mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-06 07:12:12 +03:00
feat/plugin-browser-pool
16 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
AmirHossein Rezaei
|
bb5cb51f3e |
fix(docker): honor OMNIROUTE_BASE_PATH behind reverse-proxy subpaths (#8615)
* fix(docker): honor OMNIROUTE_BASE_PATH behind reverse-proxy subpaths Next.js basePath is compile-time state; Docker now records the baked value, forwards the env var as a build-arg, patches root-path images at container start when needed, and probes health under the active subpath. Hard Rule #13: scripts/docker/patch-basepath.sh and the entrypoint invoke Node with a fixed argv; OMNIROUTE_BASE_PATH is read from process.env only — never interpolated into sed/awk. Closes #8600 * fix(docs): unblock CI for Docker basePath guide Describe the build-time basePath marker as a sentinel file instead of a fabricated env var, and replace the unsupported ```env fence with bash so fumadocs/Shiki can compile DOCKER_GUIDE.md during DAST smoke. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(docker): add changelog fragment for #8615 basePath bundle patch Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
0c6041a34e | fix(mcp): copy undici into dist/node_modules to prevent hollow-package shadowing crash (#7701) (#7756) | ||
|
huohua-dev
|
8c94cb5977 |
[needs-vps] fix(electron): materialize Turbopack hashed-module symlinks during packaging (#6724, #6594) (#6794)
* fix(electron): materialize Turbopack hashed-module symlinks during packaging Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(electron): actually enable materializeSymlinks on the electron standalone path The option existed in assembleStandalone but no production callsite passed it, so packaged builds still shipped absolute symlinks into the build machine's worktree for Turbopack hashed externals (better-sqlite3-<hash>, sqlite-vec-<hash>) — verified by dpkg -c on a freshly built .deb. One-line enablement on the electron prepare path, which is exactly the surface #6724/#6594 report. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: huohua-dev <258873123+huohua-dev@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> |
||
|
Diego Rodrigues de Sa e Souza
|
83cca4d20f |
fix(build): packed tarball boot crash — server-ws timeout import escaped the package (#7065 class) (#7308)
* fix(build): server-ws timeout helper as shipped sibling — ../../src import crashed every packed boot (#7065 class) * test(build): align pack-artifact-policy fixture with the new dist/main-server-timeouts.mjs required path |
||
|
Diego Rodrigues de Sa e Souza
|
a2ac387abd |
fix(cli): ship head-response-guard.cjs in the standalone bundle (#6908)
* fix(cli): ship head-response-guard.cjs in the standalone bundle
server-ws.mjs imports ./head-response-guard.cjs, but assembleStandalone had
no EXTRA_MODULE_ENTRIES entry for it, so every build:release bundle crashed
at boot with ERR_MODULE_NOT_FOUND (found deploying
|
||
|
Diego Rodrigues de Sa e Souza
|
78f09c8d9f |
Release v3.8.41 (#5327)
Release v3.8.41 — 52 commits since v3.8.40 (19 CHANGELOG bullets, 11 contributors). All gating CI green: Unit×8, Coverage×8, Vitest, Package Artifact, Quality Ratchet, CodeQL, Lint, Docs Sync (Strict), Node 24/26 compat, E2E×9, Integration, Electron smoke. Advisory checks overridden (main unprotected): PR Test Policy = test-masking heuristic on the cumulative 52-commit assert delta (legitimate dead-code-sweep removals + consolidations, reviewed per-PR); SonarCloud/SonarQube = new-code maintainability/coverage quality gate (CodeQL/Semgrep/Security/npm-audit/Dependabot all clean — not a security finding). |
||
|
Diego Rodrigues de Sa e Souza
|
3c9883bb73 |
Release v3.8.29 (#4126)
OmniRoute v3.8.29 — 115 commits since v3.8.28. Full CHANGELOG + 41 i18n mirrors. All content quality gates green (build, unit 8/8, vitest 188/188, PR test policy, quality gates extended, docs sync, quality ratchet). Remaining red CI checks are pre-existing release flakes (coverage-shard/integration/node-compat teardown), a new transitive undici advisory in electron devDeps, and a workflow-level CodeQL fail (0 open alerts). VPS-validated by the operator. |
||
|
Diego Rodrigues de Sa e Souza
|
fa367dd99e |
Release v3.8.27 (#3968)
* chore(release): open v3.8.27 development cycle * fix(security): polynomial ReDoS in comboAgentMiddleware regex (#3982) * fix(security): eliminate polynomial ReDoS in comboAgentMiddleware <omniModel> regex (CodeQL js/polynomial-redos) CACHE_TAG_PATTERN wrapped the tag in an unbounded `(?:\\n|\n|\r)*` prefix/suffix. On an unanchored `.test()`/`.exec()` that is O(n²) on inputs with many newlines (CodeQL js/polynomial-redos, alerts #612/#613). The surrounding runs are irrelevant to detecting/capturing the tag, so the detection pattern now matches only the core `<omniModel>([^<]+)</omniModel>`; the global strip pattern still consumes the wrapping newlines (combo.ts streaming, #531) but BOUNDED ({0,16}) so it stays linear. Behavior preserved: detection, model extraction, multi-tag stripping (#454) and blank-line cleanup all unchanged (107 related tests green). Adds ReDoS-safety regression tests (50k-newline inputs complete in <1ms). * docs(changelog): add #3982 ReDoS fix to [3.8.27] * ci(security): harden workflows — artipacked persist-credentials + cache-poisoning + SC2086 (#3965) * Refine provider quota card display (#3969) Integrated into release/v3.8.27 * feat: add sidebar group separator toggles (#3971) Integrated into release/v3.8.27 * Gate control-plane proxy direct fallback (#3963) Integrated into release/v3.8.27 * Capture actual upstream provider requests (#3941) Integrated into release/v3.8.27 * ci(quality): flip require-tighten + osv + Trivy to blocking (v3.8.27 cycle-end) (#3984) * fix(resilience): respect connection cooldown stored as numeric epoch (#3954) (#3995) rate_limited_until is a TEXT column, but setConnectionRateLimitUntil (Antigravity full-quota path) persists a raw epoch number that SQLite coerces to a numeric string ("1781696905131.0"). The selection predicate isAccountUnavailable then did new Date("1781696905131.0") -> NaN, so the cooling connection was never skipped and the router kept dispatching to rate-limited accounts. Normalize numeric-epoch strings (and number/Date/ISO) via a shared cooldownUntilMs() helper in isAccountUnavailable / getEarliestRateLimitedUntil / filterAvailableAccounts / parseFutureDateMs. ISO behavior preserved. * fix(providers): fetch live /models for LLM7 and BytePlus (#3976) (#3996) llm7 and byteplus carry a real modelsUrl but were not classified by any live-fetch branch of the model-import route, so their hardcoded 4-entry registry catalog was served (source local_catalog) instead of the upstream catalog. Add both to NAMED_OPENAI_STYLE_PROVIDERS so the route probes <baseUrl>/models and serves the live list, falling back to the local catalog only on fetch failure. * fix(dashboard): logs auto-refresh reads live visibility, not a stale mount ref (#3972) (#3997) The auto-refresh interval gated each tick on visibleRef, seeded once at mount and updated only by a visibilitychange event. A tab mounted while document.visibilityState is 'hidden' (background load, bfcache, embedded/proxied webviews) with no later visibilitychange left the ref false forever, so the interval ticked but never fetched — only the manual button worked. Read the live document.visibilityState in the tick instead. * feat(compression): add Indonesian caveman rules and language pack (#3975) Integrated into release/v3.8.27 (cherry picked from commit |
||
|
Diego Rodrigues de Sa e Souza
|
76a07cf7a5 |
Release v3.8.24 (#3747)
Release v3.8.24 — see CHANGELOG.md [3.8.24] for the full notes and the PR description for the contributors hall. Integration of release/v3.8.24 into main. |
||
|
Diego Rodrigues de Sa e Souza
|
b6c65efd28 |
fix(build): include webdav-handler.mjs in dist/ bundle (#3687)
server-ws.mjs imports ./webdav-handler.mjs but the assembleStandalone pipeline did not copy it from scripts/dev/, causing a startup crash on any fresh install of v3.8.22 (ERR_MODULE_NOT_FOUND). Fix: add the copy entry to assembleStandalone.mjs, add it to APP_STAGING_ALLOWED_EXACT_PATHS and PACK_ARTIFACT_REQUIRED_PATHS in pack-artifact-policy.ts, and add a regression test. Hotfix validated live on VPS (192.168.0.15): server-ws.mjs resolves the module and the process starts healthy after the file was deployed. |
||
|
Diego Rodrigues de Sa e Souza
|
ee62c4c38b |
refactor(build): single-source sidecar list + drop redundant Dockerfile COPYs (#3187)
Integrated into release/v3.8.11 |
||
|
diegosouzapw
|
6ce96cb664 |
refactor(build): reduce assembleStandalone cognitive complexity (SonarCloud gate)
Extract patchStandalonePackageJson / copyStaticAndPublic / copyNativeAssetsAndExtraModules helpers so assembleStandalone drops from cognitive complexity 29 → ~12 (≤15 gate). Also: replaceAll over replace, String.raw for the regex-escape replacement (2 minor smells). Pure refactor — assemble-standalone.test.ts still green; no behavior change. |
||
|
diegosouzapw
|
49dedecc42 |
fix(build): assemble static/server-files/chunks under distDir, not literal .next
CRITICAL white-screen bug from the build-output-isolation refactor: the standalone
server.js bakes distDir ("./.build/next") into its config and serves /_next/static
from <root>/.build/next/static — but assembleStandalone hard-coded the destination
to <outDir>/.next/static (+ sanitised/patched <outDir>/.next/{required-server-files,
server}). Result: the server's static dir was EMPTY → every JS/CSS chunk 404'd →
blank login page (health stayed 200, so it slipped past the health-only dry-run).
Mirror the distDir path (relative to projectRoot) for static, required-server-files
sanitization (was a silent no-op → 0 paths sanitised, now 11), and the Turbopack
chunk patch. Verified: booting the assembled bundle serves the webpack chunk 200.
Affects every consumer (npm/Docker/Electron/VPS).
|
||
|
diegosouzapw
|
b7fdcdddf8 |
build(layer1): rename standalone output app/ -> dist/; delete both App-Router move hacks
- scripts/build/prepublish.ts: APP_DIR -> DIST_DIR; remove Step 1 and Step 2.5 hack blocks; fix MCP esbuild outfile (app/ -> dist/); update all log messages - scripts/build/build-next-isolated.mjs: remove legacy-app-snapshot entry from getTransientBuildPaths() (App-Router collision hack deleted) - scripts/build/assembleStandalone.mjs: fix standalone package.json after copy — removes "type":"module" so Next.js standalone server.js (CJS) loads correctly; also adds .build/next/ to allowed staging prefixes so server bundles are kept - scripts/build/pack-artifact-policy.ts: app/ -> dist/ in all PACK_ARTIFACT_* paths; add ".build/next/" to APP_STAGING_ALLOWED_PATH_PREFIXES (Layer 1 distDir change) - scripts/build/validate-pack-artifact.ts: dist/ check instead of app/ - scripts/build/postinstall.mjs: all app/ paths -> dist/ - scripts/build/postinstallSupport.mjs: hasStandaloneAppBundle checks dist/server.js - bin/cli/commands/serve.mjs: APP_DIR -> dist/ - package.json: files[] "app/" -> "dist/" - .gitignore: remove both /app and /app/ entries (no longer needed) Smoke: NO_APP_DIR_OK; DIST_OK; check:pack-artifact PASS; health 200 from dist/ |
||
|
diegosouzapw
|
5b484737bb |
build(layer1): isolate Next output to .build/next; gitignore .build/ dist/ .next/
- next.config.mjs: distDir default ".next" → ".build/next" (NEXT_DIST_DIR override kept) - .gitignore: add /.build/, /dist/, /.next/; remove loose dist/ under #dependencies - scripts/build/paths.mjs: new shared module exporting ROOT, DIST_DIR, STANDALONE_DIR - scripts/build/build-next-isolated.mjs: default ".next" → ".build/next" in distDir, resetStandaloneOutput fallback, and pruneStandaloneArtifacts - scripts/build/prepublish.ts: NEXT_DIST default ".next" → ".build/next" - scripts/build/assembleStandalone.mjs: legacy syncStandalone* helpers updated to resolve distDir via NEXT_DIST_DIR || ".build/next" - tsconfig.json: Next.js auto-added .build/next/types includes (generated on build) Smoke: .build/next/standalone/server.js exists; BUNDLE_OK confirmed; no .next directory created. |
||
|
diegosouzapw
|
05c6335292 |
build(layer0): unify standalone assembly into assembleStandalone.mjs
Extract the shared copy/sync/sanitize logic (native assets, extra modules, static/public, optional path-sanitize + turbopack-chunk-patch) from the three divergent assembly scripts into one module. Wire build-next-isolated.mjs to call it (in-place .next/standalone). Output is byte-identical to before — pure refactor. Golden test + existing build-next-isolated tests (7/7) green; standalone retains all natives + sidecars. |