Release v3.8.39 (#5164)

* chore(release): open v3.8.39 development cycle * docs(changelog): backfill 5 v3.8.38 bullets merged after release finalize These PRs squash-merged into release/v3.8.38 between the CHANGELOG finalize (ff57be32f) and the merge-to-main (ae6e2342d), so they shipped in the v3.8.38 tag but had no bullet: - feat(compression): Ionizer engine (lossy JSON-array sampling + CCR) (#5148) - fix(sse): preserve non-stream reasoning fields (#5155, @rdself) - fix(i18n): add missing English UI labels (#5153, @rdself) - test(combo): gated live smoke (#5151) + release-expectations refresh (#5150, @KooshaPari) (#5129 exact-host Anthropic baseUrl is already covered by the #5130 bullet — same CodeQL #674.) Synced 41 i18n CHANGELOG mirrors. * feat(compression): TOON best-of-N candidate encoder + encoder A/B table (#5163) Integrated into release/v3.8.39. TOON best-of-N candidate encoder (GCF default, fail-open). 17/17 unit tests pass on merge result; CI reds were base-stale + Quality Ratchet DRIFT. * fix(zenmux): normalize vendor-prefixed GLM system roles (#5158) Integrated into release/v3.8.39. ZenMux vendor-prefixed GLM system-role normalization; 12/12 role-normalizer tests pass on merge result. CI reds base-stale. * [codex] fix xAI OAuth test and reasoning effort (#5157) Integrated into release/v3.8.39. xAI reasoning-effort normalization (max/xhigh→high) + OAuth test config; 46/46 xai-translator tests pass on merge result. CI reds base-stale. * docs(i18n): add Traditional Chinese (zh-TW) README and update zh-CN to latest (#5162) Integrated into release/v3.8.39. Traditional Chinese (zh-TW) README + zh-CN refresh; docs-only. * test(security): guard PII redaction stays opt-in (default off) + Hard Rule #20 (#5159) Integrated into release/v3.8.39. PII opt-in regression guard + Hard Rule #20; rebased to strip base-drift (+81/-1). 5/5 guard tests pass; flip-proof verified. * test(combo): deterministic context-relay universal-handoff coverage (closes phase-2 TODO) (#5168) Integrated into release/v3.8.39. Deterministic context-relay universal-handoff coverage (3 tests); 3/3 pass on merge result. * docs(i18n): full sync zh-TW and zh-CN README with canonical English v3.8.39 (#5171) Integrated into release/v3.8.39. Full zh-TW docs tree + zh-CN sync with canonical English v3.8.39; docs-only. * fix(serve): honour HOSTNAME from .env instead of hardcoding 0.0.0.0 (#5134) (#5170) Integrated into release/v3.8.39. HOSTNAME env override in serve (#5134) + regression test (4/4, TDD flip-proof verified). * fix(sse): resolve nameless deepseek-web tool blocks via parameter-schema match (#5154) (#5173) Integrated into release/v3.8.39. Schema-based nameless deepseek-web tool-block resolution (#5154); 6/6 tests pass on merge result (incl. ambiguous/no-match negatives + named-tag no-regression). * fix(sse): normalize array user content for Command Code to avoid upstream 400 (#5166) (#5174) Integrated into release/v3.8.39. Normalize array user content for Command Code (#5166, user-array/400 symptom); 4/4 tests pass on merge result. * fix(sse): defer </think> close so it never leaks before tool_calls (#5123) (#5175) Integrated into release/v3.8.39. Defer </think> close so it never leaks before tool_calls (#5123); 4/4 tests pass (incl. #4633 no-regression). CHANGELOG synced to keep all 3 v3.8.39 fixes. * fix(dashboard): use amber for home update-step warning icon (#5176) Integrated into release/v3.8.39. Amber for home update-step warning icon; 1/1 UI test. * fix(api): LAN/Tailscale dashboard — host-aware CSP + GET-exempt version route + combo field errors (#5083) (#5177) Integrated into release/v3.8.39. Host-aware CSP (ReDoS/injection-safe host validation) + GET-exempt /api/system/version (POST/spawn stays LOCAL_ONLY, exact-match safe-methods-only) + COMBO_002 firstField. 44/44 tests + route-guard membership gate green. CHANGELOG synced to keep all 4 v3.8.39 fixes. * fix(api): replace #5083 global middleware CSP with declarative ws: scheme (#5083) Follow-up to PR #5177 (merged): that version implemented the LAN-CSP fix (Bug 1) with a new global `src/middleware.ts` + `src/server/csp.ts`, which contradicts the project's documented architecture — 'No global Next.js middleware — interception is route-specific' (CLAUDE.md / AGENTS.md) — and was merged unverified (middleware vs next.config header precedence was never confirmed in a real build). This replaces that approach with the minimal, declarative equivalent: • next.config.mjs: connect-src now permits the bare `ws:` scheme (symmetric with the bare `wss:` already allowed) so the dashboard can reach its own Live WS server from a LAN/Tailscale host. No middleware. • Removes src/middleware.ts, src/server/csp.ts, and tests/unit/csp-host-aware.test.ts. • Adds tests/unit/csp-lan-ws-5083.test.ts (incl. a guard asserting src/middleware.ts does NOT exist, so the global-middleware approach cannot silently return). Bugs 2 (GET-exempt /api/system/version) and 3 (COMBO_002 field surfacing) from #5177 are unaffected and remain in place. Co-authored-by: KooshaPari <KooshaPari@users.noreply.github.com> * test(combo): end-to-end quota-share DRR routing-decision coverage (matrix parity) (#5179) Integrated into release/v3.8.39. Quota-share DRR routing-decision coverage (matrix parity); 2/2 pass on merge result. * feat(agent-bridge): graceful cert-install fallback with manual guide for containers (#4546) (#5178) Integrated into release/v3.8.39. Agent-bridge graceful cert-install fallback + manual guide (#4546); 6/6 tests pass on merge result. * fix(antigravity): family-scoped quota lockout (gemini/claude buckets) (#5180) Integrated into release/v3.8.39 — family-scoped antigravity quota lockout. Rebased from v3.8.37 + validated (vitest 5/5, typecheck clean, full combo-matrix green, model-lockout 99/0). Same-model cross-account retry (chat.ts) deferred pending live antigravity VPS validation. * fix(cli): force NODE_ENV to match dev/start run mode in custom Next server (#5189) Integrated into release/v3.8.39. Force NODE_ENV to match dev/start run mode in custom Next server; 2/2 source-scan+ordering tests pass on merge result. * feat(compression): CCR ranged/grep/stats retrieval (ReDoS-safe, backward-compat) (#5187) Integrated into release/v3.8.39. CCR ranged/grep/stats retrieval (safe-regex ReDoS guard + length/match caps); 17/17 tests pass on merge result. * docs(combo): sync all combo/routing-strategy docs to current state + document test coverage (#5185) Integrated into release/v3.8.39. Combo/routing-strategy docs sync; docs-only. * fix(mcp): return 404 (not 400) for unknown Streamable HTTP session id (#5169) (#5191) * fix(api): respect blocked Auto (Zero-Config) provider in /v1/models catalog (#5192) (#5194) * test(combo): deterministic context-relay codex quota-handoff coverage (closes last gap) (#5195) * test(ci): wire antigravity-quota-family under test:vitest (fix test-discovery orphan) (#5196) * fix(oauth): antigravity login no longer hangs — fire-and-forget onboarding + bounded post-exchange (#5193) Antigravity OAuth hang fix (no-PKCE/no-openid + bounded post-exchange + exchange-500 fix). Includes #5200 (Koosha) revert + owner rebaseline to keep documented comments. Integrated into release/v3.8.39. * feat(oauth): remote Antigravity login via local helper + paste-credentials (#5203) Remote Antigravity login: local helper (omniroute login antigravity) + paste-credentials. Integrated into release/v3.8.39. * fix(translator): accept Claude Messages shape in non-stream malformed-200 guard (#5156) Integrated into release/v3.8.39 * fix(cli): default dev bundler to Turbopack (16.2.x panic no longer reproduces) (#5206) Integrated into release/v3.8.39 * fix(cli): auto-calibrate server V8 heap from physical RAM (#5172) (#5213) The server was spawned with a fixed --max-old-space-size=512 (omniroute serve) or no heap flag at all (Electron), so RAM-rich boxes still OOM-crashed under load (Ineffective mark-compacts near heap limit ~500MB) with many providers/ accounts and large model catalogs. New calibrateHeapFallbackMb(os.totalmem()) defaults the heap to ~35% of RAM clamped [512,4096], wired into serve.mjs and electron/main.js. Explicit OMNIROUTE_MEMORY_MB still wins (#2939 unchanged). Also addresses #5160 (same OOM root); #5152 (docker) benefits via the same knob. Closes #5172 * fix(proxy): coalesce fast-fail health probes (#5208) Integrated into release/v3.8.39 * fix(proxy): close dispatchers when clearing cache (#5202) Integrated into release/v3.8.39 * fix(cli): raise dev server Node heap limit to 8GB to prevent OOM (#5198) Integrated into release/v3.8.39 * fix(auth): allow synthetic no-auth fallback for mimocode (#5205) Integrated into release/v3.8.39 * fix(oauth): preserve Antigravity refresh_token on empty/omitted upstream response (#3850) (#5214) Google's OAuth refresh tokens are non-rotating: the refresh response usually omits refresh_token and occasionally returns it as an empty string. The Antigravity executor used `typeof tokens.refresh_token === "string" ? ... ` which accepts "" (typeof "" === "string") and overwrote the stored token with empty, nulling it on first refresh. Now treats non-string OR empty as absent and preserves credentials.refreshToken, matching refreshGoogleToken semantics. Closes #3850 * fix(responses): normalize non-array input (#5204) Integrated into release/v3.8.39 * fix(stream): normalize safety finish reasons via shared helper (#5197) Integrated into release/v3.8.39 * fix(request-logger): never render negative '(-100%)' compression badge (#5201) Integrated into release/v3.8.39 * fix(combo): reject empty responses api output (#5207) Integrated into release/v3.8.39 — combo failover now rejects empty Responses API output (validateQuality). Baseline rebaseline dropped (main-measured drift; maintainer rebaselines at release). * fix(pwa): prefer cached navigation before offline page (#5209) Integrated into release/v3.8.39 — PWA service worker prefers cached navigation before offline page (#5165). * chore(release): v3.8.39 — 2026-06-28 * chore(release): rebaseline openapi+i18n coverage ratchet drift for v3.8.39 --------- Co-authored-by: Arthur Bodera <abodera@gmail.com> Co-authored-by: Nguyen Minh <lop123thcs@gmail.com> Co-authored-by: lunkerchen <labanchen@gmail.com> Co-authored-by: Ankit <177378174+anki1kr@users.noreply.github.com> Co-authored-by: KooshaPari <KooshaPari@users.noreply.github.com> Co-authored-by: Ardem2025 <ardemb22@gmail.com> Co-authored-by: backryun <bakryun0718@proton.me> Co-authored-by: Anton <39598727+NomenAK@users.noreply.github.com> Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com> Co-authored-by: Wilson <pedbookmed@gmail.com> Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
2026-07-26 09:52:11 +03:00 · 2026-06-28 06:58:29 -03:00
parent 7b139fdb5e
commit dc40911583
211 changed files with 26913 additions and 2531 deletions
--- a/bin/cli/commands/login.mjs
+++ b/bin/cli/commands/login.mjs
@@ -0,0 +1,192 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+
+/**
+ * `omniroute login antigravity` — local OAuth helper for remote installs.
+ *
+ * Why this exists: Google's `firstparty/nativeapp` consent for the embedded
+ * Antigravity desktop client only releases the authorization code when the
+ * loopback redirect (127.0.0.1:<port>) is REACHABLE. On a remote VPS install the
+ * loopback is unreachable, so the consent hangs forever and never emits a code —
+ * the dashboard's "paste the callback URL" fallback has nothing to paste. (The
+ * same flow works locally and over an SSH tunnel, where the loopback IS reachable.)
+ *
+ * This command runs the OAuth on the user's OWN machine — where 127.0.0.1 works —
+ * captures the code on a local loopback server, exchanges it for tokens, and
+ * prints a single-line credential blob. The user pastes that blob into the remote
+ * dashboard (Antigravity → "Paste credentials"), which decodes it, finalizes the
+ * onboarding server-side, and persists the connection.
+ *
+ * It talks ONLY to Google (no OmniRoute server needed locally), so it works even
+ * if the remote VPS is firewalled from the user's machine.
+ */
+
+const PROVIDER = "antigravity";
+
+/** Open the system browser; no-op if the optional `open` dependency is missing. */
+async function defaultOpenBrowser(url) {
+  try {
+    const { default: open } = await import("open");
+    await open(url);
+  } catch {
+    // `open` not available — the caller already printed the URL to paste manually.
+  }
+}
+
+/**
+ * Start a loopback HTTP server bound to 127.0.0.1 (NOT 0.0.0.0 — we never want to
+ * expose the callback to the LAN). Resolves to { port, waitForCallback, close }.
+ */
+function defaultStartServer(preferredPort) {
+  return new Promise((resolve, reject) => {
+    let resolveCallback;
+    const callbackPromise = new Promise((r) => {
+      resolveCallback = r;
+    });
+
+    const server = createServer((req, res) => {
+      const url = new URL(req.url, "http://127.0.0.1");
+      if (url.pathname !== "/callback" && url.pathname !== "/auth/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const params = Object.fromEntries(url.searchParams.entries());
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(
+        "<!doctype html><meta charset=utf-8><title>OmniRoute</title>" +
+          "<body style=\"font-family:system-ui;padding:2rem\">" +
+          "<h2>✅ Authorization received</h2>" +
+          "<p>Return to your terminal — you can close this tab.</p></body>"
+      );
+      resolveCallback(params);
+    });
+
+    server.on("error", reject);
+    server.listen(preferredPort || 0, "127.0.0.1", () => {
+      const { port } = server.address();
+      resolve({
+        port,
+        waitForCallback: () => callbackPromise,
+        close: () => new Promise((r) => server.close(() => r())),
+      });
+    });
+  });
+}
+
+/** Lazy-load the antigravity provider + blob codec (TS source via tsx). */
+async function loadDeps() {
+  const { antigravity } = await import("../../../src/lib/oauth/providers/antigravity.ts");
+  const { encodeCredentialBlob } = await import("../../../src/lib/oauth/credentialBlob.ts");
+  return { antigravity, encodeCredentialBlob };
+}
+
+/**
+ * Build the Google authorization request for a given loopback port. Uses a plain
+ * authorization_code grant (NO PKCE code_challenge) — matching the working flow:
+ * a code_challenge here would force the exchange to require a code_verifier.
+ */
+export async function buildAntigravityAuthRequest(port, makeState = randomUUID) {
+  const { antigravity } = await loadDeps();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const state = makeState();
+  const authUrl = antigravity.buildAuthUrl(antigravity.config, redirectUri, state);
+  return { redirectUri, state, authUrl };
+}
+
+/** Exchange the captured code for raw Google tokens (no code_verifier — no PKCE). */
+export async function exchangeAntigravityCode(code, redirectUri) {
+  const { antigravity } = await loadDeps();
+  return antigravity.exchangeToken(antigravity.config, code, redirectUri);
+}
+
+/**
+ * Orchestrate the local login. Dependencies are injectable for testing; the real
+ * path uses a 127.0.0.1 loopback server, the system browser, and a live token
+ * exchange against Google. Returns the credential blob string.
+ */
+export async function runAntigravityLogin(opts = {}, deps = {}) {
+  const startServer = deps.startServer ?? defaultStartServer;
+  const openBrowser = deps.openBrowser ?? defaultOpenBrowser;
+  const exchange = deps.exchange ?? exchangeAntigravityCode;
+  const makeState = deps.makeState ?? randomUUID;
+  const print = deps.print ?? ((s) => process.stdout.write(s));
+  const log = deps.log ?? ((s) => process.stderr.write(s));
+  const { encodeCredentialBlob } = await loadDeps();
+
+  const server = await startServer(opts.port);
+  const { redirectUri, state, authUrl } = await buildAntigravityAuthRequest(server.port, makeState);
+
+  log(`\nOpen this URL to authorize Antigravity (it will open automatically):\n\n  ${authUrl}\n\n`);
+  if (opts.browser !== false) await openBrowser(authUrl);
+  log("Waiting for Google to redirect back to the local loopback...\n");
+
+  const timeoutMs = opts.timeout ?? 300000;
+  let timer;
+  let params;
+  try {
+    params = await Promise.race([
+      server.waitForCallback(),
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Timed out waiting for the OAuth callback")),
+          timeoutMs
+        );
+        // Don't keep the event loop alive solely for this timer.
+        if (typeof timer.unref === "function") timer.unref();
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+    await server.close();
+  }
+
+  if (params.error) {
+    throw new Error(`Authorization failed: ${params.error_description || params.error}`);
+  }
+  if (params.state !== state) {
+    throw new Error("State mismatch — aborting (possible CSRF). Please retry the login.");
+  }
+  if (!params.code) {
+    throw new Error("No authorization code returned by Google.");
+  }
+
+  const tokens = await exchange(params.code, redirectUri);
+  const blob = encodeCredentialBlob({ provider: PROVIDER, tokens });
+
+  print(
+    "\n" +
+      "Antigravity authorized. Copy the line below and paste it into your remote\n" +
+      "OmniRoute dashboard: Providers → Antigravity → Connect → \"Paste credentials\".\n" +
+      "(This contains a refresh token — treat it like a password.)\n\n" +
+      blob +
+      "\n\n"
+  );
+  return blob;
+}
+
+async function runLoginAntigravity(opts) {
+  try {
+    await runAntigravityLogin({
+      browser: opts.browser,
+      timeout: opts.timeout,
+      port: opts.port,
+    });
+  } catch (err) {
+    process.stderr.write(`\nLogin failed: ${err?.message || err}\n`);
+    process.exit(1);
+  }
+}
+
+export function registerLogin(program) {
+  const login = program
+    .command("login")
+    .description("Local OAuth helpers for remote OmniRoute installs (run on your own machine)");
+
+  login
+    .command("antigravity")
+    .description("Authorize Antigravity locally and print a credential blob to paste remotely")
+    .option("--no-browser", "Do not auto-open the browser; print the URL instead")
+    .option("--port <n>", "Fixed loopback port (default: OS-assigned)", (v) => parseInt(v, 10))
+    .option("--timeout <ms>", "How long to wait for the callback", (v) => parseInt(v, 10), 300000)
+    .action(runLoginAntigravity);
+}
--- a/bin/cli/commands/registry.mjs
+++ b/bin/cli/commands/registry.mjs
@@ -2,6 +2,7 @@ import { registerMemory } from "./memory.mjs";
 import { registerSkills } from "./skills.mjs";
 import { registerAudit } from "./audit.mjs";
 import { registerOAuth } from "./oauth.mjs";
+import { registerLogin } from "./login.mjs";
 import { registerCloud } from "./cloud.mjs";
 import { registerEval } from "./eval.mjs";
 import { registerWebhooks } from "./webhooks.mjs";
@@ -83,6 +84,7 @@ export function registerCommands(program) {
  registerSkills(program);
  registerAudit(program);
  registerOAuth(program);
+  registerLogin(program);
  registerCloud(program);
  registerEval(program);
  registerWebhooks(program);
--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -2,11 +2,15 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { platform } from "node:os";
+import { platform, totalmem } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
 import { isTermux } from "../../../scripts/build/postinstallSupport.mjs";
+import {
+  resolveMaxOldSpaceMb,
+  calibrateHeapFallbackMb,
+} from "../../../scripts/build/runtime-env.mjs";

 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..", "..", "..");
@@ -126,9 +130,13 @@ export async function runServe(opts = {}) {

  console.log(`  \x1b[2m⏳ Starting server...\x1b[0m\n`);

-  const rawMemory = parseInt(process.env.OMNIROUTE_MEMORY_MB || "512", 10);
-  const memoryLimit =
-    Number.isFinite(rawMemory) && rawMemory >= 64 && rawMemory <= 16384 ? rawMemory : 512;
+  // #5172/#5160/#5152: default the V8 heap to ~35% of physical RAM (clamped
+  // [512, 4096]) instead of a fixed 512MB, which OOM-crashed boxes with plenty
+  // of RAM under load. An explicit OMNIROUTE_MEMORY_MB still wins.
+  const memoryLimit = resolveMaxOldSpaceMb(
+    process.env.OMNIROUTE_MEMORY_MB,
+    calibrateHeapFallbackMb(totalmem())
+  );

  const env = {
    ...process.env,
@@ -136,7 +144,7 @@ export async function runServe(opts = {}) {
    PORT: String(dashboardPort),
    DASHBOARD_PORT: String(dashboardPort),
    API_PORT: String(apiPort),
-    HOSTNAME: "0.0.0.0",
+    HOSTNAME: process.env.HOSTNAME || "0.0.0.0",
    NODE_ENV: "production",
    NODE_OPTIONS: `--max-old-space-size=${memoryLimit}`,
  };