts as a staging area — only after all PRs are integrated and tests pass does the release branch get merged into `main` via the `/generate-release` workflow.
+
+## Codex Execution Notes
+
+The source Claude command uses `// turbo` and `// turbo-all` as execution hints. In Codex, treat them explicitly as follows:
+
+- `// turbo`: batch independent local reads and small `gh`/`git` calls with `multi_tool_use.parallel`.
+- `// turbo-all`: fan out independent per-PR/per-issue calls in practical batches, usually up to 4 GitHub calls at a time.
+- Do not expand Step 4 into exhaustive CI-log debugging before Step 6. Fetch numbers, metadata, diffs/review comments, quick merge/conflict status, and only inspect extra logs when they directly affect the verdict.
+- Step 6 is a hard stop. In Codex, present the report in the final response and wait for the user before Step 7/8.
+- Do not checkout PR branches, edit files, post PR comments, close PRs, merge, cherry-pick, or run broad fix/test loops until the user explicitly approves the report.
+- If `gh pr diff` is too large, record the limit and use `gh pr view --json files` plus `git fetch refs/pull/...` with `git diff --stat` / `git diff --name-status`; only read targeted hunks needed for confirmed findings.
+
+## Steps
+
+### 1. Identify the GitHub Repository
+
+- Read `package.json` to get the repository URL, or use the git remote origin URL
+ // turbo
+- Run: `git -C remote get-url origin` to extract the owner/repo
+
+### 2. Ensure Release Branch Exists
+
+// turbo
+
+Before doing any work, ensure you are on the current release branch:
+
+```bash
+# Check current branch
+git branch --show-current
+
+# If on main, determine next version and create the release branch
+VERSION=$(node -p "require('./package.json').version")
+# Bump patch: e.g. 3.3.11 → 3.3.12
+NEXT=$(node -p "const [a,b,c]=('$VERSION').split('.').map(Number); c>=9?a+'.'+(b+1)+'.0':a+'.'+b+'.'+(c+1)")
+git checkout -b release/v$NEXT
+npm version patch --no-git-tag-version
+npm install
+```
+
+If already on a `release/vX.Y.Z` branch, continue working there.
+
+### 3. Fetch Open Pull Requests
+
+// turbo-all
+
+**⚠️ CRITICAL**: The JSON output of `gh pr list` can be truncated by the tool, silently hiding PRs. You MUST use the two-step approach below to guarantee **all** PRs are fetched.
+
+**Step 3a — Get PR numbers only** (small output, never truncated):
+
+- Run: `gh pr list --repo / --state open --limit 500 --json number --jq '.[].number'`
+- This outputs one PR number per line. Count them and confirm total.
+
+**Step 3b — Fetch full metadata for each PR** (one call per PR):
+
+- For each PR number from step 3a, run:
+ `gh pr view --repo / --json number,title,author,headRefName,baseRefName,body,createdAt,additions,deletions,files`
+- You may batch these into parallel calls (up to 4 at a time).
+
+**Step 3c — Fetch diffs for each PR** (one call per PR, saved to /tmp):
+
+- For each PR number, run:
+ `gh pr diff --repo / > /tmp/pr.diff`
+- Then read each diff file with the appropriate file-read tool (`Read` in Claude Code; equivalent in your agent runtime).
+
+- For each open PR, collect:
+ - PR number, title, author, branch, number of commits, date
+ - PR description/body
+ - Files changed (diff)
+ - Existing review comments (from bots or humans)
+
+**Verification**: Confirm the count of PRs analyzed matches the count from step 3a before proceeding.
+
+### 3.5 Redirect PR Base Branches to Release Branch
+
+// turbo-all
+
+**⚠️ CRITICAL**: Contributors typically open PRs targeting `main`. Before analyzing or merging, redirect ALL open PRs to target the current release branch instead.
+
+```bash
+# Get the current release branch name
+RELEASE_BRANCH=$(git branch --show-current) # e.g. release/v3.5.4
+
+# For each open PR that targets main, change its base to the release branch
+for PR_NUM in $(gh pr list --repo / --state open --json number,baseRefName --jq '.[] | select(.baseRefName == "main") | .number'); do
+ echo "Redirecting PR #$PR_NUM → $RELEASE_BRANCH"
+ gh pr edit "$PR_NUM" --repo / --base "$RELEASE_BRANCH"
+done
+```
+
+This ensures:
+
+1. PRs merge into the release branch, not directly into `main`
+2. Merge conflict detection is accurate against the release branch
+3. The release branch accumulates all changes before the final merge to `main`
+4. If the release branch doesn't exist on remote yet, push it first: `git push origin $RELEASE_BRANCH`
+
+### 4. Analyze Each PR — For each open PR, perform the following analysis:
+
+#### 4a. Feature Assessment
+
+- **Does it make sense?** Evaluate if the feature fills a real gap or solves a valid problem
+- **Alignment** — Check if it aligns with the project's architecture and roadmap
+- **Complexity** — Assess if the scope is reasonable or if it should be split
+
+#### 4b. Code Quality Review
+
+- Check for code duplication
+- Evaluate error handling patterns (consistent with existing codebase?)
+- Check naming conventions and code style
+- Verify TypeScript types (any `any` usage, missing types?)
+
+#### 4c. Security Review
+
+- Check for missing authentication/authorization on new endpoints
+- Check for injection vulnerabilities (URL params, SQL, XSS)
+- Verify input validation on all user-controlled data
+- Check for hardcoded secrets or credentials
+
+#### 4d. Architecture Review
+
+- Does the change follow existing patterns?
+- Are there any breaking changes to public APIs?
+- Is the database schema affected? Migration needed?
+- Impact on performance (N+1 queries, missing indexes?)
+
+#### 4e. Test Coverage
+
+- Does the PR include tests?
+- Are edge cases covered?
+- Would existing tests break?
+
+#### 4f. Cross-Layer (Global) Analysis
+
+Perform a **global impact assessment** to verify whether the PR changes are complete across all layers of the application:
+
+- **Backend → Frontend check**: If the PR adds or modifies backend-only resources (new endpoints, services, data models), evaluate whether corresponding frontend changes are missing:
+ - Does a new endpoint require a new screen/page in the dashboard?
+ - Should there be a new action button, menu item, or navigation link?
+ - Are there new data fields that should be displayed or editable in the UI?
+ - Does a new feature need a toggle, configuration panel, or status indicator?
+- **Frontend → Backend check**: If the PR adds frontend elements, verify the backend support exists:
+ - Are the required API endpoints implemented?
+ - Is the data model sufficient for the new UI components?
+- **Cross-cutting concerns**: Check shared layers (types, DTOs, validation schemas, routes, middleware) for completeness
+- **Document gaps** — If missing layers are detected, list them as **IMPORTANT** issues in the report with concrete suggestions for what should be added
+
+### 5. Generate Report — Create a markdown report for each PR including:
+
+- **PR Summary** — What it does, files affected, commit count
+- **Improvements/Benefits** — Numbered list with impact level (HIGH/MEDIUM/LOW)
+- **Risks & Issues** — Categorized as CRITICAL / IMPORTANT / MINOR
+- **Scoring Table** — Rate across: Feature Relevance, Code Quality, Security, Robustness, Tests
+- **Verdict** — Ready to merge? With mandatory vs optional fixes
+- **Next Steps** — What will happen if approved
+
+### 6. Present to User
+
+- Show the report in the final response and stop. Mark this as a blocking checkpoint awaiting explicit user approval before continuing.
+- Wait for user decision:
+ - **Approved** → Proceed to step 7
+ - **Approved with changes** → Implement the fixes and corrections before merging
+ - **Rejected** → Close the PR or leave a review comment
+
+### 7. Pre-Merge Fixes & CI Green-Lighting (if approved)
+
+> **⚠️ Fixes and Conflict Resolutions MUST be pushed back to the PR branch before merging.** We want the PR itself to be green and fully valid before it integrates.
+
+- **Sync latest fixes & Resolve Conflicts:** Merge the current `release` branch into the PR branch. If there are merge conflicts, you MUST resolve them inside the author's PR branch. NEVER resolve conflicts by closing their PR and doing the work in a separate branch, as this steals credit from the original author.
+- **Implement improvements:** Apply the required fixes identified in the analysis directly on the PR branch (e.g., adding missing API routes, fixing SSRF, applying comments from other agents).
+- **Pushing changes to PR branches:**
+
+ ```bash
+ # Checkout the PR locally
+ gh pr checkout
+
+ # Apply fixes, commit your changes
+ git commit -m "chore: apply review suggestions and missing layers"
+
+ # Attempt to push directly to the PR branch
+ git push
+ ```
+
+- **Fallback (ONLY for external forks without maintainer edit access):**
+ Using `cherry-pick` instead of fixing the contributor's PR directly is a **LAST RESORT**. You MUST ALWAYS attempt to `git push` your fixes to their branch first.
+ **ONLY if `git push` explicitly fails with a permission/access error** (meaning the contributor unchecked "Allow edits from maintainers" or it's a locked fork), you may use `git cherry-pick` to bring their changes into the release branch and fix the issues locally.
+ Even then, ensure you preserve the contributor's authorship (`git commit --author="Contributor Name "` if creating new commits).
+ Once you have integrated their work into the release branch, **DO NOT close their PR**. Leave it open so the contributor retains credit. Under NO CIRCUMSTANCES should you use `gh pr close`.
+
+- Run the project's test suite locally to verify nothing breaks:
+ // turbo
+- Run: `npm test` or equivalent test command
+
+### 8. Merge into Release Branch (NEVER CLOSE!)
+
+> **⚠️ CRITICAL**: NEVER use `gh pr close` for a PR whose idea or code was accepted. Closing a PR in a contributor's face after taking their idea—or closing it just because it had conflicts—is unacceptable.
+> You MUST ALWAYS resolve conflicts and apply fixes ON THE AUTHOR'S PR BRANCH (unless explicitly locked from edits), and then merge the PR using GitHub so the contributor gets the official "Merged" badge and proper credit on their profile. **Do not use cherry-pick just because it is "easier" than resolving conflicts on their branch.**
+
+Even if the PR had severe conflicts or required significant architectural adjustments, you MUST:
+
+1. Resolve any conflicts and apply the fixes directly to their PR branch (as detailed in step 7) or use cherry-picking into the release branch.
+2. If you managed to fix their branch, merge it into the release branch using the GitHub CLI:
+ `gh pr merge --repo / --squash --body "Integrated into release/vX.Y.Z"`
+3. If you had to use cherry-picking because you couldn't push to their branch, DO NOT close the PR. GitHub will sometimes auto-detect the cherry-picked commits and mark it as Merged. If it doesn't, leave it open. The repository owner will handle it. NEVER run `gh pr close`.
+
+In ALL cases:
+
+- Post a **thank-you comment** on the PR via the GitHub API before or immediately after merging.
+- The message should:
+ - Thank the author by name/username for their contribution.
+ - Explain what was adjusted or improved (if we pushed fixes to their branch or cherry-picked).
+ - Note it will be included in the upcoming release.
+ - Be friendly, professional, and encouraging.
+
+> **⚠️ MANDATORY CHANGELOG CREDIT**: When cherry-picking is used (because the PR branch couldn't be pushed to or `gh pr merge` failed), the contributor does NOT get the automatic GitHub "Merged" badge. In this case, you MUST compensate by adding an explicit entry to `CHANGELOG.md` in the `[Unreleased]` section with `(#PR_NUMBER — thanks @username)` format. This ensures the contributor gets public credit in the release notes even if GitHub doesn't auto-detect the cherry-pick. This is NOT optional — skipping it effectively erases the contributor's work from the release record.
+
+### 9. Sync Local Release Branch
+
+After merging PRs, sync the local release branch to include the new changes:
+
+```bash
+git fetch origin
+git pull origin release/vX.Y.Z
+```
+
+### 10. Continue or Finalize
+
+After processing all approved PRs:
+
+- If more PRs remain, go back to step 7
+- When all PRs are processed, **update CHANGELOG.md** on the release branch with all new entries
+- Run **test coverage** to verify the gate (≥75% statements/lines/functions, ≥70% branches — measured ~82%):
+ ```bash
+ npm run test:coverage
+ ```
+- Fix any test regressions introduced by merged PRs
+- Run `/generate-release` workflow Phase 1 steps 7–10 (tests → commit → push → open PR to main → wait for user)
+- The `/generate-release` workflow handles the final merge from `release/vX.Y.Z` → `main`
diff --git a/.agents/skills/version-bump/SKILL.md b/.agents/skills/version-bump/SKILL.md
new file mode 100644
index 0000000000..3d3ddf9f4a
--- /dev/null
+++ b/.agents/skills/version-bump/SKILL.md
@@ -0,0 +1,347 @@
+---
+name: version-bump-cx
+description: Bump version, auto-generate CHANGELOG from git commits, update all versioned files, and refresh root + docs/ documentation to reflect the current project state
+---
+
+# Version Bump Workflow
+
+Automatically bump the project version, generate CHANGELOG entries from git history since the last tag, update every file that references the version, and refresh project documentation to reflect the current state.
+
+## Codex Execution Notes
+
+- Treat `// turbo` / `// turbo-all` as instructions to use `multi_tool_use.parallel` for independent reads, checks, and GitHub calls.
+- Any user-approval phase is a hard stop: present the report/status in the final response and wait before committing, pushing, tagging, publishing, or deploying.
+
+> **VERSION RULE: Always use PATCH bumps (3.x.y → 3.x.y+1)**
+> NEVER use `npm version minor` or `npm version major`.
+> Always use: `npm version patch --no-git-tag-version`
+> The threshold rule: when `y` reaches 10, bump to `3.(x+1).0` — e.g. `3.4.10` → `3.5.0`.
+
+---
+
+## Phase 1: Determine Version
+
+### 1. Read current version and last tag
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+CURRENT_VERSION=$(node -p "require('./package.json').version")
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+CURRENT_BRANCH=$(git branch --show-current)
+echo "Current version: $CURRENT_VERSION"
+echo "Last tag: $LAST_TAG"
+echo "Current branch: $CURRENT_BRANCH"
+```
+
+### 2. Calculate new version
+
+Apply the patch bump rule:
+
+- If the current patch number is `9`, the new version is `3.(minor+1).0`
+- Otherwise, increment patch: `3.x.y` → `3.x.(y+1)`
+
+If the version was ALREADY bumped (e.g. you are on a release branch and package.json already has the new version), **skip the npm version bump** and use the existing version.
+
+### 3. Bump package.json (if needed)
+
+// turbo
+
+```bash
+# Only if version hasn't been bumped yet
+npm version patch --no-git-tag-version
+```
+
+Or for threshold (y=10):
+
+```bash
+# Manual threshold bump
+VERSION="3.X.0" # compute manually
+npm version "$VERSION" --no-git-tag-version
+```
+
+---
+
+## Phase 2: Generate CHANGELOG from Git History
+
+### 4. Collect commits since last tag
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
+echo "=== Commits since $LAST_TAG ==="
+git log "$LAST_TAG"..HEAD --pretty=format:"%h %s" --no-merges | head -100
+echo ""
+echo "=== Merge commits ==="
+git log "$LAST_TAG"..HEAD --merges --pretty=format:"%h %s" | head -50
+```
+
+### 5. Classify commits and generate CHANGELOG section
+
+Analyze each commit message and classify into categories based on the conventional-commit prefix and content:
+
+| Category | Patterns |
+| ------------------- | ------------------------------------------------ |
+| ✨ New Features | `feat:`, `feat(*):` |
+| 🐛 Bug Fixes | `fix:`, `fix(*):` |
+| ⚠️ Breaking Changes | `BREAKING CHANGE`, `!:` suffix |
+| 🛠️ Maintenance | `chore:`, `refactor:`, `perf:`, `build:` |
+| 🧪 Tests | `test:`, `tests:` |
+| 📝 Documentation | `docs:` |
+| 🔒 Security | `security:`, CVE references, vulnerability fixes |
+| 🌍 i18n | translation updates, locale changes |
+
+For each category with entries, create a markdown section with descriptive bullet points. Use the commit messages but rewrite them to be human-readable and descriptive (not raw commit messages).
+
+**If a commit references a PR number** (e.g. `#880`, `PR #885`), include it in the description.
+
+### 6. Update CHANGELOG.md
+
+Replace the `## [Unreleased]` section content with the generated entries, then add the new versioned section:
+
+```markdown
+## [Unreleased]
+
+---
+
+## [NEW_VERSION] — YYYY-MM-DD
+
+### ✨ New Features
+
+- **Feature name:** Description (#PR)
+
+### 🐛 Bug Fixes
+
+- **Fix name:** Description (#PR)
+
+### 🛠️ Maintenance
+
+- **Item:** Description
+
+---
+
+## [PREVIOUS_VERSION] — YYYY-MM-DD
+
+...
+```
+
+The date must be today's date in `YYYY-MM-DD` format.
+
+---
+
+## Phase 3: Sync Version Across All Files
+
+### 7. Update workspace package.json files and openapi.yaml
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+VERSION=$(node -p "require('./package.json').version")
+
+# Update docs/reference/openapi.yaml version
+sed -i "s/ version: .*/ version: $VERSION/" docs/reference/openapi.yaml
+echo "✓ docs/reference/openapi.yaml → $VERSION"
+
+# Update workspace packages (open-sse, electron)
+for dir in electron open-sse; do
+ if [ -d "$dir" ] && [ -f "$dir/package.json" ]; then
+ (cd "$dir" && npm version "$VERSION" --no-git-tag-version --allow-same-version > /dev/null)
+ echo "✓ $dir/package.json → $VERSION"
+ fi
+done
+
+echo "✓ All workspace packages synced to $VERSION"
+```
+
+### 8. Update llm.txt version references
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+VERSION=$(node -p "require('./package.json').version")
+OLD_VERSION_PATTERN='[0-9]\+\.[0-9]\+\.[0-9]\+'
+
+# Update "Current version:" line
+sed -i "s/\*\*Current version:\*\* $OLD_VERSION_PATTERN/**Current version:** $VERSION/" llm.txt
+
+# Update "Key Features (vX.Y.Z)" header
+sed -i "s/## Key Features (v$OLD_VERSION_PATTERN)/## Key Features (v$VERSION)/" llm.txt
+
+echo "✓ llm.txt → $VERSION"
+```
+
+### 9. Regenerate lock file
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+npm install
+echo "✓ Lock file regenerated"
+```
+
+---
+
+## Phase 4: Update Root Documentation
+
+Based on the CHANGELOG entries generated in Phase 2, review and update these root-level files if relevant changes warrant updates:
+
+### 10. Review and update root documentation files
+
+For each file below, read the current content and determine if the CHANGELOG entries require any updates. Only modify files where substantive changes have occurred:
+
+| File | When to update |
+| ----------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| `README.md` | New providers, major features, stats changes (test count, provider count), badges, installation instructions, feature table |
+| `AGENTS.md` | Architecture changes, new modules, new commands, new providers, new services/handlers/executors |
+| `CONTRIBUTING.md` | Dev workflow changes, new tooling, test infrastructure changes |
+| `SECURITY.md` | Security fixes, new auth mechanisms, vulnerability disclosures |
+| `llm.txt` | Provider count changes, new features, architecture changes |
+
+**Update rules:**
+
+- **README.md**: Update provider count, test count, feature highlights table, badges if any numbers changed. If a new provider was added, add it to the provider table. If a major feature was added, add it to the features section.
+- **AGENTS.md**: If new architecture components (handlers, executors, services, DB modules) were added, update the Architecture section. If new commands were added, update the Build/Test table.
+- **SECURITY.md**: Add new vulnerability fixes or security improvements to the relevant section.
+- **llm.txt**: Update provider count, feature list, version references.
+
+### 11. Review and update docs/ files (excluding i18n/)
+
+For each file in `docs/` (excluding `docs/i18n/`), review if CHANGELOG changes affect it:
+
+| File | When to update |
+| --------------------------------------------- | ------------------------------------------------------------------ |
+| `docs/reference/API_REFERENCE.md` | New API endpoints, changed request/response formats |
+| `docs/architecture/ARCHITECTURE.md` | New modules, new services, changed data flow |
+| `docs/architecture/CODEBASE_DOCUMENTATION.md` | New files, architectural changes, module reorganization |
+| `docs/architecture/REPOSITORY_MAP.md` | New folders / files / one-line descriptions |
+| `docs/reference/CLI-TOOLS.md` | New CLI tool integrations, config format changes |
+| `docs/guides/USER_GUIDE.md` | UX changes, new dashboard pages, settings changes |
+| `docs/reference/PROVIDER_REFERENCE.md` | New providers (regenerate via `scripts/gen-provider-reference.ts`) |
+| `docs/frameworks/MCP-SERVER.md` | New MCP tools, changed tool signatures, scope changes |
+| `docs/frameworks/A2A-SERVER.md` | New A2A skills, protocol changes |
+| `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md` | New external agent protocols supported |
+| `docs/frameworks/CLOUD_AGENT.md` | Cloud agent additions (codex-cloud, devin, jules) or API changes |
+| `docs/architecture/AUTHZ_GUIDE.md` | New route classifications, policy changes |
+| `docs/security/GUARDRAILS.md` | New guardrails registered, priority/order changes |
+| `docs/security/COMPLIANCE.md` | Audit log / retention / no-log policy changes |
+| `docs/frameworks/SKILLS.md` | Skill framework / registry / built-in skill changes |
+| `docs/frameworks/MEMORY.md` | Memory pipeline / extraction / injection / Qdrant changes |
+| `docs/frameworks/EVALS.md` | Evaluation framework changes, new evaluators |
+| `docs/frameworks/WEBHOOKS.md` | New webhook events, payload schema changes |
+| `docs/routing/REASONING_REPLAY.md` | Reasoning capture/replay pipeline changes |
+| `docs/routing/AUTO-COMBO.md` | Routing changes, new strategies, scoring weight changes |
+| `docs/architecture/RESILIENCE_GUIDE.md` | Circuit breaker / cooldown / lockout behavior changes |
+| `docs/security/STEALTH_GUIDE.md` | TLS / CLI fingerprint changes |
+| `docs/ops/TUNNELS_GUIDE.md` | Cloudflare tunnel feature changes |
+| `docs/guides/ELECTRON_GUIDE.md` | Electron build / signing / packaging changes |
+| `docs/guides/TROUBLESHOOTING.md` | New known issues, resolved problems |
+| `docs/ops/RELEASE_CHECKLIST.md` | Process changes |
+| `docs/ops/COVERAGE_PLAN.md` | Coverage gate adjustments, target metrics |
+| `docs/reference/openapi.yaml` | Already updated in step 7 |
+
+**Only update files where the CHANGELOG entries directly affect the documented content.** Do NOT update files just to bump a version number — only when the documented behavior, features, or architecture has actually changed.
+
+---
+
+## Phase 5: Verify
+
+### 12. Run lint check
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+npm run lint
+```
+
+### 13. Run tests
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+npm test
+```
+
+### 14. Verify version sync across all files
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+VERSION=$(node -p "require('./package.json').version")
+echo "Expected version: $VERSION"
+echo ""
+
+echo "--- package.json ---"
+grep '"version"' package.json | head -1
+
+echo "--- open-sse/package.json ---"
+grep '"version"' open-sse/package.json | head -1
+
+echo "--- electron/package.json ---"
+[ -f electron/package.json ] && grep '"version"' electron/package.json | head -1
+
+echo "--- docs/reference/openapi.yaml ---"
+grep " version:" docs/reference/openapi.yaml | head -1
+
+echo "--- llm.txt ---"
+grep "Current version:" llm.txt
+
+echo "--- CHANGELOG.md (first versioned entry) ---"
+grep "^## \[" CHANGELOG.md | head -2
+```
+
+### 15. 🛑 STOP — Present Summary to User
+
+**STOP** and present a summary to the user including:
+
+- Old version → New version
+- CHANGELOG entries generated
+- Files modified
+- Test results
+- Any documentation updates made
+
+**Wait for the user to confirm before committing.**
+
+---
+
+## Phase 6: Commit (only after user approval)
+
+### 16. Stage and commit
+
+// turbo-all
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute
+git add -A
+VERSION=$(node -p "require('./package.json').version")
+git commit -m "chore(release): bump to v$VERSION — changelog, docs, version sync"
+```
+
+---
+
+## Notes
+
+- This workflow does **NOT** create tags, releases, or deploy. Use `/generate-release` for the full release cycle after this.
+- This workflow does **NOT** update `docs/i18n/` translations. Translation updates are handled manually or via release tooling — there is no `/update-i18n` workflow shipped in this repo.
+- The CHANGELOG generation is based on git commits since the last tag. If there are no new commits, the workflow should inform the user and stop.
+- Always verify the generated CHANGELOG entries make sense — raw commit messages may need rewriting for clarity.
+- If the version was already bumped (e.g. you're on a `release/vX.Y.Z` branch), skip the `npm version` step and use the existing version.
+
+## Version Touchpoints Checklist
+
+| File | Field/Pattern |
+| ----------------------------- | ----------------------------------------------------------- |
+| `package.json` | `"version": "X.Y.Z"` |
+| `open-sse/package.json` | `"version": "X.Y.Z"` |
+| `electron/package.json` | `"version": "X.Y.Z"` |
+| `docs/reference/openapi.yaml` | `version: X.Y.Z` |
+| `llm.txt` | `**Current version:** X.Y.Z` and `## Key Features (vX.Y.Z)` |
+| `CHANGELOG.md` | `## [X.Y.Z] — YYYY-MM-DD` |
diff --git a/.agents/workflows/capture-release-evidences.md b/.agents/workflows/capture-release-evidences-ag.md
similarity index 69%
rename from .agents/workflows/capture-release-evidences.md
rename to .agents/workflows/capture-release-evidences-ag.md
index 54b373fdd7..30ab18d572 100644
--- a/.agents/workflows/capture-release-evidences.md
+++ b/.agents/workflows/capture-release-evidences-ag.md
@@ -1,10 +1,12 @@
---
-description: Automatically run the browser_subagent to visually validate all new UI features from the current release and capture evidence WebP recordings of the changes.
+description: Automatically run a browser-automation agent to visually validate all new UI features from the current release and capture evidence WebP recordings of the changes.
---
# Capture Release Evidences Workflow
-Use this workflow to automatically drive the `browser_subagent` to explore the newly deployed or locally running application and record evidence of the UI changes introduced in the latest release.
+Use this workflow to automatically drive a browser-automation agent to explore the newly deployed or locally running application and record evidence of the UI changes introduced in the latest release.
+
+> **Tool mapping note (v3.8):** The `browser_subagent` tool referenced below is specific to an earlier agent runtime. In Claude Code, substitute with the available browser MCP tools (e.g. `mcp__claude-in-chrome__*`) for navigation/screenshots, plus the `Write` tool for saving artifacts. The high-level steps remain the same regardless of the browser-automation surface in use.
## Prerequisites
@@ -35,7 +37,7 @@ _(Note: The `browser_subagent` automatically creates a WebP recording named by t
### 3. Generate Report Artifact
-After the `browser_subagent` finishes its sessions, generate a final Markdown artifact (using `write_to_file` and `IsArtifact=true`) to present the recordings inline to the user using the `` syntax.
+After the `browser_subagent` finishes its sessions, generate a final Markdown artifact (using `Write` and `IsArtifact=true`) to present the recordings inline to the user using the `` syntax.
### Example Invocation
diff --git a/.agents/workflows/deploy-vps-akamai.md b/.agents/workflows/deploy-vps-akamai-ag.md
similarity index 100%
rename from .agents/workflows/deploy-vps-akamai.md
rename to .agents/workflows/deploy-vps-akamai-ag.md
diff --git a/.agents/workflows/deploy-vps-both.md b/.agents/workflows/deploy-vps-both-ag.md
similarity index 100%
rename from .agents/workflows/deploy-vps-both.md
rename to .agents/workflows/deploy-vps-both-ag.md
diff --git a/.agents/workflows/deploy-vps-local.md b/.agents/workflows/deploy-vps-local-ag.md
similarity index 100%
rename from .agents/workflows/deploy-vps-local.md
rename to .agents/workflows/deploy-vps-local-ag.md
diff --git a/.agents/workflows/generate-release.md b/.agents/workflows/generate-release-ag.md
similarity index 83%
rename from .agents/workflows/generate-release.md
rename to .agents/workflows/generate-release-ag.md
index 399e12d214..8919137688 100644
--- a/.agents/workflows/generate-release.md
+++ b/.agents/workflows/generate-release-ag.md
@@ -1,15 +1,15 @@
---
-description: Create a new release, bump version up to 1.x.10 threshold, update changelog, and manage Pull Requests
+description: Create a new release, bump version up to the .10 patch threshold, update changelog, and manage Pull Requests
---
# Generate Release Workflow
Bump version, finalize CHANGELOG, commit, open a **PR to main** and wait for user confirmation before tagging, publishing, and deploying.
-> **VERSION RULE: Always use PATCH bumps (2.x.y → 2.x.y+1)**
+> **VERSION RULE: Always use PATCH bumps (3.x.y → 3.x.y+1)**
> NEVER use `npm version minor` or `npm version major`.
> Always use: `npm version patch --no-git-tag-version`
-> The threshold rule: when `y` reaches 10, bump to `2.(x+1).0` — e.g. `2.1.10` → `2.2.0`.
+> The threshold rule: when `y` reaches 10, bump to `3.(x+1).0` — e.g. `3.8.10` → `3.9.0`.
> **🔴 SINGLE BRANCH RULE**: The `release/vX.Y.Z` branch is the **ONLY** development branch for the entire release cycle. ALL work — bug fixes, feature implementations, PR integrations, issue resolutions — MUST be committed directly on this branch. Never create separate `fix/`, `feat/`, or topic branches. When running `/resolve-issues`, `/implement-features`, or `/review-prs`, always work on the current release branch.
@@ -49,7 +49,7 @@ Before creating the release, you must ensure the codebase and supply chain are s
### 1. Create release branch
```bash
-git checkout -b release/v2.x.y
+git checkout -b release/v3.x.y
```
### 2. Determine and sync version
@@ -72,19 +72,19 @@ grep '"version"' package.json
>
> 1. `npm version patch --no-git-tag-version` ← bump first
> 2. implement features / fix bugs
-> 3. `git add -A && git commit -m "chore(release): v2.x.y — all changes in ONE commit"`
+> 3. `git add -A && git commit -m "chore(release): v3.x.y — all changes in ONE commit"`
>
> **OR if features are already staged:**
>
> 1. implement features (do NOT commit yet)
> 2. `npm version patch --no-git-tag-version` ← bump before committing
-> 3. `git add -A && git commit -m "chore(release): v2.x.y — all changes in ONE commit"`
+> 3. `git add -A && git commit -m "chore(release): v3.x.y — all changes in ONE commit"`
>
> **NEVER do this (creates version mismatch in git history):**
>
> - ~~commit features → then bump version → commit package.json separately~~
>
-> This ensures that `git show v2.x.y` always contains both code changes and the version bump together.
+> This ensures that `git show v3.x.y` always contains both code changes and the version bump together.
> The GitHub release tag will point to a commit that includes ALL changes for that version.
### 3. Regenerate lock file (REQUIRED after version bump)
@@ -124,13 +124,13 @@ Keep an empty `## [Unreleased]` section above it, separated by a horizontal rule
### 5. Update openapi.yaml version ⚠️ MANDATORY
-> **CI will fail** if `docs/openapi.yaml` version ≠ `package.json` version (`check:docs-sync` enforces this).
+> **CI will fail** if `docs/reference/openapi.yaml` version ≠ `package.json` version (`check:docs-sync` enforces this).
// turbo
```bash
VERSION=$(node -p "require('./package.json').version")
-sed -i "s/ version: .*/ version: $VERSION/" docs/openapi.yaml
+sed -i "s/ version: .*/ version: $VERSION/" docs/reference/openapi.yaml
echo "✓ openapi.yaml → $VERSION"
for dir in electron open-sse; do
@@ -145,11 +145,12 @@ npm install
### 6. Update README.md and i18n docs
-Run `/update-docs` workflow steps to:
+Manually perform these documentation updates (there is no `/update-docs` workflow — it was deprecated in v3.8):
-- Update feature table rows in `README.md`
-- Sync changes to all 29 language `docs/i18n/*/README.md` files
-- Update `docs/FEATURES.md` if Settings section changed
+- Update feature table rows and "What's new in vX.Y.Z" section in `README.md`
+- Sync feature changes to all 40 language `docs/i18n/*/README.md` files (use the same row edits across each translated README)
+- Update the relevant `docs/.md` if architecture or counts changed
+- Re-run `npm run check:docs-sync` and `npm run check:docs-all` to catch drift
### 7. Run tests
@@ -167,8 +168,8 @@ All tests must pass before creating the PR.
```bash
git add -A
-git commit -m "chore(release): v2.x.y — summary of changes"
-git push origin release/v2.x.y
+git commit -m "chore(release): v3.x.y — summary of changes"
+git push origin release/v3.x.y
```
### 9. Open PR to main
@@ -200,7 +201,7 @@ gh pr create \
### 10. 🛑 STOP — Notify User & Await PR Confirmation
-**This is a mandatory stop point.** Use `notify_user` with `BlockedOnUser: true`:
+**This is a mandatory stop point.** Present the report in the final response and stop. Do not continue to the next phase until the user explicitly approves.
Inform the user:
@@ -333,7 +334,7 @@ If a workflow fails:
- Use `gh run view --log-failed` to identify the error.
- Apply the fix on the `main` branch.
-- If necessary, re-trigger the workflow using `gh workflow run --repo diegosouzapw/OmniRoute --ref v2.x.y`
+- If necessary, re-trigger the workflow using `gh workflow run --repo diegosouzapw/OmniRoute --ref v3.x.y`
### 20. Preserve release branch
@@ -345,7 +346,7 @@ If a workflow fails:
## Notes
-- Always run `/update-docs` BEFORE this workflow (ensures CHANGELOG and README are current)
+- Ensure CHANGELOG, README and `docs/*` are current BEFORE this workflow — run `npm run check:docs-all` and `/version-bump` first (there is no `/update-docs` workflow anymore)
- The `prepublishOnly` script runs `npm run build:cli` automatically during `npm publish`
- After npm publish, verify with `npm info omniroute version`
- Lock file sync errors are caused by skipping `npm install` after version bump
@@ -353,9 +354,9 @@ If a workflow fails:
## Known CI Pitfalls
-| CI failure | Cause | Fix |
-| ------------------------------------------------------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------- |
-| `[docs-sync] FAIL - OpenAPI version differs from package.json` | Skipped step 5 — `docs/openapi.yaml` version not updated | Run step 5 (`sed -i ...`) and commit |
-| `[docs-sync] FAIL - CHANGELOG.md first section must be "## [Unreleased]"` | `## [Unreleased]` missing or not at top of CHANGELOG | Add `## [Unreleased]\n\n---\n` before the first versioned `## [x.y.z]` |
-| Electron Linux `.deb` build fails (`FpmTarget` error) | `fpm` Ruby gem not installed on `ubuntu-latest` runner | Already fixed in `electron-release.yml` (`gem install fpm` step) |
-| Docker Hub `502 error writing layer blob` | Transient Docker Hub network error during ARM64 push | Re-run the Docker publish workflow; no code change needed |
+| CI failure | Cause | Fix |
+| ------------------------------------------------------------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
+| `[docs-sync] FAIL - OpenAPI version differs from package.json` | Skipped step 5 — `docs/reference/openapi.yaml` version not updated | Run step 5 (`sed -i ...`) and commit |
+| `[docs-sync] FAIL - CHANGELOG.md first section must be "## [Unreleased]"` | `## [Unreleased]` missing or not at top of CHANGELOG | Add `## [Unreleased]\n\n---\n` before the first versioned `## [x.y.z]` |
+| Electron Linux `.deb` build fails (`FpmTarget` error) | `fpm` Ruby gem not installed on `ubuntu-latest` runner | Already fixed in `electron-release.yml` (`gem install fpm` step) |
+| Docker Hub `502 error writing layer blob` | Transient Docker Hub network error during ARM64 push | Re-run the Docker publish workflow; no code change needed |
diff --git a/.agents/workflows/implement-features.md b/.agents/workflows/implement-features-ag.md
similarity index 98%
rename from .agents/workflows/implement-features.md
rename to .agents/workflows/implement-features-ag.md
index 6a0938a868..afb8b3ed93 100644
--- a/.agents/workflows/implement-features.md
+++ b/.agents/workflows/implement-features-ag.md
@@ -201,22 +201,22 @@ For each viable feature, perform systematic research:
**Step 1 — Web search for similar implementations:**
```
-search_web("how to implement in ")
-search_web(" implementation nextjs typescript 2025 2026")
-search_web(" open source library npm")
+WebSearch("how to implement in ")
+WebSearch(" implementation nextjs typescript 2025 2026")
+WebSearch(" open source library npm")
```
**Step 2 — Find reference Git repositories:**
```
-search_web("site:github.com stars:>100")
-search_web("github implementation recently updated 2026")
+WebSearch("site:github.com stars:>100")
+WebSearch("github implementation recently updated 2026")
```
- Find **up to 10 relevant repositories**, sorted by most recently updated.
- For each repository:
- Note the repo URL, star count, last commit date
- - Read its README and relevant source files via `read_url_content`
+ - Read its README and relevant source files via `WebFetch`
- Extract the architectural approach, patterns used, and key code snippets
**Step 3 — Read API docs and standards:**
diff --git a/.agents/workflows/issue-triage.md b/.agents/workflows/issue-triage-ag.md
similarity index 100%
rename from .agents/workflows/issue-triage.md
rename to .agents/workflows/issue-triage-ag.md
diff --git a/.agents/workflows/resolve-issues.md b/.agents/workflows/resolve-issues-ag.md
similarity index 100%
rename from .agents/workflows/resolve-issues.md
rename to .agents/workflows/resolve-issues-ag.md
diff --git a/.agents/workflows/review-discussions.md b/.agents/workflows/review-discussions-ag.md
similarity index 92%
rename from .agents/workflows/review-discussions.md
rename to .agents/workflows/review-discussions-ag.md
index e9f6a0cd1b..bd1192e29e 100644
--- a/.agents/workflows/review-discussions.md
+++ b/.agents/workflows/review-discussions-ag.md
@@ -8,6 +8,8 @@ description: Read all open GitHub Discussions, summarize them, respond to pendin
This workflow reads all open GitHub Discussions, generates a categorized summary, identifies which ones need a response, drafts and posts replies, and optionally creates issues from actionable feature requests. It follows the same flow used for Issues but adapted for the Discussions forum.
+> **Tool mapping note (v3.8):** Where steps below say `browser_subagent`, in modern Claude Code substitute with the `gh` CLI via Bash — `gh api graphql` for reading discussions and mutations for posting comments. `WebFetch` is acceptable for read-only HTML scraping when GraphQL is overkill, but prefer `gh` for any write actions.
+
// turbo-all
## Steps
@@ -19,7 +21,7 @@ This workflow reads all open GitHub Discussions, generates a categorized summary
### 2. Fetch All Open Discussions
-- Use `read_url_content` to fetch `https://github.com///discussions`
+- Use `WebFetch` to fetch `https://github.com///discussions`
- Parse the discussion list to get all discussion titles, IDs, authors, categories, and dates
- For each discussion, fetch the individual page to read the full content and all comments/replies
diff --git a/.agents/workflows/review-prs-ag.md b/.agents/workflows/review-prs-ag.md
new file mode 100644
index 0000000000..22d9404b8b
--- /dev/null
+++ b/.agents/workflows/review-prs-ag.md
@@ -0,0 +1,256 @@
+---
+description: Analyze open Pull Requests from the project's GitHub repository, generate a critical report, and optionally implement approved changes
+---
+
+# /review-prs — PR Review & Analysis Workflow
+
+## ⛔ ABSOLUTE PROHIBITION — Read Before Anything Else
+
+> **NEVER close a contributor's PR if you intend to use ANY of their code, ideas, or fixes.**
+>
+> **NEVER manually integrate contributor code into a release branch and then close their PR.**
+>
+> These actions are **STRICTLY FORBIDDEN** under all circumstances:
+>
+> 1. ❌ Closing a PR and cherry-picking/copying its code into a release branch
+> 2. ❌ Closing a PR "because of conflicts" and re-implementing the same fix yourself
+> 3. ❌ Closing a PR and committing a "similar" solution inspired by it
+> 4. ❌ Using `gh pr close` on any PR whose content was or will be used
+>
+> **Why**: Closing a PR after taking the contributor's work means they get ZERO credit on GitHub — no "Merged" badge, no contribution graph entry, no public record. This is effectively stealing their contribution. An audit found this happened to **37 PRs** in the past.
+>
+> **The ONLY acceptable flow**: Resolve conflicts IN the contributor's branch, push fixes TO their branch, then merge THEIR PR via `gh pr merge`. See Step 7 and Step 8 for the exact procedure.
+>
+> **When to close a PR**: ONLY when the user (repository owner) explicitly requests it, OR when the PR is clearly spam/malicious, OR when the author themselves asks to close it. In ALL other cases, leave it open.
+
+## Overview
+
+This workflow fetches all open PRs from the project's GitHub repository, performs a critical analysis of each one, generates a detailed report, and waits for user approval before proceeding with implementation. **All improvements are committed on the current release branch** (`release/vX.Y.Z`).
+
+> **BRANCH RULE**: PRs are ALWAYS merged into the current `release/vX.Y.Z` branch, NEVER directly into `main`. The release branch acts as a staging area — only after all PRs are integrated and tests pass does the release branch get merged into `main` via the `/generate-release` workflow.
+
+## Steps
+
+### 1. Identify the GitHub Repository
+
+- Read `package.json` to get the repository URL, or use the git remote origin URL
+ // turbo
+- Run: `git -C remote get-url origin` to extract the owner/repo
+
+### 2. Ensure Release Branch Exists
+
+// turbo
+
+Before doing any work, ensure you are on the current release branch:
+
+```bash
+# Check current branch
+git branch --show-current
+
+# If on main, determine next version and create the release branch
+VERSION=$(node -p "require('./package.json').version")
+# Bump patch: e.g. 3.3.11 → 3.3.12
+NEXT=$(node -p "const [a,b,c]=('$VERSION').split('.').map(Number); c>=9?a+'.'+(b+1)+'.0':a+'.'+b+'.'+(c+1)")
+git checkout -b release/v$NEXT
+npm version patch --no-git-tag-version
+npm install
+```
+
+If already on a `release/vX.Y.Z` branch, continue working there.
+
+### 3. Fetch Open Pull Requests
+
+// turbo-all
+
+**⚠️ CRITICAL**: The JSON output of `gh pr list` can be truncated by the tool, silently hiding PRs. You MUST use the two-step approach below to guarantee **all** PRs are fetched.
+
+**Step 3a — Get PR numbers only** (small output, never truncated):
+
+- Run: `gh pr list --repo / --state open --limit 500 --json number --jq '.[].number'`
+- This outputs one PR number per line. Count them and confirm total.
+
+**Step 3b — Fetch full metadata for each PR** (one call per PR):
+
+- For each PR number from step 3a, run:
+ `gh pr view --repo / --json number,title,author,headRefName,baseRefName,body,createdAt,additions,deletions,files`
+- You may batch these into parallel calls (up to 4 at a time).
+
+**Step 3c — Fetch diffs for each PR** (one call per PR, saved to /tmp):
+
+- For each PR number, run:
+ `gh pr diff --repo / > /tmp/pr.diff`
+- Then read each diff file with the appropriate file-read tool (`Read` in Claude Code; equivalent in your agent runtime).
+
+- For each open PR, collect:
+ - PR number, title, author, branch, number of commits, date
+ - PR description/body
+ - Files changed (diff)
+ - Existing review comments (from bots or humans)
+
+**Verification**: Confirm the count of PRs analyzed matches the count from step 3a before proceeding.
+
+### 3.5 Redirect PR Base Branches to Release Branch
+
+// turbo-all
+
+**⚠️ CRITICAL**: Contributors typically open PRs targeting `main`. Before analyzing or merging, redirect ALL open PRs to target the current release branch instead.
+
+```bash
+# Get the current release branch name
+RELEASE_BRANCH=$(git branch --show-current) # e.g. release/v3.5.4
+
+# For each open PR that targets main, change its base to the release branch
+for PR_NUM in $(gh pr list --repo / --state open --json number,baseRefName --jq '.[] | select(.baseRefName == "main") | .number'); do
+ echo "Redirecting PR #$PR_NUM → $RELEASE_BRANCH"
+ gh pr edit "$PR_NUM" --repo / --base "$RELEASE_BRANCH"
+done
+```
+
+This ensures:
+
+1. PRs merge into the release branch, not directly into `main`
+2. Merge conflict detection is accurate against the release branch
+3. The release branch accumulates all changes before the final merge to `main`
+4. If the release branch doesn't exist on remote yet, push it first: `git push origin $RELEASE_BRANCH`
+
+### 4. Analyze Each PR — For each open PR, perform the following analysis:
+
+#### 4a. Feature Assessment
+
+- **Does it make sense?** Evaluate if the feature fills a real gap or solves a valid problem
+- **Alignment** — Check if it aligns with the project's architecture and roadmap
+- **Complexity** — Assess if the scope is reasonable or if it should be split
+
+#### 4b. Code Quality Review
+
+- Check for code duplication
+- Evaluate error handling patterns (consistent with existing codebase?)
+- Check naming conventions and code style
+- Verify TypeScript types (any `any` usage, missing types?)
+
+#### 4c. Security Review
+
+- Check for missing authentication/authorization on new endpoints
+- Check for injection vulnerabilities (URL params, SQL, XSS)
+- Verify input validation on all user-controlled data
+- Check for hardcoded secrets or credentials
+
+#### 4d. Architecture Review
+
+- Does the change follow existing patterns?
+- Are there any breaking changes to public APIs?
+- Is the database schema affected? Migration needed?
+- Impact on performance (N+1 queries, missing indexes?)
+
+#### 4e. Test Coverage
+
+- Does the PR include tests?
+- Are edge cases covered?
+- Would existing tests break?
+
+#### 4f. Cross-Layer (Global) Analysis
+
+Perform a **global impact assessment** to verify whether the PR changes are complete across all layers of the application:
+
+- **Backend → Frontend check**: If the PR adds or modifies backend-only resources (new endpoints, services, data models), evaluate whether corresponding frontend changes are missing:
+ - Does a new endpoint require a new screen/page in the dashboard?
+ - Should there be a new action button, menu item, or navigation link?
+ - Are there new data fields that should be displayed or editable in the UI?
+ - Does a new feature need a toggle, configuration panel, or status indicator?
+- **Frontend → Backend check**: If the PR adds frontend elements, verify the backend support exists:
+ - Are the required API endpoints implemented?
+ - Is the data model sufficient for the new UI components?
+- **Cross-cutting concerns**: Check shared layers (types, DTOs, validation schemas, routes, middleware) for completeness
+- **Document gaps** — If missing layers are detected, list them as **IMPORTANT** issues in the report with concrete suggestions for what should be added
+
+### 5. Generate Report — Create a markdown report for each PR including:
+
+- **PR Summary** — What it does, files affected, commit count
+- **Improvements/Benefits** — Numbered list with impact level (HIGH/MEDIUM/LOW)
+- **Risks & Issues** — Categorized as CRITICAL / IMPORTANT / MINOR
+- **Scoring Table** — Rate across: Feature Relevance, Code Quality, Security, Robustness, Tests
+- **Verdict** — Ready to merge? With mandatory vs optional fixes
+- **Next Steps** — What will happen if approved
+
+### 6. Present to User
+
+- Show the report in the final response and stop. Mark this as a blocking checkpoint awaiting explicit user approval.
+- Wait for user decision:
+ - **Approved** → Proceed to step 7
+ - **Approved with changes** → Implement the fixes and corrections before merging
+ - **Rejected** → Close the PR or leave a review comment
+
+### 7. Pre-Merge Fixes & CI Green-Lighting (if approved)
+
+> **⚠️ Fixes and Conflict Resolutions MUST be pushed back to the PR branch before merging.** We want the PR itself to be green and fully valid before it integrates.
+
+- **Sync latest fixes & Resolve Conflicts:** Merge the current `release` branch into the PR branch. If there are merge conflicts, you MUST resolve them inside the author's PR branch. NEVER resolve conflicts by closing their PR and doing the work in a separate branch, as this steals credit from the original author.
+- **Implement improvements:** Apply the required fixes identified in the analysis directly on the PR branch (e.g., adding missing API routes, fixing SSRF, applying comments from other agents).
+- **Pushing changes to PR branches:**
+
+ ```bash
+ # Checkout the PR locally
+ gh pr checkout
+
+ # Apply fixes, commit your changes
+ git commit -m "chore: apply review suggestions and missing layers"
+
+ # Attempt to push directly to the PR branch
+ git push
+ ```
+
+- **Fallback (ONLY for external forks without maintainer edit access):**
+ Using `cherry-pick` instead of fixing the contributor's PR directly is a **LAST RESORT**. You MUST ALWAYS attempt to `git push` your fixes to their branch first.
+ **ONLY if `git push` explicitly fails with a permission/access error** (meaning the contributor unchecked "Allow edits from maintainers" or it's a locked fork), you may use `git cherry-pick` to bring their changes into the release branch and fix the issues locally.
+ Even then, ensure you preserve the contributor's authorship (`git commit --author="Contributor Name "` if creating new commits).
+ Once you have integrated their work into the release branch, **DO NOT close their PR**. Leave it open so the contributor retains credit. Under NO CIRCUMSTANCES should you use `gh pr close`.
+
+- Run the project's test suite locally to verify nothing breaks:
+ // turbo
+- Run: `npm test` or equivalent test command
+
+### 8. Merge into Release Branch (NEVER CLOSE!)
+
+> **⚠️ CRITICAL**: NEVER use `gh pr close` for a PR whose idea or code was accepted. Closing a PR in a contributor's face after taking their idea—or closing it just because it had conflicts—is unacceptable.
+> You MUST ALWAYS resolve conflicts and apply fixes ON THE AUTHOR'S PR BRANCH (unless explicitly locked from edits), and then merge the PR using GitHub so the contributor gets the official "Merged" badge and proper credit on their profile. **Do not use cherry-pick just because it is "easier" than resolving conflicts on their branch.**
+
+Even if the PR had severe conflicts or required significant architectural adjustments, you MUST:
+
+1. Resolve any conflicts and apply the fixes directly to their PR branch (as detailed in step 7) or use cherry-picking into the release branch.
+2. If you managed to fix their branch, merge it into the release branch using the GitHub CLI:
+ `gh pr merge --repo / --squash --body "Integrated into release/vX.Y.Z"`
+3. If you had to use cherry-picking because you couldn't push to their branch, DO NOT close the PR. GitHub will sometimes auto-detect the cherry-picked commits and mark it as Merged. If it doesn't, leave it open. The repository owner will handle it. NEVER run `gh pr close`.
+
+In ALL cases:
+
+- Post a **thank-you comment** on the PR via the GitHub API before or immediately after merging.
+- The message should:
+ - Thank the author by name/username for their contribution.
+ - Explain what was adjusted or improved (if we pushed fixes to their branch or cherry-picked).
+ - Note it will be included in the upcoming release.
+ - Be friendly, professional, and encouraging.
+
+> **⚠️ MANDATORY CHANGELOG CREDIT**: When cherry-picking is used (because the PR branch couldn't be pushed to or `gh pr merge` failed), the contributor does NOT get the automatic GitHub "Merged" badge. In this case, you MUST compensate by adding an explicit entry to `CHANGELOG.md` in the `[Unreleased]` section with `(#PR_NUMBER — thanks @username)` format. This ensures the contributor gets public credit in the release notes even if GitHub doesn't auto-detect the cherry-pick. This is NOT optional — skipping it effectively erases the contributor's work from the release record.
+
+### 9. Sync Local Release Branch
+
+After merging PRs, sync the local release branch to include the new changes:
+
+```bash
+git fetch origin
+git pull origin release/vX.Y.Z
+```
+
+### 10. Continue or Finalize
+
+After processing all approved PRs:
+
+- If more PRs remain, go back to step 7
+- When all PRs are processed, **update CHANGELOG.md** on the release branch with all new entries
+- Run **test coverage** to verify the gate (≥75% statements/lines/functions, ≥70% branches — measured ~82%):
+ ```bash
+ npm run test:coverage
+ ```
+- Fix any test regressions introduced by merged PRs
+- Run `/generate-release` workflow Phase 1 steps 7–10 (tests → commit → push → open PR to main → wait for user)
+- The `/generate-release` workflow handles the final merge from `release/vX.Y.Z` → `main`
diff --git a/.agents/workflows/version-bump.md b/.agents/workflows/version-bump-ag.md
similarity index 66%
rename from .agents/workflows/version-bump.md
rename to .agents/workflows/version-bump-ag.md
index 0667e0eb1d..8c356e52b5 100644
--- a/.agents/workflows/version-bump.md
+++ b/.agents/workflows/version-bump-ag.md
@@ -136,9 +136,9 @@ The date must be today's date in `YYYY-MM-DD` format.
cd /home/diegosouzapw/dev/proxys/OmniRoute
VERSION=$(node -p "require('./package.json').version")
-# Update docs/openapi.yaml version
-sed -i "s/ version: .*/ version: $VERSION/" docs/openapi.yaml
-echo "✓ docs/openapi.yaml → $VERSION"
+# Update docs/reference/openapi.yaml version
+sed -i "s/ version: .*/ version: $VERSION/" docs/reference/openapi.yaml
+echo "✓ docs/reference/openapi.yaml → $VERSION"
# Update workspace packages (open-sse, electron)
for dir in electron open-sse; do
@@ -208,22 +208,36 @@ For each file below, read the current content and determine if the CHANGELOG ent
For each file in `docs/` (excluding `docs/i18n/`), review if CHANGELOG changes affect it:
-| File | When to update |
-| -------------------------------- | --------------------------------------------------- |
-| `docs/API_REFERENCE.md` | New API endpoints, changed request/response formats |
-| `docs/ARCHITECTURE.md` | New modules, new services, changed data flow |
-| `docs/CLI-TOOLS.md` | New CLI tool integrations, config format changes |
-| `docs/FEATURES.md` | New features, removed features, changed settings |
-| `docs/MCP-SERVER.md` | New MCP tools, changed tool signatures |
-| `docs/A2A-SERVER.md` | New A2A skills, protocol changes |
-| `docs/USER_GUIDE.md` | UX changes, new dashboard pages, settings changes |
-| `docs/VM_DEPLOYMENT_GUIDE.md` | Deployment changes, new env vars |
-| `docs/TROUBLESHOOTING.md` | New known issues, resolved problems |
-| `docs/AUTO-COMBO.md` | Routing changes, new strategies |
-| `docs/CODEBASE_DOCUMENTATION.md` | New files, architectural changes |
-| `docs/RELEASE_CHECKLIST.md` | Process changes |
-| `docs/COVERAGE_PLAN.md` | Test changes |
-| `docs/openapi.yaml` | Already updated in step 7 |
+| File | When to update |
+| --------------------------------------------- | ------------------------------------------------------------------ |
+| `docs/reference/API_REFERENCE.md` | New API endpoints, changed request/response formats |
+| `docs/architecture/ARCHITECTURE.md` | New modules, new services, changed data flow |
+| `docs/architecture/CODEBASE_DOCUMENTATION.md` | New files, architectural changes, module reorganization |
+| `docs/architecture/REPOSITORY_MAP.md` | New folders / files / one-line descriptions |
+| `docs/reference/CLI-TOOLS.md` | New CLI tool integrations, config format changes |
+| `docs/guides/USER_GUIDE.md` | UX changes, new dashboard pages, settings changes |
+| `docs/reference/PROVIDER_REFERENCE.md` | New providers (regenerate via `scripts/gen-provider-reference.ts`) |
+| `docs/frameworks/MCP-SERVER.md` | New MCP tools, changed tool signatures, scope changes |
+| `docs/frameworks/A2A-SERVER.md` | New A2A skills, protocol changes |
+| `docs/frameworks/AGENT_PROTOCOLS_GUIDE.md` | New external agent protocols supported |
+| `docs/frameworks/CLOUD_AGENT.md` | Cloud agent additions (codex-cloud, devin, jules) or API changes |
+| `docs/architecture/AUTHZ_GUIDE.md` | New route classifications, policy changes |
+| `docs/security/GUARDRAILS.md` | New guardrails registered, priority/order changes |
+| `docs/security/COMPLIANCE.md` | Audit log / retention / no-log policy changes |
+| `docs/frameworks/SKILLS.md` | Skill framework / registry / built-in skill changes |
+| `docs/frameworks/MEMORY.md` | Memory pipeline / extraction / injection / Qdrant changes |
+| `docs/frameworks/EVALS.md` | Evaluation framework changes, new evaluators |
+| `docs/frameworks/WEBHOOKS.md` | New webhook events, payload schema changes |
+| `docs/routing/REASONING_REPLAY.md` | Reasoning capture/replay pipeline changes |
+| `docs/routing/AUTO-COMBO.md` | Routing changes, new strategies, scoring weight changes |
+| `docs/architecture/RESILIENCE_GUIDE.md` | Circuit breaker / cooldown / lockout behavior changes |
+| `docs/security/STEALTH_GUIDE.md` | TLS / CLI fingerprint changes |
+| `docs/ops/TUNNELS_GUIDE.md` | Cloudflare tunnel feature changes |
+| `docs/guides/ELECTRON_GUIDE.md` | Electron build / signing / packaging changes |
+| `docs/guides/TROUBLESHOOTING.md` | New known issues, resolved problems |
+| `docs/ops/RELEASE_CHECKLIST.md` | Process changes |
+| `docs/ops/COVERAGE_PLAN.md` | Coverage gate adjustments, target metrics |
+| `docs/reference/openapi.yaml` | Already updated in step 7 |
**Only update files where the CHANGELOG entries directly affect the documented content.** Do NOT update files just to bump a version number — only when the documented behavior, features, or architecture has actually changed.
@@ -268,8 +282,8 @@ grep '"version"' open-sse/package.json | head -1
echo "--- electron/package.json ---"
[ -f electron/package.json ] && grep '"version"' electron/package.json | head -1
-echo "--- docs/openapi.yaml ---"
-grep " version:" docs/openapi.yaml | head -1
+echo "--- docs/reference/openapi.yaml ---"
+grep " version:" docs/reference/openapi.yaml | head -1
echo "--- llm.txt ---"
grep "Current version:" llm.txt
@@ -310,18 +324,18 @@ git commit -m "chore(release): bump to v$VERSION — changelog, docs, version sy
## Notes
- This workflow does **NOT** create tags, releases, or deploy. Use `/generate-release` for the full release cycle after this.
-- This workflow does **NOT** update `docs/i18n/` translations. Use `/update-i18n` separately after committing.
+- This workflow does **NOT** update `docs/i18n/` translations. Translation updates are handled manually or via release tooling — there is no `/update-i18n` workflow shipped in this repo.
- The CHANGELOG generation is based on git commits since the last tag. If there are no new commits, the workflow should inform the user and stop.
- Always verify the generated CHANGELOG entries make sense — raw commit messages may need rewriting for clarity.
- If the version was already bumped (e.g. you're on a `release/vX.Y.Z` branch), skip the `npm version` step and use the existing version.
## Version Touchpoints Checklist
-| File | Field/Pattern |
-| ----------------------- | ----------------------------------------------------------- |
-| `package.json` | `"version": "X.Y.Z"` |
-| `open-sse/package.json` | `"version": "X.Y.Z"` |
-| `electron/package.json` | `"version": "X.Y.Z"` |
-| `docs/openapi.yaml` | `version: X.Y.Z` |
-| `llm.txt` | `**Current version:** X.Y.Z` and `## Key Features (vX.Y.Z)` |
-| `CHANGELOG.md` | `## [X.Y.Z] — YYYY-MM-DD` |
+| File | Field/Pattern |
+| ----------------------------- | ----------------------------------------------------------- |
+| `package.json` | `"version": "X.Y.Z"` |
+| `open-sse/package.json` | `"version": "X.Y.Z"` |
+| `electron/package.json` | `"version": "X.Y.Z"` |
+| `docs/reference/openapi.yaml` | `version: X.Y.Z` |
+| `llm.txt` | `**Current version:** X.Y.Z` and `## Key Features (vX.Y.Z)` |
+| `CHANGELOG.md` | `## [X.Y.Z] — YYYY-MM-DD` |
diff --git a/.claude/commands/capture-release-evidences-cc.md b/.claude/commands/capture-release-evidences-cc.md
new file mode 100644
index 0000000000..b2eb264b6f
--- /dev/null
+++ b/.claude/commands/capture-release-evidences-cc.md
@@ -0,0 +1,51 @@
+---
+description: Automatically run a browser-automation agent to visually validate all new UI features from the current release and capture evidence WebP recordings of the changes.
+---
+
+# Capture Release Evidences Workflow
+
+Use this workflow to automatically drive a browser-automation agent to explore the newly deployed or locally running application and record evidence of the UI changes introduced in the latest release.
+
+> **Tool mapping note (v3.8):** This workflow references a `browser_subagent` tool that was specific to an earlier agent runtime. In Claude Code, substitute with the available browser MCP tools (e.g. `mcp__claude-in-chrome__*`) for navigation/screenshots, plus the `Write` tool for saving artifacts. The high-level steps below remain the same regardless of which browser-automation surface is used.
+
+## Prerequisites
+
+- OmniRoute must be actively running and accessible (e.g. locally at `http://localhost:20128` or on the Local VPS at `http://192.168.0.15:20128`).
+- The user must provide the target URL to be tested, or default to `http://192.168.0.15:20128`.
+
+## Workflow Steps
+
+### 1. Identify Target Features
+
+Review the `CHANGELOG.md` for the latest version to map out the new UI elements. For example:
+
+- **CLI Tools Settings**
+- **New Provider/Model Listings (e.g., Gemini 3.1, Qoder PAT)**
+- **New Feature Modals**
+
+### 2. Run the Browser Subagent
+
+For each identified feature, invoke the `browser_subagent` using the `default_api:browser_subagent` tool.
+**Important Task Guidelines for the Subagent:**
+
+- `TaskName`: Give it a clear name like "Validate CLIProxyAPI Tool Tab".
+- `TaskSummary`: "Navigate to the CLI Tools tab and verify the new Integration settings."
+- `Task`: Provide unambiguous instructions for the subagent, such as: "Navigate to http://192.168.0.15:20128/dashboard. Click on the 'Settings' or 'CLI Tools' nav link. Scroll down to find the CLIProxyAPI integration card. Hover over it to trigger UI state. Verify the components render correctly and exit."
+- `RecordingName`: Ensure it describes the feature (e.g. `v3_4_5_cli_proxy_api`). This is required and strictly automatically saved as a WebP artifacts video by the system.
+
+_(Note: The `browser_subagent` automatically creates a WebP recording named by the `RecordingName` parameter. No additional tools for screenshots are needed.)_
+
+### 3. Generate Report Artifact
+
+After the `browser_subagent` finishes its sessions, generate a final Markdown artifact (using `Write` and `IsArtifact=true`) to present the recordings inline to the user using the `` syntax.
+
+### Example Invocation
+
+\```json
+{
+"TaskName": "Validating Qoder PAT Configuration UI",
+"TaskSummary": "Validates the Qoder provider configuration modal",
+"Task": "Go to http://192.168.0.15:20128/dashboard. Click on the 'Providers' tab. Find 'Qoder' in the list. Click 'Add Token' or 'Configure'. Type 'test_token' and submit. Return when done.",
+"RecordingName": "qoder_pat_ui_validation"
+}
+\```
diff --git a/.claude/commands/deploy-vps-akamai-cc.md b/.claude/commands/deploy-vps-akamai-cc.md
new file mode 100644
index 0000000000..b25ae3cd99
--- /dev/null
+++ b/.claude/commands/deploy-vps-akamai-cc.md
@@ -0,0 +1,39 @@
+---
+description: Deploy the latest OmniRoute code to the Akamai VPS (69.164.221.35)
+---
+
+# Deploy to Akamai VPS Workflow
+
+Deploy OmniRoute to the Akamai VPS using `npm pack + scp` + PM2.
+
+**Akamai VPS:** `69.164.221.35`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+```
+
+### 2. Copy to Akamai VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@69.164.221.35:/tmp/
+```
+
+```bash
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'AKAMAI HTTP %{http_code}\n' http://69.164.221.35:20128/
+```
diff --git a/.claude/commands/deploy-vps-both-cc.md b/.claude/commands/deploy-vps-both-cc.md
new file mode 100644
index 0000000000..e1aa4d1def
--- /dev/null
+++ b/.claude/commands/deploy-vps-both-cc.md
@@ -0,0 +1,49 @@
+---
+description: Deploy the latest OmniRoute code to BOTH the Akamai VPS and the Local VPS
+---
+
+# Deploy to VPS (Both) Workflow
+
+Deploy OmniRoute to the production VPSs using `npm pack + scp` + PM2.
+
+**Akamai VPS:** `69.164.221.35`
+**Local VPS:** `192.168.0.15`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+**PM2 entry:** `/usr/lib/node_modules/omniroute/app/server.js`
+
+> [!IMPORTANT]
+> The npm registry rejects packages > 100MB, so deployment uses **npm pack + scp**.
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+```
+
+### 2. Copy to both VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@69.164.221.35:/tmp/ && scp omniroute-*.tgz root@192.168.0.15:/tmp/
+```
+
+```bash
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+```
+
+```bash
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'AKAMAI HTTP %{http_code}\n' http://69.164.221.35:20128/
+curl -s -o /dev/null -w 'LOCAL HTTP %{http_code}\n' http://192.168.0.15:20128/
+```
diff --git a/.claude/commands/deploy-vps-local-cc.md b/.claude/commands/deploy-vps-local-cc.md
new file mode 100644
index 0000000000..549b1f0b2a
--- /dev/null
+++ b/.claude/commands/deploy-vps-local-cc.md
@@ -0,0 +1,39 @@
+---
+description: Deploy the latest OmniRoute code to the Local VPS (192.168.0.15)
+---
+
+# Deploy to Local VPS Workflow
+
+Deploy OmniRoute to the Local VPS using `npm pack + scp` + PM2.
+
+**Local VPS:** `192.168.0.15`
+**Process manager:** PM2 (`omniroute`)
+**Port:** `20128`
+
+## Steps
+
+### 1. Build + pack locally
+
+// turbo
+
+```bash
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+```
+
+### 2. Copy to Local VPS and install
+
+// turbo-all
+
+```bash
+scp omniroute-*.tgz root@192.168.0.15:/tmp/
+```
+
+```bash
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+```
+
+### 3. Verify the deployment
+
+```bash
+curl -s -o /dev/null -w 'LOCAL HTTP %{http_code}\n' http://192.168.0.15:20128/
+```
diff --git a/.claude/commands/generate-release-cc.md b/.claude/commands/generate-release-cc.md
new file mode 100644
index 0000000000..7cb717c423
--- /dev/null
+++ b/.claude/commands/generate-release-cc.md
@@ -0,0 +1,362 @@
+---
+description: Create a new release, bump version up to the .10 patch threshold, update changelog, and manage Pull Requests
+---
+
+# Generate Release Workflow
+
+Bump version, finalize CHANGELOG, commit, open a **PR to main** and wait for user confirmation before tagging, publishing, and deploying.
+
+> **VERSION RULE: Always use PATCH bumps (3.x.y → 3.x.y+1)**
+> NEVER use `npm version minor` or `npm version major`.
+> Always use: `npm version patch --no-git-tag-version`
+> The threshold rule: when `y` reaches 10, bump to `3.(x+1).0` — e.g. `3.8.10` → `3.9.0`.
+
+> **🔴 SINGLE BRANCH RULE**: The `release/vX.Y.Z` branch is the **ONLY** development branch for the entire release cycle. ALL work — bug fixes, feature implementations, PR integrations, issue resolutions — MUST be committed directly on this branch. Never create separate `fix/`, `feat/`, or topic branches. When running `/resolve-issues`, `/implement-features`, or `/review-prs`, always work on the current release branch.
+
+---
+
+## ⚠️ Two-Phase Flow
+
+```
+Phase 1 (automated): bump → docs → i18n → commit → push → open PR
+ ↕ 🛑 STOP: Notify user, wait for PR confirmation
+Phase 2 (post-merge): tag → publish → GitHub release → Docker → deploy
+```
+
+**NEVER push directly to main or create tags before the user confirms the PR.**
+
+---
+
+## Phase 0: Security Verification (MANDATORY)
+
+Before creating the release, you must ensure the codebase and supply chain are secure and free of known vulnerabilities.
+
+1. **Run Local Dependencies Audit:**
+
+ ```bash
+ npm audit
+ ```
+
+ _Fix any `high` or `critical` vulnerabilities identified._
+
+2. **Check GitHub CodeQL & Dependabot Alerts:**
+ Navigate to the repository's **Security** tab on GitHub, or use the project's `vulnerability-scanner` skill to analyze active alerts. Ensure all static analysis findings (e.g., prototype pollution, insecure randomness, ReDoS, shell injections) are addressed and logically committed on a target branch.
+
+---
+
+## Phase 1: Pre-Merge
+
+### 1. Create release branch
+
+```bash
+git checkout -b release/v3.x.y
+```
+
+### 2. Determine and sync version
+
+Check current version in `package.json`:
+
+```bash
+grep '"version"' package.json
+```
+
+> **🔴 BRANCH-VERSION PARITY RULE**: The logical version in `package.json` MUST exactly match the release branch name. For example, if you are on `release/v3.7.0`, the version in `package.json` MUST be `3.7.0`.
+>
+> - If this is the FIRST time generating a release for a new minor/major branch (e.g., bumping from 3.6.9 to 3.7.0), you MUST ensure the version is bumped to match the new branch logic.
+> - If you are just bumping a patch on the current branch (e.g., 3.6.9 to 3.6.10), use:
+> `npm version patch --no-git-tag-version`
+
+> **⚠️ ATOMIC COMMIT RULE — Version bump MUST happen before committing feature files.**
+>
+> **CORRECT order:**
+>
+> 1. `npm version patch --no-git-tag-version` ← bump first
+> 2. implement features / fix bugs
+> 3. `git add -A && git commit -m "chore(release): v3.x.y — all changes in ONE commit"`
+>
+> **OR if features are already staged:**
+>
+> 1. implement features (do NOT commit yet)
+> 2. `npm version patch --no-git-tag-version` ← bump before committing
+> 3. `git add -A && git commit -m "chore(release): v3.x.y — all changes in ONE commit"`
+>
+> **NEVER do this (creates version mismatch in git history):**
+>
+> - ~~commit features → then bump version → commit package.json separately~~
+>
+> This ensures that `git show v3.x.y` always contains both code changes and the version bump together.
+> The GitHub release tag will point to a commit that includes ALL changes for that version.
+
+### 3. Regenerate lock file (REQUIRED after version bump)
+
+**Mandatory** — skipping causes `@swc/helpers` lock mismatch and CI failures:
+
+```bash
+npm install
+```
+
+### 4. Finalize CHANGELOG.md
+
+> **🔴 NO MIXUPS RULE**: Ensure you do NOT mix the backlog of the previous version with the new one. The new version section must ONLY contain the features and fixes for the current release.
+
+Replace the `[Unreleased]` header with the new version and date.
+Keep an empty `## [Unreleased]` section above it, separated by a horizontal rule (`---`).
+
+```markdown
+## [Unreleased]
+
+---
+
+## [3.7.0] — 2026-04-19
+
+### ✨ New Features
+
+- ...
+
+### 🐛 Bug Fixes
+
+- ...
+
+---
+
+## [3.6.9] — 2026-04-19
+```
+
+### 5. Update openapi.yaml version ⚠️ MANDATORY
+
+> **CI will fail** if `docs/reference/openapi.yaml` version ≠ `package.json` version (`check:docs-sync` enforces this).
+
+// turbo
+
+```bash
+VERSION=$(node -p "require('./package.json').version")
+sed -i "s/ version: .*/ version: $VERSION/" docs/reference/openapi.yaml
+echo "✓ openapi.yaml → $VERSION"
+
+for dir in electron open-sse; do
+ if [ -d "$dir" ] && [ -f "$dir/package.json" ]; then
+ (cd "$dir" && npm version "$VERSION" --no-git-tag-version --allow-same-version > /dev/null)
+ echo "✓ $dir/package.json → $VERSION"
+ fi
+done
+# Re-run install to assert the workspace lockfile is updated
+npm install
+```
+
+### 6. Update README.md and i18n docs
+
+Manually perform these documentation updates (there is no `/update-docs` slash command — it was deprecated in v3.8):
+
+- Update feature table rows and "What's new in vX.Y.Z" section in `README.md`
+- Sync feature changes to all 40 language `docs/i18n/*/README.md` files (use the same row edits across each translated README)
+- Update the relevant `docs/.md` if architecture or counts changed (e.g. `docs/frameworks/MCP-SERVER.md` when MCP tools change)
+- Re-run `npm run check:docs-sync` and `npm run check:docs-all` to catch drift
+
+### 7. Run tests
+
+// turbo
+
+```bash
+npm test
+```
+
+All tests must pass before creating the PR.
+
+### 8. Stage, commit, and push
+
+// turbo-all
+
+```bash
+git add -A
+git commit -m "chore(release): v3.x.y — summary of changes"
+git push origin release/v3.x.y
+```
+
+### 9. Open PR to main
+
+### 9. Open PR to main
+
+// turbo
+
+```bash
+VERSION=$(node -p "require('./package.json').version")
+
+# Extract the exact changelog entry for this version from the root CHANGELOG.md
+awk "/^## \\[$VERSION\\]/{flag=1; print; next} /^---/{if(flag) {flag=0; exit}} flag" CHANGELOG.md > /tmp/changelog_body.txt
+
+# Append test status and next steps
+echo "" >> /tmp/changelog_body.txt
+echo "### Tests" >> /tmp/changelog_body.txt
+echo "- All tests pass" >> /tmp/changelog_body.txt
+echo "" >> /tmp/changelog_body.txt
+echo "### ⚠️ After merging: run Phase 2 steps to tag, publish, and deploy." >> /tmp/changelog_body.txt
+
+gh pr create \
+ --repo diegosouzapw/OmniRoute \
+ --base main \
+ --head release/v$VERSION \
+ --title "Release v$VERSION" \
+ --body-file /tmp/changelog_body.txt
+```
+
+### 10. 🛑 STOP — Notify User & Await PR Confirmation
+
+**This is a mandatory stop point.** Present the report in the final response and stop. Do not continue to the next phase until the user explicitly approves.
+
+Inform the user:
+
+- PR URL
+- Summary of changes
+- Test results
+- List of files changed
+
+**DO NOT proceed to Phase 2 until the user confirms the PR looks good and merges it.**
+
+---
+
+## Phase 2: Post-Merge Validation (Local VPS)
+
+> Run these steps only AFTER the user has merged the PR into `main` and all CI jobs have passed.
+
+### 11. Deploy to Local VPS for Final Validation (MANDATORY)
+
+Before cutting the official git tag and publishing to the world, deploy the `main` branch to the Local VPS for a final homologation test.
+
+```bash
+git checkout main
+git pull origin main
+
+# Build and pack locally
+cd /home/diegosouzapw/dev/proxys/OmniRoute && rm -f omniroute-*.tgz && rm -rf .next/cache app/.next/cache && npm run build:cli && rm -rf app/logs app/coverage app/.git app/.app-build-backup* && npm pack --ignore-scripts
+
+# Deploy to LOCAL VPS (192.168.0.15)
+scp omniroute-*.tgz root@192.168.0.15:/tmp/
+ssh root@192.168.0.15 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Local done'"
+
+# Verify
+curl -s -o /dev/null -w "LOCAL: HTTP %{http_code}\n" http://192.168.0.15:20128/
+```
+
+### 12. 🛑 STOP — Notify User & Await Final OK
+
+**This is a mandatory stop point.**
+Inform the user that the `main` branch is now running on the Local VPS.
+Wait for the user to manually test and give the **OK**.
+**DO NOT proceed to Phase 3 until the user confirms the local deploy is stable.**
+
+---
+
+## Phase 3: Official Launch
+
+> Run these steps only AFTER the user gives the final OK from the Phase 2 local validation.
+
+### 13. Create Git Tag and GitHub Release (MANDATORY)
+
+// turbo
+
+```bash
+git checkout main
+git pull origin main
+VERSION=$(node -p "require('./package.json').version")
+
+# Extracts the changelog section for this version
+NOTES=$(awk "/^## \\[$VERSION\\]/{flag=1; next} /^---/{if(flag) {flag=0; exit}} flag" CHANGELOG.md | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+if [ -z "$NOTES" ]; then NOTES="OmniRoute v$VERSION Release"; fi
+
+git tag -a "v$VERSION" -m "Release v$VERSION"
+git push origin "v$VERSION"
+gh release create "v$VERSION" --repo diegosouzapw/OmniRoute --title "v$VERSION" --notes "$NOTES" --target main || gh release edit "v$VERSION" --repo diegosouzapw/OmniRoute --title "v$VERSION" --notes "$NOTES"
+```
+
+### 14. 🐳 Trigger Docker Hub build (MANDATORY — keep npm and Docker in sync)
+
+> **CRITICAL**: Docker Hub and npm MUST always publish the same version.
+> The Docker image is built automatically via GitHub Actions when a new tag is pushed.
+> After pushing the tag in step 13, **verify the workflow runs**:
+
+```bash
+# Verify the Docker workflow triggered
+gh run list --repo diegosouzapw/OmniRoute --workflow docker-publish.yml --limit 3
+
+# Wait for the Docker build to complete (usually 5–10 min)
+gh run watch --repo diegosouzapw/OmniRoute
+```
+
+### 15. Publish to NPM (Optional/Automated)
+
+Normally handled by CI, but if manual publish is required:
+
+```bash
+npm publish
+```
+
+### 16. Deploy to AKAMAI VPS (Production)
+
+Now that the release is officially cut, deploy it to the Akamai VPS.
+
+```bash
+# Deploy to AKAMAI VPS (69.164.221.35)
+scp omniroute-*.tgz root@69.164.221.35:/tmp/
+ssh root@69.164.221.35 "npm install -g /tmp/omniroute-*.tgz --ignore-scripts && cd /usr/lib/node_modules/omniroute/app && npm rebuild better-sqlite3 && pm2 delete omniroute 2>/dev/null; pm2 start /root/.omniroute/ecosystem.config.cjs --update-env && pm2 save && echo '✅ Akamai done'"
+
+# Verify
+curl -s -o /dev/null -w "AKAMAI: HTTP %{http_code}\n" http://69.164.221.35:20128/
+```
+
+## Phase 4: Release Monitoring & Artifact Validation
+
+> After triggering the official release, actively monitor the CI pipelines until all artifacts are successfully generated. If any pipeline fails, stop and apply the necessary corrections before continuing.
+
+### 18. Monitor CI Pipelines
+
+Wait for and verify the successful completion of the following automated jobs:
+
+1. **Docker Hub Publish**
+2. **Electron Build**
+3. **NPM Registry Publish** (Check with `npm info omniroute version`)
+
+```bash
+# Monitor Docker Hub workflow
+gh run list --repo diegosouzapw/OmniRoute --workflow docker-publish.yml --limit 1
+gh run watch
+
+# Monitor Electron build
+gh run list --repo diegosouzapw/OmniRoute --workflow electron-release.yml --limit 1
+gh run watch
+
+# Verify NPM version
+npm info omniroute version
+```
+
+### 19. Handle Failures (If Any)
+
+If a workflow fails:
+
+- Use `gh run view --log-failed` to identify the error.
+- Apply the fix on the `main` branch.
+- If necessary, re-trigger the workflow using `gh workflow run --repo diegosouzapw/OmniRoute --ref v3.x.y`
+
+### 20. Preserve release branch
+
+```bash
+# Branch is kept for historical purposes. Do not delete.
+```
+
+---
+
+## Notes
+
+- Ensure CHANGELOG, README and `docs/*` are current BEFORE this workflow — run `npm run check:docs-all` and `/version-bump` first (there is no `/update-docs` slash command anymore)
+- The `prepublishOnly` script runs `npm run build:cli` automatically during `npm publish`
+- After npm publish, verify with `npm info omniroute version`
+- Lock file sync errors are caused by skipping `npm install` after version bump
+- Use `gh auth switch -u diegosouzapw` if git push fails with wrong account
+
+## Known CI Pitfalls
+
+| CI failure | Cause | Fix |
+| ------------------------------------------------------------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------- |
+| `[docs-sync] FAIL - OpenAPI version differs from package.json` | Skipped step 5 — `docs/reference/openapi.yaml` version not updated | Run step 5 (`sed -i ...`) and commit |
+| `[docs-sync] FAIL - CHANGELOG.md first section must be "## [Unreleased]"` | `## [Unreleased]` missing or not at top of CHANGELOG | Add `## [Unreleased]\n\n---\n` before the first versioned `## [x.y.z]` |
+| Electron Linux `.deb` build fails (`FpmTarget` error) | `fpm` Ruby gem not installed on `ubuntu-latest` runner | Already fixed in `electron-release.yml` (`gem install fpm` step) |
+| Docker Hub `502 error writing layer blob` | Transient Docker Hub network error during ARM64 push | Re-run the Docker publish workflow; no code change needed |
diff --git a/.claude/commands/implement-features-cc.md b/.claude/commands/implement-features-cc.md
new file mode 100644
index 0000000000..afb8b3ed93
--- /dev/null
+++ b/.claude/commands/implement-features-cc.md
@@ -0,0 +1,706 @@
+---
+description: Analyze open feature request issues, implement viable ones on dedicated branches, and respond to authors
+---
+
+# /implement-features — Feature Request Harvest, Research & Implementation Workflow
+
+## Overview
+
+A **5-phase** workflow that systematically harvests feature requests from GitHub issues, creates structured idea files, researches solutions across the internet and Git repositories, presents a consolidated report for user approval, then generates detailed implementation plans and executes them.
+
+**Output directory structure:**
+
+```
+_ideia/
+├── viable/ # Features approved for implementation
+│ ├── need_details/ # ❓ Good idea but waiting for author clarification (issues stay OPEN)
+│ │ └── 1015-warp-terminal-mitm.md
+│ ├── 1046-native-playground.md # ✅ Ready — researched and planned
+│ └── 1046-native-playground.requirements.md
+├── defer/ # ⏭️ Good ideas deferred for future cycles (issues CLOSED)
+│ └── 1041-smart-auto-combos.md
+└── notfit/ # ❌ Out of scope / already exists (issues CLOSED)
+ └── 945-telegram-integration.md
+
+_tasks/features-vX.Y.Z/ # Implementation plans (per-release)
+└── 1046-native-playground.plan.md
+```
+
+> **LIFECYCLE RULE:** `viable/` files are **DELETED** once the feature is implemented — they are not moved. Only unimplemented features live in `viable/` (or `viable/need_details/`). Files in `defer/` and `notfit/` remain as permanent reference.
+
+> **BRANCH RULE**: All implementation work MUST happen on the current `release/vX.Y.Z` branch. Never create separate `feat/` branches. If no release branch exists yet, create one first using `/generate-release` Phase 1 steps 1–5.
+
+---
+
+## Phase 1 — Harvest: Collect & Catalog Feature Ideas
+
+### 1.1 Identify the Repository
+
+// turbo
+
+- Run: `git -C remote get-url origin` to extract owner/repo.
+
+### 1.2 Ensure Release Branch Exists
+
+// turbo
+
+Before doing any work, ensure you are on the current release branch:
+
+```bash
+# Check current branch
+git branch --show-current
+
+# If on main, determine next version and create the release branch
+VERSION=$(node -p "require('./package.json').version")
+NEXT=$(node -p "const [a,b,c]=('$VERSION').split('.').map(Number); c>=9?a+'.'+(b+1)+'.0':a+'.'+b+'.'+(c+1)")
+git checkout -b release/v$NEXT
+npm version patch --no-git-tag-version
+npm install
+```
+
+If already on a `release/vX.Y.Z` branch, continue working there.
+
+### 1.3 Fetch ALL Open Feature Requests
+
+// turbo-all
+
+**⚠️ CRITICAL**: The JSON output of `gh issue list` can be truncated by the tool, silently hiding issues. You MUST use the two-step approach below.
+
+**Step 1 — Get Issue numbers only** (small output, never truncated):
+
+```bash
+# Fetch issues with feature/enhancement labels
+gh issue list --repo / --state open -l "enhancement" --limit 500 --json number --jq '.[].number'
+
+# Also check for [Feature] in title (common pattern when no labels are set)
+gh issue list --repo / --state open --limit 500 --json number,title --jq '.[] | select(.title | test("\\[Feature\\]|\\[feature\\]|feature request"; "i")) | .number'
+```
+
+- Merge both lists, deduplicate. Count and confirm the total.
+
+**Step 2 — Fetch full metadata for each Issue** (one call per issue):
+
+```bash
+gh issue view --repo / --json number,title,labels,body,comments,createdAt,author,assignees
+```
+
+- Read the **entire body** — including description, use cases, screenshots, mockups, and any embedded images.
+- Read **ALL comments** — community discussion, agreements, restrictions, owner responses, and linked PRs.
+- **Images**: If the body or comments contain image URLs (`` or `https://...png/jpg/gif`), note them — they may contain UI mockups, wireframes, or architecture diagrams that are essential to understanding the request.
+- You may batch these into parallel calls (up to 4 at a time).
+- Sort by oldest first (FIFO).
+
+### 1.4 Create Idea Files (initially in `_ideia/` root)
+
+For each feature request, create a structured idea file in `/_ideia/`:
+
+**Filename convention**: `-.md`
+Example: `1046-native-playground.md`, `1041-smart-auto-combos.md`
+
+#### 1.4a — If the idea file does NOT exist yet, create it:
+
+```markdown
+# Feature:
+
+> GitHub Issue: # — opened by @ on
+> Status: 📋 Cataloged | Priority: TBD
+
+## 📝 Original Request
+
+
+
+## 💬 Community Discussion
+
+
+
+### Participants
+
+- @ — Original requester
+- @ —
+- ...
+
+### Key Points
+
+-
+-
+-
+
+## 🎯 Refined Feature Description
+
+
+
+### What it solves
+
+-
+-
+
+### How it should work (high level)
+
+1.
+2.
+3. ...
+
+### Affected areas
+
+-
+
+## 📎 Attachments & References
+
+-
+
+## 🔗 Related Ideas
+
+-