Release v3.8.31 (#4377)

Release v3.8.31 — see CHANGELOG.md [3.8.31] for full notes and contributors.

Merged over known non-blocking reds (all correctness gates green): Integration Tests (2/2) is env/flaky (polls a real upstream batch that did not complete in the poll window); SonarQube/SonarCloud is the advisory server-side new-code quality gate. Unit (8 shards), Coverage, Node 22/24/26, Lint, PR Test Policy, Quality Ratchet, Docs-Strict, Quality-Extended and all 4 CodeQL analyses are green.

scripts/check/check-env-doc-sync.mjs

@@ -177,6 +177,10 @@ const DOC_ONLY_ALLOWLIST = new Set([
   "IFLOW_OAUTH_CLIENT_SECRET",
   // Source-code constants accidentally captured by the doc regex.
   "CLI_COMPAT_OMITTED_PROVIDER_IDS",
+  // The stream-recovery tuning object in open-sse/config/constants.ts (`STREAM_RECOVERY.HOLDBACK_MS`
+  // etc.) — documented for reference; the real operator-facing env vars are STREAM_RECOVERY_ENABLED /
+  // STREAM_RECOVERY_MIDSTREAM_ENABLED (both in .env.example). The bare prefix is not an env var.
+  "STREAM_RECOVERY",
   // Sample default values that look like SHOUTY_NAMES (not env vars).
   "CHANGEME",
   // Legacy aliases — present in docs as "would be aliases" but read-only
@@ -188,6 +192,9 @@ const DOC_ONLY_ALLOWLIST = new Set([
   "REQUEST_RETRY",
   "SKILLS_EXECUTION_TIMEOUT_MS",
   "SKILLS_SANDBOX_DOCKER_IMAGE",
+  // Source-code constants referenced in the docs narrative for the local
+  // endpoints / route-guard classification (PR-3 in #3932).
+  "LOCAL_ONLY_API_PREFIXES",
 ]);
 
 // Vars present in .env.example but intentionally absent from ENVIRONMENT.md.

scripts/check/check-fabricated-docs.mjs

@@ -108,6 +108,8 @@ const ENV_VAR_ALLOWLIST = new Set([
   "CODEX_HOME", // Codex CLI's own config-home env var (CODEX-CLI-CONFIGURATION.md)
   "GEMINI_API_KEY", // Gemini CLI's own API-key env var, set by `omniroute setup-gemini` (REMOTE-MODE.md)
   "GOOGLE_GEMINI_BASE_URL", // Gemini CLI's own base-URL env var, set by `omniroute setup-gemini` (REMOTE-MODE.md)
+  "OPENAI_API_BASE", // legacy OpenAI base-URL env var some downstream tools (e.g. Aider) read (CLI-INTEGRATIONS.md)
+  "PROMPTFOO_PROVIDER_KEY", // promptfoo's own provider-key env var, used by the red-team suite (GUARDRAILS.md)
   "REDIS_PORT", // docker-compose host-port override (DOCKER_GUIDE.md)
   "AUTO_UPDATE_HOST_REPO_DIR", // docker-compose self-update mount (DOCKER_GUIDE.md)
   "LINUX_GPG_KEY", // electron AppImage signing key, CI/build only (ELECTRON_GUIDE.md)

scripts/check/check-route-guard-membership.ts

@@ -48,6 +48,7 @@ export const SPAWN_CAPABLE_ROUTE_ROOTS: ReadonlyArray<string> = [
   "src/app/api/services",
   "src/app/api/mcp",
   "src/app/api/cli-tools/runtime",
+  "src/app/api/local", // T-12: 1-click local service launchers (Redis today) — every child here spawns podman/docker (Hard Rules #15 + #17)
 ];
 
 // Frozen pre-existing exceptions: spawn-capable routes NOT yet classified

scripts/check/check-t11-any-budget.mjs

@@ -49,7 +49,11 @@ const budget = [
   { file: "open-sse/handlers/responseTranslator.ts", maxAny: 0 },
   { file: "open-sse/utils/stream.ts", maxAny: 0 },
   { file: "open-sse/translator/request/openai-responses.ts", maxAny: 0 },
-  { file: "open-sse/executors/base.ts", maxAny: 0 },
+  // 2 FALSE POSITIVES: #4389 compares the Anthropic `tool_choice` value against the
+  // STRING literal "any" (`tb.tool_choice === "any"` and `.type === "any"`) to detect
+  // forced tool use. The checker strips comments but not strings, and there are zero
+  // actual TypeScript `any` types in this file. Budget set to the matched count.
+  { file: "open-sse/executors/base.ts", maxAny: 2 },
   { file: "open-sse/executors/kiro.ts", maxAny: 0 },
   // 3 FALSE POSITIVES: the word "any" appears in #3104's tool-commit / output-
   // constraint prompt STRINGS ("not any other tool", "any text", "any of these