diegosouzapw
0e238a61fb
feat(core): implement 26 action items from critical analysis + bump v0.4.0
...
- Security: AES-256-GCM encryption for API keys/tokens, CI security audit
- Accessibility: ARIA labels, aria-live regions, skip-to-content, contrast utility
- Components: Tooltip, CloudSyncStatus, SystemMonitor, StreamTracker
- Utils: costEstimator, promptInjectionGuard middleware, Zod validation schemas
- Docs: openapi.yaml +9 routes, API_REFERENCE internal APIs, version bumps
- Quality: coverage thresholds 60/50/50, error handling improvements
2026-02-15 12:33:56 -03:00
diegosouzapw
597c590a1d
feat(phase10): docs restructuring, component decomposition, and cleanup
...
- Split README (1326→211 lines): USER_GUIDE, API_REFERENCE, TROUBLESHOOTING
- Expand CONTRIBUTING.md (112→273 lines)
- Extract RequestLoggerDetail from RequestLoggerV2 (910→665 lines)
- Extract ProxyLogDetail from ProxyLogger (677→519 lines)
- Add accessibility attrs (aria-label, role=dialog) to extracted modals
- Migrate not-found.js inline styles to TailwindCSS gradient classes
- Remove continue-on-error from E2E CI step
- Add PolicyEngine class with glob-based policy matching
- Create a11yAudit.js (WCAG rule checker)
- Fix policyEngine test import path
2026-02-15 11:53:40 -03:00
diegosouzapw
1cbbc33f20
feat(security): FASE-01 to FASE-06 security hardening
...
FASE-01 — Security Hardening:
- Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast)
- Create secretsValidator.js with enforceSecrets() at startup
- Create inputSanitizer.js (prompt injection + PII detection)
- Integrate sanitizer in chat.js handler pipeline
- Add structured logging to silent catch blocks in proxy.js
- Remove .passthrough() from Zod updateSettingsSchema
- Remove insecure npm fs dependency
- Update .env.example with generation commands
FASE-02 — CI/CD & Tests:
- Create ci.yml workflow (lint, build, test, coverage, e2e)
- Fix test scripts (test now runs actual tests)
- Add test:unit, test:security, test:coverage (c8), test:all
- Add security rules to ESLint (no-eval, no-implied-eval, no-new-func)
FASE-03 — Architecture:
- Create settingsCache.js (eliminate self-fetch anti-pattern)
- Create domain/types.js and domain/responses.js
FASE-04 — Observability:
- Create correlationId.js (AsyncLocalStorage tracing)
- Create circuitBreaker.js (full state machine + registry)
- Create requestTimeout.js (per-provider timeouts)
FASE-05 — Code Quality:
- Create structuredLogger.js (JSON/human-readable logging)
FASE-06 — Documentation:
- Update SECURITY.md with hardening practices
- Create CONTRIBUTING.md with dev setup and PR checklist
Tests: 52/52 pass (23 security + 15 observability + 14 integration)
2026-02-14 18:21:47 -03:00
Diego Rodrigues de Sa e Souza
c4cdb52fe6
fix(ci): reference NPM_TOKEN environment for environment-scoped secrets ( #18 )
...
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com >
2026-02-14 04:31:26 -03:00
Diego Rodrigues de Sa e Souza
15ec100dcb
fix(ci): write .npmrc explicitly for npm auth — support both secrets and vars ( #17 )
...
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com >
2026-02-14 04:26:05 -03:00
Diego Rodrigues de Sa e Souza
d401ef40f1
fix(ci): support NPM_TOKEN from both secrets and vars, remove --provenance ( #16 )
...
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com >
2026-02-14 04:22:00 -03:00
Diego Rodrigues de Sa e Souza
92b4c59fec
feat(npm): add npm package publishing with CLI entry point ( #15 )
...
- Add bin/omniroute.mjs CLI with banner, auto-open browser, graceful shutdown
- Add scripts/prepublish.mjs to build Next.js standalone into app/
- Add .github/workflows/npm-publish.yml for automated publish on release
- Update package.json: name=omniroute, bin, files, engines, keywords, prepublishOnly
- Add output: 'standalone' to next.config.mjs
- Add MIT LICENSE
- Update .npmignore and .gitignore for app/ build artifact
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com >
2026-02-14 04:14:14 -03:00
dependabot[bot]
79e10c9a41
build(deps): bump actions/github-script from 7 to 8
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 7 to 8.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](https://github.com/actions/github-script/compare/v7...v8 )
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: '8'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-13 19:30:25 +00:00
diegosouzapw
699329944e
feat: initial OmniRoute release (rebranded from 9router)
...
This project is inspired by and originally forked from 9router by decolua
(https://github.com/decolua/9router ).
Full rebrand: 9router → OmniRoute across all source code, configuration,
Docker, documentation, and assets.
2026-02-13 16:29:27 -03:00
