diegosouzapw
d624ddde03
fix(electron): code review hardening — 16 fixes for security, performance, robustness
...
## Critical Fixes
- #1 : Server readiness — waitForServer() polls before loading window
- #2 : Restart timeout — 5s + SIGKILL prevents IPC handler from hanging
- #3 : changePort — now stops/restarts server on new port
## Important Fixes
- #4 : Tray cleanup — destroy old Tray before recreating
- #5 : IPC emission — server-status & port-changed events
- #6 : Disposer pattern — replaces removeAllListeners
- #7 : useSyncExternalStore — eliminates 5x re-renders
## Minor: #8-#16 (dead code, CSP, platform titlebar, types, errors, version)
Tests: 76 / 15 suites (was 64/9)
2026-02-28 08:15:04 -03:00
diegosouzapw
d3ace8d611
fix: security hardening, tests, docs for Electron desktop & memory optimization
...
## Security Fixes
- Sanitize OMNIROUTE_MEMORY_MB with parseInt + range validation (64-16384)
to prevent command injection via spawn() args
- Validate URL protocol in shell.openExternal (http/https only)
to prevent RCE in Electron renderer compromise
- Bump default memory from 256MB to 512MB
## Electron package-lock.json
- Added to .gitignore (5278 lines removed from tracking)
## Test Suite (64 tests, 9 suites)
- electron-main.test.mjs: URL validation, IPC channels, window handler
- electron-preload.test.mjs: channel whitelist, API surface, open-external
- cli-memory.test.mjs: injection prevention, boundary values, .env parsing
## Documentation
- Desktop App section added to all 30 READMEs (9 fully translated)
- USER_GUIDE.md updated with 512MB default
- .env.example reflects new defaults
2026-02-28 07:59:38 -03:00
diegosouzapw
01c1bbfe29
fix: polish split-port implementation for merge
...
- Add 30s timeout to API bridge proxy requests to prevent resource exhaustion
- Extract healthcheck.mjs script (replaces inline node -e in Dockerfile + compose files)
- Add unit tests for runtime port resolution (14 tests, parsePort + resolveRuntimePorts)
- Fix formatting in declare global block
2026-02-27 16:29:58 -03:00
diegosouzapw
1dd05bffe8
fix: proxy support for connection tests, compatible provider display ( #119 , #113 )
...
- Connection tests now route through configured proxy (key → combo → provider → global → direct)
- Compatible providers show friendly labels (OAI-COMPAT, ANT-COMPAT) in request logger
- 26 new unit tests for error classification, token expiry, and display labels
- Version bump to 1.3.1
2026-02-23 16:50:48 -03:00
diegosouzapw
343e6c50e3
chore(release): v1.3.0 — iFlow HMAC fix, health check logs toggle, kilocode models, model dedup
...
✨ New Features:
- Hide Health Check Logs toggle (PR #111 by @nyatoru)
- Kilocode custom models endpoint + 26 models (PR #115 by @benzntech)
🐛 Bug Fixes:
- iFlow 406 error fixed with IFlowExecutor HMAC-SHA256 signature (#114 )
- Filter parent model duplicates from endpoint lists (PR #112 by @nyatoru)
🧪 Tests:
- 11 new IFlowExecutor unit tests
- All 379 tests passing
2026-02-23 03:50:01 -03:00
diegosouzapw
5e0376c6c9
fix(test): correct JWT_SECRET assertion — required:false means missing is valid
...
The secretsValidator marks JWT_SECRET as required:false (auto-generated
at startup), but the test asserted valid:false when JWT_SECRET was missing.
This caused CI to fail with 367/368 tests passing.
2026-02-22 16:42:09 -03:00
diegosouzapw
0279341221
feat(phase4): focus indicators, session management, k6 load tests, remove @ts-check
...
- U-3/U-4: Global focus-visible indicators + CSS focus-ring utility
- C-6: Removed @ts-check from 18 .ts files (redundant in TypeScript)
- T-5: k6 load test script (tests/load/proxy-load.js)
- P-3: SessionInfoCard component in Security settings tab
2026-02-18 14:51:15 -03:00
diegosouzapw
7efbfad9bd
feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, audit log, cache invalidation, ARIA, CSS vars
...
Phase 2 — Architecture & Quality:
- A-5: DI container (src/lib/container.ts)
- L-6: Prompt versioning (src/lib/db/prompts.ts)
- L-7: Eval scheduler (src/lib/evals/scheduler.ts)
- L-8: Plugin architecture (src/lib/plugins/index.ts)
- T-3: Integration tests (42 tests, 9 suites)
Phase 3 — UX & Polish:
- P-1: 500 error page (src/app/error.tsx)
- P-2: Audit log viewer (dashboard/audit-log/page.tsx)
- U-2: ARIA attributes on error pages
- U-5: Typed global-error.tsx params
- U-6: CSS variables for accent/semantic/traffic colors
- L-3: Output PII sanitization (src/lib/piiSanitizer.ts)
- L-4: Tool-calling allowlist/denylist (src/lib/toolPolicy.ts)
- L-9: Semantic cache invalidation API + auto-cleanup
- D-5: SECURITY.md updated to v1.0.x
- F-2: Deleted .env copy
2026-02-18 14:43:57 -03:00
diegosouzapw
71d14209a4
feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy
...
OmniRoute is an intelligent API gateway that unifies 20+ AI providers behind a single
OpenAI-compatible endpoint. Features include intelligent routing with 6 strategies,
multi-format translation (OpenAI/Claude/Gemini/Responses API), circuit breakers,
semantic caching, combo fallback chains, real-time health monitoring, and a full
dashboard with provider management, analytics, and CLI tool integration.
Key highlights:
- 20+ providers (Claude Code, Codex, Gemini CLI, GitHub Copilot, iFlow, Qwen, Kiro, etc.)
- 6 routing strategies (Fill First, Round Robin, P2C, Random, Least Used, Cost Optimized)
- Export/Import database backup with full archive support
- Translator Playground with 4 modes (Playground, Chat Tester, Test Bench, Live Monitor)
- 100% TypeScript across src/ and open-sse/
- Docker support with multi-stage builds
- Comprehensive documentation and 9 dashboard screenshots
2026-02-18 00:02:15 -03:00
