PR #3907 lowered the test assertions for fetchKeepAliveTimeoutMs from 4000 to
1000 expecting DEFAULT_FETCH_KEEPALIVE_TIMEOUT_MS to drop to 1000, but the source
change was reverted on review (kept at 4000, with keepAliveMaxTimeout pinning
instead). The test was left asserting 1000, turning the unit suite red
release-wide. Align the assertions back to the shipped source value (4000).
Integrated into release/v3.8.26 — reconciled: kept #3900's superset wiki-sync, dropped the superseded sync-wiki-home; counts taken from the newer canonical release docs; net-new value = vale/markdownlint docs-lint infra + 7 new docs (Notion/Obsidian/Plugin-Marketplace/Cost-Tracking/Free-Provider-Rankings/Feature-Flags/Egress-Policy) + check-docs-counts-sync guard.
* docs(mcp): correct the MCP tool-inventory diagram source + text to 87 tools
The mcp-tools diagram source was frozen at v3.8.8 (43 tools = 30 core + 3 memory +
4 skills + 6 notion) — missing the agent-skills, gamification, plugins and obsidian
modules, and Core had grown 30 → 33. Corrected to the real breakdown verified against
open-sse/mcp-server (TOTAL_MCP_TOOL_COUNT):
33 core + 3 memory + 4 skills + 3 agent-skills + 8 gamification + 8 plugins
+ 6 notion + 22 obsidian = 87
- renamed mcp-tools-43.{mmd,svg} → mcp-tools-87.{mmd,svg}
- rewrote the .mmd source with the 8 real categories
- fixed MCP-SERVER.md: source-of-truth line, image alt, and the inventory caption
- fixed docs/diagrams/README.md index entry
check:doc-links PASS (links resolve).
⚠️ The committed mcp-tools-87.svg is the OLD render (still draws 43 tools): the SVG
must be regenerated with `npm run docs:render-diagrams` in an environment with a
working headless Chromium. It could NOT be rendered in this sandbox — Chromium is
missing system libraries (libnss3 / libatk / libcups / libxcb, no apt access). The
.mmd source and all surrounding text are correct, so a single render call finalizes
the image.
* docs(mcp): render mcp-tools-87.svg (87-tool inventory diagram)
Several docs bodies carried stale counts from the v3.8.0–v3.8.2 era while the code
moved on. Brought them to the canonical values verified against source:
- providers 177/160+/223 → 226 (docs/reference/PROVIDER_REFERENCE.md "Total providers")
- MCP tools 37/42/43 → 87 (open-sse/mcp-server TOTAL_MCP_TOOL_COUNT)
- routing strategies 14 → 15 (routingStrategies.ts ROUTING_STRATEGY_VALUES)
- i18n locales 40/40+ → 42 (config/i18n.json)
- MCP scopes ~13/13 → 30
Files: ARCHITECTURE, CODEBASE_DOCUMENTATION, REPOSITORY_MAP, QUALITY_GATES,
ACP, AGENT-SKILLS, AGENTBRIDGE, PROVIDERS-GUIDE, SETUP_GUIDE, MCP-SERVER (headline),
OMNIROUTE_VS_ALTERNATIVES, README, RELEASE_CHECKLIST.
Executors (60), OAuth providers (16), A2A skills (6) and cloud agents (3) were already
correct (check-docs-counts-sync --strict still passes). Left untouched on purpose: the
point-in-time reports (DOCUMENTATION_AUDIT_REPORT, E2E shakedown) and the MCP tool
inventory diagram (mcp-tools-43.svg) — diagram regeneration is a separate task.
This unblocks full GitHub-wiki content parity: the wiki was synced from these corrected
sources via scripts/docs/sync-wiki.mjs --update-existing.
docs/ops/DOCUMENTATION_AUDIT_REPORT.md (added in #3804) was the only file
under docs/ops/ without a `title:` frontmatter block. Fumadocs scans docs/**
into the `docs` collection and fails the production build with
"Invalid input: expected string, received undefined" (title) — the same MDX
frontmatter class of break as the v3.8.25 SUPPLY_CHAIN.md incident (#3864).
Fast Quality Gates does not run `npm run build`, so it stayed green on the
release branch and would only explode at release->main sync. Added the
frontmatter matching the sibling docs/ops/*.md convention; full build now
passes (Next.js compiled 549/549 pages).
The wiki has no native generator and drifts each release — it lacked SUPPLY_CHAIN
plus 24 other docs pages, and the cover counts went stale (212+/14/37 vs 226/15/87).
Adds:
- scripts/docs/sync-wiki.mjs — adds docs/ pages missing from the wiki (curated;
internal reports/plans/index excluded) and syncs the four Home.md cover counts.
Matches the hand-curated, non-deterministic wiki page names by a normalized fuzzy
key and writes the EXISTING name, so it never creates duplicate pages. Overwriting
existing-page content is opt-in (--update-existing) and intentionally OFF by
default: several docs sources still carry stale counts (e.g. ARCHITECTURE.md says
"177 providers / 37 MCP tools" while the wiki cover is 226/87), so a blind overwrite
would REGRESS the wiki. Full parity is gated on regenerating those sources — see
docs/ops/DOCUMENTATION_AUDIT_REPORT.md.
- .github/workflows/wiki-sync.yml — runs the sync on every push to main that touches
docs/ (or a count source) + workflow_dispatch, pushing via GITHUB_TOKEN.
- tests/unit/sync-wiki.test.ts — pure-function coverage (8 tests).
The first run already pushed the 25 missing pages to the wiki.
Move the committed quality-gate state files out of the repo root into
config/quality/ and the v3.8.24 documentation audit into docs/ops/, then
re-point every gate script, test and .gitignore entry at the new paths.
Refresh docs/architecture/REPOSITORY_MAP.md (stale since v3.8.2) to match
the current layout.
Moved -> config/quality/:
quality-baseline.json, complexity-baseline.json, duplication-baseline.json,
file-size-baseline.json, test-discovery-baseline.json,
dependency-allowlist.json, .license-allowlist.json
(generated quality-metrics.json now written here too; still gitignored)
Moved -> docs/ops/:
DOCUMENTATION_AUDIT_REPORT.md (+ meta.json entry + fabricated-docs skip)
Path updates: check-{complexity,duplication,file-size,test-discovery,deps,
licenses,dead-code,cognitive-complexity,type-coverage}.mjs, check-quality-
ratchet.mjs, collect-metrics.mjs, check-tracked-artifacts.mjs (+ its test and
check-deps test). Also gitignore /logs/ (was untracked-not-ignored).
Tracked root files: 56 -> 48. Tool configs left in root on purpose: most are
auto-discovered there, and the tsconfig variants have location-relative
files:[] arrays that would need 46 path rewrites for a 2-file gain.
- README advertised a stale '177 providers'; the canonical generator
(gen-provider-reference.ts) reports 226 unique provider IDs. Updated the README
badges/anchors/heading and regenerated docs/reference/PROVIDER_REFERENCE.md (223→226)
to match the source of truth.
- Adds DOCUMENTATION_AUDIT_REPORT.md (docs/i18n sync audit + plan).
Docs-only; carried over from in-progress working-tree changes and verified against the
generator.
* chore(release): continue v3.8.25 development cycle after main code-sync (r5)
main fast-forwarded to release/v3.8.25 (#3863): unblocked Build+Docker via
#3864, plus #3837 (mimocode proxy) and #3862 (trivy bump). This marker
re-opens the umbrella PR for further v3.8.25 work. No version bump.
* fix(db): persist the Keep-latest-backups retention setting (#3834) (#3867)
* fix(oauth): clear GitLab Duo setup message instead of 500 (#3861) (#3868)
* test(oauth): prove refresh_token preserved on real gemini-cli/antigravity dispatch (#3850) (#3869)
* feat(compression-ui): unified compression config UI — per-engine pages + combos editor + menu + WS default-on (#3860)
Integrated into release/v3.8.25 — feat(compression-ui): unified compression configuration UI (Compression Hub + per-engine Lite/Aggressive/Ultra pages + combos editor + sidebar entry + live-WS default-on). File-size re-baselined for sidebarVisibility.ts/chatCore.ts growth; orphan ws test relocated to a collected path.
* docs(changelog): complete the v3.8.25 release notes + credit all contributors
Audited every commit since v3.8.24 and filled the gaps the [3.8.25] section
was missing: a New Features section (compression engines + Compression Studios
#3848, compression UI #3860, injection-guard #3857, kiro discovery #3836, Veo
#3839, mimocode proxy #3837, Arena ELO flag #3821), 9 more Fixed entries
(#3811/#3807/#3759/#3849/#3838/#3835/#3814/#3820/#3819), a Security section
(CCR IDOR #3859, supply-chain #3824), and an Internal/Quality section. Every
contributor and issue reporter is now credited.
* docs(changelog): restore + complete the v3.8.25 release notes
Re-adds CHANGELOG.md (a prior server-side commit accidentally dropped it) with
the complete, audited [3.8.25] section: New Features, the full Fixed list,
Security & Hardening, and Internal/Quality — every contributor and issue
reporter credited.
* chore(release): finalize v3.8.25 — reconcile CHANGELOG + i18n mirrors, document OMNIROUTE_MAX_PENDING_MIGRATIONS, green the unit suite
Release-gate reconciliation for v3.8.25:
- CHANGELOG: dated 2026-06-14, linked #3826, rolled up file-size re-baselines (#3823/#3833),
recorded the test-greening; re-synced all 41 i18n CHANGELOG mirrors.
- Documented OMNIROUTE_MAX_PENDING_MIGRATIONS (#3416) in .env.example + ENVIRONMENT.md.
- Greened the unit suite (was merged red on 4 CI shards): aligned 10 stale tests to this
cycle's intended behavior (#3838/#3822/#3501/SOCKS5/Vertex-Express/Antigravity) and the
same-provider 503 fall-through test; de-flaked the compression benchmark reproducibility
and ServiceSupervisor crash tests. No production code changed.
* ci(security): clear OpenSSF Scorecard code-scanning noise + harden workflow token permissions
The Security tab held 155 open alerts, ALL from the advisory OpenSSF Scorecard tool
(#3824) — supply-chain/posture scores, not code vulnerabilities — which drowned out
real CodeQL findings.
- scorecard.yml: stop uploading SARIF to the code-scanning tab (drop the upload-sarif
step + the now-unused security-events: write). The run still produces the OpenSSF
badge (publish_results) and a downloadable SARIF artifact.
- TokenPermissions hardening (the high-severity, genuinely-valuable subset): set each
workflow's top-level token to read-only and grant the exact writes at the job level
that needs them — npm-publish (id-token/packages on publish jobs), docker-publish
(packages on build), electron-release (contents on build/release, id-token/packages
on publish-npm), build-fork (packages on build), claude (empty top-level; job grants
its own). The 155 existing alerts were dismissed.
Not adopting repo-wide SHA-pinning (143 PinnedDependencies advisories) — declined.
* test(integration): align stale wiring/socks5 integration tests to this cycle's behavior
These were red on the CI Integration job (pre-existing). No production code changed:
- integration-wiring: the combos page no longer renders a per-page EmailPrivacyToggle
(#3822 consolidated it into Settings → Appearance); the provider-detail test-result
masking and upstream-proxy copy moved to decomposed components (#3501
BatchTestResultsModal / UpstreamProxyCard) — assertions now read the owning files.
- api-routes-critical: SOCKS5 is now enabled by default (opt-out), so the disabled-
rejection test must set ENABLE_SOCKS5_PROXY=false explicitly (an unset env now means
enabled).
(The ~32 live-Gemini integration tests are gated on OMNIROUTE_API_KEY and skip in CI;
they only 'fail' locally when that key is present without a running server.)
Integrated into release/v3.8.25 — feat(mimocode): per-account proxy for multi-account round-robin (runWithProxyContext per account, keyed by fingerprint). Orphan test relocated to a collected vitest path (14/14 green).
main was fast-forwarded to release/v3.8.25 (#3805); this marker re-opens the
umbrella PR so further v3.8.25 work keeps flowing to main. No version bump —
development continues on the current v3.8.25 line.
Clarifies that the Default Strategy control syncs both new combo defaults and global
account fallback routing, and updates the Round Robin sticky-limit helper text to call
out account-level fallback behavior. Copy-only change to ComboDefaultsTab + en.json.
Integrated into release/v3.8.25.
Co-authored-by: Abhishek Divekar <adivekar@utexas.edu>
