- quota-equal-split / quota-summed-budget: drop top-level `await` from test()
registrations. Under --test-force-exit --test-concurrency=4 the awaited
registrations were cancelled mid-module-eval when a sibling's slow SQLite
migration briefly emptied the event loop. No assertions changed.
- proxy-registry-flow: the legacy /api/settings/proxy GET is now a unified bridge
over the new proxy registry; after an atomic create-with-assignment it resolves
to the newly assigned proxy (atomic-flow) and supersedes the legacy config —
assert that instead of expecting null.
- e2e: agent-skills redirect regex now matches the bare /login auth redirect;
memory-qdrant uses the unique heading locator (strict-mode fix); group-b specs
navigate to the real pages / tolerate the auth redirect like sibling specs;
playground-compare checks the toolbar control (Run all|Cancel all) per state.
In checkModelAvailable and handleSingleModelChat, when the combo target's
providerId is merely the prefix already encoded in the model string (e.g. "p2"
from "p2/test-model"), prefer the fully-resolved provider (e.g. the generated
custom node id openai-compatible-chat-e2e-p2) so the executor resolves the
custom baseUrl from the connection instead of falling back to the base provider
(real openai). Intentional providerId overrides (providerId not encoded in the
model string) are preserved.
Also fixes the resilience-http-e2e combo tests (cooldown window + DB-write
visibility for the cooled-down-primary skip).
Two pre-existing failures (release CI never ran):
1. Auth: the /api/compliance/audit-log route now requires management auth
(requireManagementAuth). The test issued bare requests; in CI INITIAL_PASSWORD
makes auth required, so it got 401. Now attaches a signed dashboard-session
cookie via the shared managementSession helper (like sibling management-route
tests).
2. Taxonomy: the test seeded stale action names (provider.added, combo.created)
and treated provider.validation.ssrf_blocked as non-high. Aligned the seed to
real HIGH_LEVEL_ACTIONS (provider.credentials.created, quota.pool.created) so
the level=high filter assertion validates the actual filter.
The "recent" memory strategy maps to the internal "exact" retrieval path, whose
post-query relevance filter (score > 0) silently dropped recent memories whose
text didn't overlap the current prompt. Since the user-facing strategy enum is
only recent|semantic|hybrid (no "exact"), forwarding the prompt as `query` for
"recent" always engaged that filter, so recency-based injection returned nothing
when the prompt was unrelated to the stored memory.
Skip query forwarding for the "recent" strategy so retrieveMemories returns the
most recent memories (ORDER BY created_at DESC) regardless of prompt overlap.
Semantic/hybrid still forward the query for vector search.
Fixes the chat-pipeline + memory-pipeline integration memory-injection tests.
Back-merge to resolve PR #2930 (release/v3.8.8 -> main) conflicts. Release is a
superset of main's features, so all ~44 content conflicts resolved to the
release ("ours") version; generated .source/* dropped.
Reconciliation:
- auth.ts: port #3058 (getProviderSearchPool expands custom provider_nodes
prefixes to internal connection ids) — release lacked this main fix.
- quota-plan-registry.test.ts: align knownProviders() 6 -> 10 (pre-existing
stale assertion vs the registry).
Completes the #3066 fix. Externalizing sqlite-vec unblocked the Turbopack build, but
Next.js does not trace sqlite-vec's platform-specific native package
(sqlite-vec-<os>-<arch>, which ships vec0.so) into .next/standalone — sqlite-vec
resolves it at runtime via require.resolve() (Next.js issue #88844). Result: in the
bundled/Docker build the wrapper loaded but getLoadablePath() threw MODULE_NOT_FOUND,
so vectorStore silently degraded vector/semantic memory to FTS5 keyword search.
build-next-isolated now syncs the sqlite-vec wrapper plus whichever sqlite-vec-<platform>
package npm installed into the standalone output (mirroring the existing better-sqlite3
native-binary handling). Platform-agnostic, so Docker (linux) and Electron (mac/win/linux)
builds all carry their matching vec0.so/.dylib/.dll.
Verified: vec0.so present in .next/standalone/node_modules/sqlite-vec-linux-x64;
createRequire("sqlite-vec") + require.resolve("sqlite-vec-linux-x64/vec0.so") both
resolve from inside the standalone (no FTS5 fallback). build-next-isolated tests 7/7.
Addresses findings from the multi-agent PR review of the #3066 fix:
- manager.stub.ts comments: the previous inline comment claimed the throwing ops
(getMitmStatus/startMitm/stopMitm) are "dynamic-import paths that should never hit
the stub at runtime" — factually wrong: those are static imports too, baked into the
bundled build just like getAllAgentsStatus. Rewrote the file header to describe the
real split — exports with a safe degraded value return it (getCachedPassword/
setCachedPassword/clearCachedPassword → null/no-op, getAllAgentsStatus → []) while
getMitmStatus/startMitm/stopMitm throw STUB_ERROR — and trimmed the inline comment.
Comment-only; no runtime/build change (the export still exists).
- stub-drift guard test: now scans ALL of src/ instead of only src/app —
src/lib/tailscaleTunnel.ts statically imports getCachedPassword/setCachedPassword
from @/mitm/manager and is pulled into routes transitively, so the src/app-only scan
had a false-negative blind spot. Also skips inline `type` imports (erased at build,
need no runtime export) and detects stub exports from declaration AND `export { … }`
forms (no false-positive if the stub later uses class/re-export).
Verified: next-config suite 4/4, typecheck:core / lint clean.
Follow-up to 146244b8f (#3066), addressing optional review suggestions:
- manager.stub.ts: getAllAgentsStatus now returns [] (the truthful "no agents"
state, type-faithful) instead of throwing. Unlike the dynamic-import heavy ops,
this is a STATIC import baked into the Turbopack/bundled build, so it is
legitimately reached at runtime there — returning an empty list degrades
gracefully instead of erroring. (Functionally inert for the existing
agent-bridge/state route, where getMitmStatus already rejects first.)
- next-config.test.ts: the stub-drift guard no longer hard-asserts a specific
symbol (getAllAgentsStatus); the generic ">=1 import found" sanity plus the
missing-exports check remain, so the guard survives an agent-bridge /
traffic-inspector route being renamed or removed.
typecheck:core / lint / next-config suite (4/4) clean. The export still exists,
so the Turbopack build resolution is unchanged.
The Docker image build (`docker compose --profile cli build`) runs `next build`
with OMNIROUTE_USE_TURBOPACK=1 and failed with two Turbopack errors that the
webpack-based VM build never hits — which is why the VM deploy validated but the
Docker build errored (#3066). The reporter's log was truncated before the real
errors; reproducing `OMNIROUTE_USE_TURBOPACK=1 npm run build` locally surfaced them:
1. node_modules/sqlite-vec-linux-x64/vec0.so — "Unknown module type". sqlite-vec
ships a native vec0.so loaded at runtime via createRequire(); Turbopack tried to
bundle the .so. Fixed by adding "sqlite-vec" to serverExternalPackages, exactly
like better-sqlite3.
2. /api/tools/agent-bridge/state statically imports getAllAgentsStatus from
@/mitm/manager, which next.config aliases to manager.stub.ts for the Turbopack
build. The stub did not export getAllAgentsStatus → "Export getAllAgentsStatus
doesn't exist in target module". Added the export (throws like the other heavy
ops — MITM/agent-bridge is non-functional in the bundled build anyway).
Tests (tests/unit/next-config.test.ts):
- assert sqlite-vec is in serverExternalPackages.
- new guard: manager.stub.ts must export every name statically imported from
@/mitm/manager across src/app (catches stub/manager drift — would have caught this).
Verified: OMNIROUTE_USE_TURBOPACK=1 npm run build → EXIT 0 (was: Build error
occurred); webpack build → EXIT 0; typecheck:core / check:cycles / lint clean.
Fixes#3066
Symptom: freshly-added Codex accounts (e.g. davi/gabriel) showed "No quota data"
even when healthy. Root cause: the quota path reuses the access_token without
refreshing rotating providers (#3019, anti Auth0 family-revocation cascade), so a
Codex account whose short-lived access_token has expired can never surface quota
from the sync — the live fetch returns "Codex token expired".
Fix (opt-in, cascade-safe):
- refreshAndUpdateCredentials gains `allowRotatingRefresh` + a pure exported gate
`shouldAttemptRotatingRefresh`. The actual token mint is wrapped in
`serializeRefresh` (one refresh at a time per Auth0 rotation group) — so even N
concurrent per-account requests can never refresh siblings in parallel.
- The BULK scheduler (syncAllProviderLimits, concurrent) keeps the flag OFF →
#3019 fully preserved (guardian test codex-quota-sync-no-proactive-refresh stays
green). Only the on-demand, per-connection path (`GET /api/usage/[connectionId]`)
opts in.
- Frontend: the quota page auto-fetches LIVE on open for the VISIBLE connections
that have no cached quota (scoped to what's on screen — not all connections —
and skips entries already cached), so expired-token Codex accounts surface real
quota automatically and cascade-safely.
Adds unit coverage for the gate (bulk skips rotating, on-demand allows; non-rotating
always eligible). typecheck / lint clean.
The quota-sync path deliberately reuses a rotating-refresh provider's (Codex/
OpenAI/Claude — see refreshSerializer ROTATION_LOCK_GROUP) access_token WITHOUT
proactively refreshing it (#3019, to avoid the Auth0 family-revocation cascade).
When that token is expired the codex usage fetch returns "token expired", and
syncExpiredStatusIfNeeded then flagged the connection testStatus="expired" — a
false-negative: the credential is still valid (expires_at in the future) and the
reactive serialized 401 path refreshes the access_token on next use.
Symptom: freshly-added Codex accounts showed "expired" with no quota on the
quota page, while a providers-page refresh turned them green. They never lost
access — only the quota sync mislabeled them.
Fix: extract the decision into the pure, exported `quotaPathShouldMarkExpired()`
and skip rotating providers (rotationGroupFor !== null). Their status is owned by
the reactive path / connection test, never the quota sync. Adds unit coverage.
E2E testing on the VPS showed a normal key (empty allowedQuotas) could call a
qtSd/<group>/<provider>/<model> virtual model and route through a shared quota
pool — because the quota-exclusive enforcement (Check 3) only ran when
allowedQuotas was non-empty, so an unallocated key fell through to the normal
model checks and qtSd was served. This is the "empty allowedQuotas = all pools"
gap from the redesign.
Add Check 2.9 in enforceApiKeyPolicy: if the requested model is a qtSd model and
the key is NOT allocated to any quota pool (allowedQuotas empty), reject 403
QUOTA_NOT_ALLOCATED. Allocated keys are unchanged (Check 3 still validates scope).
This matches the owner's rule: only a key selected in a pool may use its qtSd
models. Normal (non-qtSd) model access for normal keys is unchanged.
Test: tests/unit/apikeypolicy-quota-only.test.ts — new case asserts a non-quota
key is blocked from qtSd (QUOTA_NOT_ALLOCATED) yet still uses normal models.
The key list stacked many badges in one column (tall/cluttered) and didn't
distinguish quota keys. Now renders two sections — "Normal keys" and "Quota keys"
(purple QUOTA pill) — sharing the same compact table header via an extracted
renderKeyRow(). Quota rows prepend a qtSd-only mode chip + group-name chips
(resolved by fetching /api/quota/pools + /api/quota/groups → poolId→group map).
Empty sections are hidden. i18n en/pt-BR for the new labels.
Source-scan test + i18n parity in api-manager-quota-keys-section.test.ts.
Two bugs made `wscat ws://host/v1/responses` fail with
"Transfer-Encoding can't be present with Content-Length":
1. authz/management policy 401'd the proxy's own internal authenticate/prepare
loopback call to /api/internal/codex-responses-ws (MANAGEMENT-classified, the
per-process bridge secret wasn't recognized one layer up). Added a tightly-scoped
carve-out: isValidWsBridgeRequest() honors a timing-safe sha256 match of
OMNIROUTE_WS_BRIDGE_SECRET (x-omniroute-ws-bridge-secret header) for that exact
internal path; the route still re-validates the secret. → auth now succeeds → 101.
2. On auth failure the proxy spread the internal fetch's response headers onto the
raw upgrade socket — a chunked Transfer-Encoding + Next CSP/route-class headers
collided with writeHttpError's Content-Length framing (and duplicated Content-Type
via a case-mismatched spread). writeHttpError now strips framing + pipeline/security
headers (case-insensitive), and the auth-fail callsite no longer forwards them.
Regression test: tests/unit/responses-ws-proxy-headers.test.mjs (exports writeHttpError;
asserts no TE+CL, single Content-Type, no CSP/route-class leak, safe headers forwarded).
- xiaomi-mimo: token plan is MONTHLY (per platform.xiaomimimo.com/token-plan), so
the seed is now tokens/monthly/4.1B (was weekly).
- deepseek: prepaid in USD — its balance API is already wired (deepseekQuotaFetcher)
and the fair-share engine supports the usd unit (COUNTABLE_UNITS). Seeded a
usd/monthly preset so the limit is set by dollar value.
- minimax: documented the real M3 tiers (Plus ~1.633B/Max ~5.053B/Ultra ~9.796B)
in-comment; EPSILON keeps it manual until tier-aware presets land.
- planRegistry already seeds codex/claude/glm/minimax/kimi/kimi-coding/xiaomi-mimo/
deepseek/bailian/alibaba; PoolWizard 'Limite' step stays editable.
Researched plan structures + the tier-aware-preset follow-up are in the redesign plan.
Claude Code (Pro/Max) is a percentage-of-plan quota (5h rolling + weekly cap,
shared Claude+Code); exact token caps are unpublished/task-variable so percent is
the practical unit. Unblocks the PoolWizard 'Limite' pre-fill for claude pools.
Researched plan structures (codex/claude/glm/kimi/minimax/xiaomi) captured in the
quota-share redesign plan.
- Beta banner scoped to the Quota Share page (functional-but-bugs-expected) with a
pre-filled "open an issue" link (labels quota-share,beta). Page-only.
- Endpoints card now also surfaces POST /v1/responses (codex/github) and the
codex-only WS /v1/responses line (the Responses-over-WebSocket proxy), each gated
on the in-scope provider slug.
- planRegistry: seed xiaomi-mimo (4.1B-token weekly "lite" cap) and kimi-coding so the
PoolWizard "Limite" step pre-fills a fair-share limit for these no-balance-API
providers (fair-share enforces from the proxy's own token count, not an upstream
balance — set the real cap manually in step 2).
- docs(API_REFERENCE): document the codex Responses-over-WebSocket endpoint.
- i18n en/pt-BR for all new keys.
Tracked in _tasks/features-v3.8.8/quota-share-key-redesign.plan.md (codex-WS config
toggle + per-provider balance fetchers + %-quota attribution are planned follow-ups).
The "Available endpoints" card's no-key (default) view generated representative
model ids from a hardcoded PREVIEW_MODELS_BY_PROVIDER map, so providers absent
from that map (claude, xiaomi-mimo, kimi-coding) rendered fake "model-a/b/c"
placeholders. It now fetches the REAL minted qtSd/* combos from /api/combos,
parses them (parseQuotaModelName), and groups by group → provider — falling back
to the placeholder map only when the fetch fails or returns nothing. The per-key
view already showed real models via /api/quota/keys/[id]/models; this aligns the
default view with it.
Verified on the local VPS: an exclusive key (share01) returns ONLY the real qtSd
models of its groups (claudao + chinas) and a non-quota key returns []. The
remaining /v1/models leak (non-quota keys still see qtSd among all models) is
tracked in the quota-key redesign plan.
No-auth / keyless providers (opencode, opencode-zen) returned synthetic
"noauth" credentials BEFORE honoring excludeConnectionIds, so the chat
account-fallback loop re-selected the same synthetic connection forever on
a persistent upstream error (e.g. the opencode public endpoint answering
401 "Model X is not supported"). The synthetic id has no DB row, so
markAccountUnavailable could not persist a cooldown to brake it — each
iteration wrote key-health + request logs immediately, growing the DB until
the disk filled (see @paraflu's "failure #320" trace in discussion #3038).
Honor the exclusion set in both synthetic-credential paths
(getProviderCredentials NOAUTH_PROVIDERS block + opencode-zen keyless
fallback): once "noauth" is already excluded, return null so the handler
stops after a single attempt. The happy path (nothing excluded -> synthetic
noauth) is preserved, so keyless access still works.
Closes#3061.
Tests (TDD): tests/unit/auth-noauth-fallback-loop-3061.test.ts — the two
exclusion cases failed before the fix and pass after; two happy-path guards
ensure first-selection synthetic noauth still resolves.
* fix(sse): defer enqueuing of event lines to align event names with data lines and prevent stop-signal event name misattribution
* fix(sse): preserve keep-alives and prevent pending event leakage on dropped chunks
* fix(sse): preserve pending event lines before other non-data lines and fix zero-window-size bypass
* fix(sse): defer lastEventLine update until after flush check to preserve previous event context on flush
* fix(sse): flush trailing pendingEventLine when stream closes
* fix(sse): preserve consecutive event lines without intervening data
---------
Co-authored-by: Ruslan Sivak <russ@ruslansivak.com>
Remove the Petals executor from registration and exports.
Improve type safety by replacing broad any usage in MCP tool registration
with inferred types and documenting dynamic handler type limitations.
Add request validation for the agent bridge cert route and expand tests to
ensure switch buttons explicitly declare type="button", preventing implicit
form submissions.
Bugs found while testing the Quota Share engine on the local VPS:
- B1 hidden/stuck pools: pools created while the page group filter was "all"
were persisted with group_id="all", matched no real group, and rendered
nowhere — so they could not be seen, edited or deleted. PoolWizard now resolves
the group id away from the "all" sentinel before POST/PATCH (falls back to the
first real group / seed group-demo), and QuotaSharePageClient renders an
"Ungrouped" recovery bucket so already-orphaned pools stay editable/deletable.
- B3 one-connection-per-pool made explicit: existingPoolConnectionIds now spans
every member connection (not just the primary), and the wizard shows which pool
an already-used connection belongs to instead of silently disabling it.
- B4 delete group: wired the missing UI control + handler (handleDeleteGroup,
409-aware) — the backend DELETE handler + deleteGroup already existed. Hidden for
"all" and the protected seed group-demo.
- B5a endpoints card now surfaces the native Anthropic POST /v1/messages line when
a claude*/anthropic provider is in scope (previously only /v1/chat/completions).
- B5b endpoints card gained a collapse/minimize toggle (the card was too tall).
Source-scan tests + en/pt-BR i18n parity in quota-share-bugfixes-v388.test.ts.
The larger quota-key redesign (key type bound to a group, default-restricted with
opt-in normal-model access, recoverable keys, api-keys page layout) is planned
separately in _tasks/features-v3.8.8/quota-share-key-redesign.plan.md.
#3054 ("remove 9 dead/unreachable free providers") removed the petals/nanobanana
configs, registry entries and validators but left dangling references that broke
the build and the unit suite on release/v3.8.8:
- open-sse/executors/petals.ts imported the deleted ../config/petals.ts
(webpack "Module not found" → `next build` failed). Removed the executor, its
registration + re-export in executors/index.ts, and the leftover
`providerId === "petals"` branch in providerAllowsOptionalApiKey.
- Removed tests for the now-deleted providers: executor-petals.test.ts and
poolside-provider.test.ts (REGISTRY.poolside was removed), and the petals /
nanobanana validator assertions in provider-validation-specialty.test.ts,
plus the stale petals catalog assertions in providers-page-utils.test.ts,
proxy-connection-test.test.ts and providers-route-managed-catalog.test.ts.
The image/video/embed registries for nanobanana/replicate/nomic are real and
untouched — only the dead chat/api-key surfaces were removed. 146/146 affected
tests pass; typecheck / build clean.
* chore: remove 9 dead/unreachable free providers
Verified via HTTP probe — API endpoints return 000/404/empty:
- freetheai, enally, replicate, lepton, poolside, nomic
- astraflow, petals, nanobanana (phantom: catalog but no registry)
Also removed from: providerRegistry.ts, validation.ts,
staticModels.ts, imageValidation.ts, open-sse/config/petals.ts
* chore: remove dead astraflow providers
Remove astraflow and astraflow-cn (UCloud) — API endpoints unreachable.
Remaining dead providers (enally, freetheai, nanobanana, replicate,
lepton, petals, poolside, nomic) have working main sites but dead API
endpoints — need API keys. Will remove in follow-up.
* chore: remove 9 dead/unreachable free providers
Removed: freetheai, enally, replicate, lepton, poolside, nomic,
astraflow, petals, nanobanana
All verified as dead via live API probes (000/404/empty responses).
Cleaned from providers.ts, providerRegistry.ts, validation.ts,
staticModels.ts, and imageValidation.ts.
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Audited all 687 commits / 60 release/v3.8.8 PRs since v3.8.7 against the CHANGELOG:
- Added 5 missing Fixed entries: #3052 (heap-pressure auto-calibration),
#3051/#3048 (proxy fail-closed + registry assignments, @terence71-glitch),
#3049/#3046 (session-pool fingerprint rotation + claude-web cf_clearance, @oyi77).
- Credited previously-uncredited contributors: @branben (#2958 scope fix, #2959
Notion context source) and @JxnLexn (per-API-key stream default mode).
- Added an Added entry for the per-API-key stream default mode feature.
- Added the "🏆 Contributors" hall (24 contributors), matching the v3.8.6 format.
Maintainer fix-PRs (#2966–#3030) are intentionally referenced by their original
issue numbers in the body rather than the fix-PR number; @diegosouzapw is in the hall.
Threshold now derives from the live V8 heap ceiling (85%, floor 400MB) instead of a fixed 200MB that sat below the ~260MB app baseline and 503'd every request. Tracks --max-old-space-size across 1GB/2GB/large VPS.
* fix(pollinations): wire session pool + add idle pruning
PollinationsExecutor.getPool() returned null because poolConfig was
never set. Now sets DEFAULT_POOL_CONFIG in constructor so anonymous
requests get fingerprint rotation and 429 cooldown management.
Also:
- Use acquireBlocking() instead of acquire() to wait for available session
- Add startAutoPrune() for periodic idle session cleanup (5min idle timeout)
- Improve execute() error handling with proper finally block
* fix(duckduckgo-web): wire session pool for fingerprint rotation
DuckDuckGoWebExecutor had poolConfig set but never called getPool()
in execute(). Added session acquisition via acquireBlocking() and
merges fingerprint headers into fetch calls for rate limit evasion.
* fix: address PR #3049 review comments
- duckduckgo-web: fix session leak (add finally release), fix race
condition (report status before release), remove duplicate sessionHeaders
- pollinations: fix race condition (move release to finally, report before)
* fix: address all PR #3049 review comments
- duckduckgo-web: add pool reporting on 429/500 early returns (was missing)
- duckduckgo-web: add sessionHeaders to retry fetch on 401/403
- sessionPool: add .unref() to setInterval to prevent keeping process alive
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Real fixes (alerts auto-close on next scan):
- agentSkills/generator: escape backslash before double-quote in YAML
frontmatter so a trailing backslash can't escape the closing quote
(js/incomplete-sanitization #297/#298)
- usage: replace /\s*\(RESTRICTED\)\s*$/ with a non-backtracking literal +
trim (js/polynomial-redos #275)
- i18n/request: skip __proto__/constructor/prototype in deepMergeFallback
(js/prototype-pollution-utility #274)
- scripts/ad-hoc/nvidia diag: log key presence only, never key chars
(js/clear-text-logging #273)
- tests: regression coverage for all three production fixes (YAML round-trip,
proto-pollution guard, RESTRICTED strip + ReDoS timing)
Docs:
- ARCHITECTURE.md: executor count 45->55, OAuth modules 15->16, agy.ts in list
Deploy skills (deploy-vps-*-cc/-cx/-ag): add --legacy-peer-deps (npm v11
peer-dep resolver crashes on the omniroute tree) and replace the
"; pm2 start" that masked a failed install with a proper && chain.
The execute() and testConnection() methods called
normalizeClaudeSessionCookie() which does NOT inject cf_clearance.
Cloudflare pins cf_clearance to TLS fingerprint — without it, requests
get challenged with 403 even with valid session cookies.
Changed both call sites to use normalizeClaudeSessionCookieWithAutoRefresh()
which auto-injects cf_clearance via Turnstile solver when missing.
Fixes: [403]: Claude Web API error:
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Follow-up to the plugins framework (#3041): wires the plugin hooks end-to-end and adds full test coverage.
- Wires `onRequest` / `onResponse` / `onError` hooks into the chat pipeline (`chatCore` now imports from the unified `hooks` registry).
- Loads active plugins on server startup (`pluginManager.loadAll()` in `server-init`) so they survive restarts.
- Ships a `welcome-banner` example plugin (`examples/plugins/`) + test fixture.
- Adds a comprehensive plugin test suite (manifest, db, config, hooks, manager lifecycle, loader IPC, permissions, scanner, welcome-banner e2e).
Integration fixes applied during review:
- `manager.install` now removes an orphaned `destDir` (DB row gone but files left on disk) before the atomic rename, guarded by path containment — it previously failed with `ENOTEMPTY` (a regression surfaced by the new lifecycle test).
- `plugins-db` / `plugins-manager-lifecycle` tests now initialize the DB via the real migration `076` (`getDbInstance`) rather than relying on ambient state, so a missing/renumbered migration fails loudly instead of being masked.
348/348 plugin tests pass; typecheck / cycles clean.
Co-authored-by: oyi77 <14921983+oyi77@users.noreply.github.com>
Integrated into release/v3.8.8. Applied review fixes: moved the SELECT 1 into a pingDb() db helper (no raw SQL in route, Hard Rule #5) + the 503 catch no longer leaks err.message (Hard Rule #12). Thanks @herjarsa!
Integrated into release/v3.8.8. Applied review fixes: moved the SELECT 1 into a pingDb() db helper (no raw SQL in route, Hard Rule #5) + the 503 catch no longer leaks err.message (Hard Rule #12). Thanks @herjarsa!
Integrated into release/v3.8.8. Docker /app/data permission check is now warn-only (no exit 1 crash-loop on first run) + UID hint uses $(id -u):$(id -g). The mcp-tools-43.svg part was already in the release. Thanks @wussh!
Integrated into release/v3.8.8. The DuckDuckGo noAuth bypass + OpenCode free-model refresh were already integrated earlier (you're credited in CHANGELOG); this squashes your branch in for the Merged badge. Thanks @NekoMonci12!
Integrated into release/v3.8.8. macOS Electron window-chrome: tray icon template + draggable header region (excludes interactive controls) with a safe fallback + MutationObserver cleanup. Squash-merged (drops the AI co-author trailers per repo policy). Thanks @bobbyunknown!
