Skill tools were advertised as 'name@version' (e.g. test-fr2@1.0.0), but
DeepSeek/Groq/OpenAI reject function names not matching ^[a-zA-Z0-9_-]+$.
Names already valid are left untouched; invalid ones are reversibly encoded
as omr_skill_<base64url> and decoded in interception before registry lookup.
- skills: Next.js compiles SkillExecutor into multiple chunks (own singleton
each); route chunk lacked builtin handlers registered at startup via
instrumentation. execute() now falls back to builtinSkills registry, so
POST /api/skills/executions works for file_read/web_fetch/etc.
- memory: scheduleVectorUpsert is fire-and-forget and embeddings are slow;
health-check verify (create->delete test memory) left queued upserts
failing with 'memory not found' every 30s. Check existence before embedding
and skip quietly.
searchHybrid in vectorStore.ts runs its own raw FTS5 MATCH — the earlier
retrieval.ts fix missed it, so hybrid queries with punctuation still threw
'fts5: syntax error'. Extracted the sanitizer to src/lib/memory/ftsQuery.ts
(no import cycle) and applied it at all three MATCH sites; punctuation-only
queries now yield a non-matching '""' phrase instead of an error.
- /api/v1/quotas read conn.id/provider/name — the lazy row proxy does not
expose connectionId/providerId, so every connection was skipped and the
endpoint always returned an empty list.
- retrieveMemories/buildFtsRows now sanitize the query into a quoted FTS5
MATCH expression — natural-language queries with ? ! : ( ) etc. no longer
throw 'fts5: syntax error' and silently degrade to empty results.
- new unit test tests/unit/memory/fts5-query-sanitize.test.ts (5 cases).
potion-base-8M has no vocab.json on HuggingFace (404) — the download
silently failed and vector retrieval always fell back to FTS5-only.
Load the token→id map from tokenizer.json (already cached at
<DATA_DIR>/embeddings/potion-base-8M/tokenizer.json) with fallbacks to
vocab.json and line-indexed vocab.txt.
- responseHeaders: promote NVIDIA NIM quota/usage headers (x-nvcf-*,
x-quota-*, x-ratelimit-*) to priority 2 so they survive the 768-byte
upstream header forwarding budget (were previously dropped as priority 3)
- new GET /api/v1/quotas: lists every provider connection with saturation
(0..1), remaining percent, and data source using existing saturation
signals — lets operators check key budgets via API instead of live monitoring
Root cause (reproduced by tests): combo steps edited by an agent in text/SQLite
format used field names the normalizer didn't recognize, so every step was
dropped and the combo became empty in the WebUI builder.
- steps.ts: extractModelField() accepts model/target/name/modelName variants,
used by both getComboStepTarget and normalizeComboStep (fixes {name,provider}
and legacy {id,target,weight} shapes)
- combos.ts: withSortOrder/parseComboRow now return null on malformed stored
JSON instead of throwing, so the WebUI combo list never crashes on a broken
row
- new test: combo-editability-paths.test.ts (7 cases covering baseline, SQLite
INSERT, API text-edit, legacy shapes, malformed JSON)
- chatCore: maxAttempts 1→2 for all providers (previously only model-scope and codex got retries)
- combo.ts: add x-omniroute-attempt response header showing how many attempts were made
- memory/settings: enable memory injection by default (maxTokens 1000) — auto-extraction already wired in chatCore
Claude→Gemini direct translators dropped thoughtSignature, so Gemini 3
tool follow-ups returned 400. Store on the response path, re-attach (or
context-fallback) on the request path, and thread signatureNamespace.
Closes#8979
Stop aliasing canonical `poe` to PoeWebExecutor so API-key requests hit
api.poe.com Chat Completions / Responses / Claude-only Messages instead of
the web GraphQL path that returned HTTP 405.
* fix(ci): five workflow defects, one of them shipping the wrong dmg to Intel Macs
Gaps 31, 19, 16, 30 and 12 of the v3.8.49 process dossier.
## 31 — LIVE BUG: an Intel Mac downloads the ARM dmg
electron-builder runs once per macOS job and each run emits its own
`latest-mac.yml` listing only its own dmg — measured at 338 and 350 bytes,
different content, identical filename. `download-artifact` with
`merge-multiple: true` resolves that collision by ARRIVAL ORDER, so one silently
overwrites the other. arm64 won in the published v3.8.48.
Why that breaks Intel, from electron-updater's own selection code
(out/providers/Provider.js):
files.find(it => [...].some(n => n.includes(process.arch))) ?? files.shift()
The Intel dmg is `OmniRoute-X.Y.Z.dmg` — no arch suffix. On Intel `process.arch`
is "x64", nothing matches, and the fallback takes the FIRST entry. With an
arm64-only manifest that is the ARM build.
So ORDER is the fix, not tidiness: the un-suffixed entry must be first, because
it is the only one reachable through that fallback. `merge-multiple` is now off
(per-artifact subdirectories) and a new
`scripts/release/merge-mac-update-manifest.mjs` merges them deliberately. It
refuses to write when the inputs disagree on version — a manifest stitched from
two builds points at files that were never published together, which is worse
than no manifest.
Validated against the REAL v3.8.49 manifests, not just fixtures: the script
reproduces byte-for-byte the manifest I hand-merged and published, including
both sha512 values and the newer releaseDate.
## 19 — one variable, two opposite machines
`USE_VPS_RUNNER` governed the build and the test jobs together. The build needs
the .113's RAM; the tests need the hosted runner's link. Measured 2026-07-29:
`actions/setup-node` took 20m06s on .113 with 4 concurrent runners versus 16s
hosted (npm cache restore saturating the link), while the tests themselves tied
— 2m54 vs 2m31.
Self-hosted is therefore strictly worse for tests, so rather than add a second
variable to configure, `test-unit`, `test-vitest`, `fast-unit` and `fast-vitest`
are pinned to `ubuntu-latest`. `quality.yml`'s `fast-gates` deliberately keeps
the variable — I have no measurement for it, and guessing is what produced this
gap.
## 16 — a flaky shard sent the publish into the 40-minute build
The artifact reuse filter required `conclusion == "success"` on the whole run, so
any unrelated red shard discarded a perfectly good tree. The artifact is only
uploaded if the Build job succeeded, so its PRESENCE is the accurate signal. Now
it takes the 5 most recent candidate runs and tries each download until one
works. `head_repository.full_name == env.REPO` stays — that clause is the
artifact-poisoning guard, not a filter refinement.
## 30 — the gate that could be bypassed at merge
`check:agent-skills-sync` lived only in quality.yml's PR-only Merge-integrity
job, because the CHANGELOG half of that job needs a base to diff against. This
half does not. Keeping it PR-only left a real hole: this cycle's merge trains
landed with `--admin`, which bypasses required checks, so three SKILL.md files
drifted, rode the release squash into `main`, and the sync-back turned them into
a base-red blocking EVERY PR into release/v3.8.50 until #8954. It now also runs
in ci.yml's lint job, which runs on push to `main`.
## 12 — a cancelled gate reads like a passing one
The dashboard already renders `⚫ CANCELLED` per job, so my dossier entry was
imprecise: they do not vanish, they sit buried mid-table. A cancelled job
reported no verdict at all, and this cycle the Vitest job was cancelled in rounds
1, 2 and 3 — it finished only in round 4, revealing a suite broken the whole
cycle plus two production bugs. The summary now opens with a banner naming every
cancelled job and saying plainly that nothing was checked.
node --import tsx/esm --test tests/unit/mac-update-manifest-merge.test.ts # 11 pass
merge against the real v3.8.49 manifests → both dmgs, Intel first
all four workflows parse; check:workflows --ratchet → 178, baseline 190
* docs(changelog): fragment for #8988
* test(ci): align the artifact-provenance guard with the gap-16 criterion
My own assertion from #8953 encoded the criterion this PR deliberately removes:
it required `.conclusion == "success"` on the whole CI run, which discarded a
perfectly good build tree whenever any unrelated shard went red — pushing the
publish into the 40-minute build the fast path exists to avoid.
Inverted rather than deleted, and the replacement is strictly stronger. It now
pins three things where the old one pinned one: that the loose criterion is gone,
that the step actually probes for the artifact (the accurate signal, since it is
only uploaded when the Build job succeeded), and that it probes MORE THAN ONE
candidate run — without which a single miss still falls back to a full build.
The provenance clause it was originally written to protect
(head_repository.full_name == env.REPO) is untouched and still asserted above.
* fix(ci): finish gap 19 — pin fast-gates and give USE_VPS_RUNNER one meaning
This was left deliberately partial because `fast-gates` had never been measured,
and guessing is what produced gap 19 in the first place. Measured now, and the
evidence is cleaner than expected:
fast-gates, 160 quality.yml runs .... ZERO self-hosted samples
every non-skipped one is "GitHub Actions NNNN"
median duration, 72 successful runs .. 5.6 min hosted
The classifier is not at fault — in the same window ci.yml's Build demonstrably
ran on omniroute-113-7 and omniroute-113-6, so self-hosted runs are visible when
they happen. The USE_VPS_RUNNER expression on this job was dead configuration.
And had it ever fired it would have inherited the measured penalty, because this
job's first two steps are exactly the bottleneck:
actions/setup-node on .113 with 4 concurrent runners .... 20m06s
actions/setup-node hosted .............................. 16s
So it is pinned rather than switched, and the second variable the gap proposed
(USE_VPS_RUNNER_BUILD / _TESTS) turns out to be unnecessary. After this the
variable governs exactly five jobs, all of them build-like:
ci.yml:build · quality.yml:build · npm-publish:publish
nightly-release-green: release-green, main-green
One variable, one meaning: "this job needs the .113's memory". A guard test pins
that — it fails if the variable is ever attached to a test-like job again, and it
also asserts the build KEEPS it, so nobody closes this gap by removing the
variable outright.
node --import tsx/esm --test tests/unit/vps-runner-variable-scope.test.ts # 3 pass
check:workflows --ratchet → 178, baseline 190
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* docs(readme): add Support OmniRoute donate section (PIX live) and rename community section
- Replace bullet '❤️ Support' with a full '💚 Support OmniRoute' table (nowrap pattern):
Star, GitHub Sponsors, Open Collective, Ko-fi, Buy Me a Coffee, Liberapay, PIX, Crypto.
- PIX: dedicated random key + static BR Code (copia-e-cola) + QR (docs/assets/pix-qr.png).
- Rename '📧 Support & Community' -> '📧 Community & Help' to drop the duplicate 'Support';
fix the nav anchor and the 'Support the project' row to point at the new section.
- Open Collective / Ko-fi / Buy Me a Coffee / Liberapay and Crypto still marked as pending.
* docs(readme): wire up Ko-fi donation link (ko-fi.com/diegosouzapw)
* docs(readme): wire up Buy Me a Coffee donation link
* docs(readme): wire up Liberapay donation link
* docs(readme): wire up Open Collective donation link (invoice-issuing channel)
* docs(readme): reorganize top nav into one categorized table + add donate link
- Merge the two loose nav tables under '🧩 Available' into a single labeled table
(Start / Learn / Features / See it / Support / Project), 21 links.
- Surface '💚 Support / Donate' in the nav near the top, next to Community & Sponsors.
- Drop the pre-existing broken '#-dashboard-screenshots' anchor; add '✨ What's New'.
- All 21 in-page anchors verified against github-slugger (0 broken).
* docs(readme): complete crypto donation block (BTC, ETH, USDT-TRC20, USDC-Solana)
- Fill the Crypto <details> with the four wallet addresses (coin / network / address),
replacing XMR with USDC on Solana per owner's choice.
- Update the donate table's Crypto row to 'BTC · ETH · USDT-TRC20 · USDC-Solana'.
- Add a wrong-network warning note.
* docs(readme): label BTC network as Bitcoin (SegWit) for consistency
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* fix(ci): stop the reconciliation range and the fragment sweep from hiding work
Two release-tooling defects found during the v3.8.49 run (gaps 4 and 7 of the
process dossier). Both fail by hiding work rather than announcing themselves,
which is why each one had already cost a real mistake.
## The reconciliation range was 62× too wide
`list-uncovered-commits.mjs` bounded its scan with `git describe --tags`. Releases
reach `main` by SQUASH, so no commit on a release branch is ever an ancestor of the
tag, and `vPREV..HEAD` re-lists the un-squashed history of every earlier cycle.
Measured on release/v3.8.50 @ 7eca04fd12:
v3.8.49..HEAD ....... 1361 commits
cycle open..HEAD ..... 22 commits
The report drowns in noise, and that is how a previous reconciliation let ~200 PRs
through with no CHANGELOG bullet.
The base is now resolved by CONTENT — the oldest commit that introduced this
version string into package.json — deliberately NOT by commit subject, because the
subject has already changed format once:
chore(release): bump v3.8.49 (development cycle version) older
chore(release): open v3.8.50 development cycle current
A message-matching resolver would have silently reverted to the broken tag base the
first time someone reworded the bump. The fallback now writes a WARNING to stderr
explaining that a tag range re-lists previous cycles, so a shallow clone degrades
loudly instead of quietly reproducing the bug. One of the five tests asserts
exactly that the warning says "squash" and "noise".
## The back-merge resurrects fragments that already shipped
The release lands on `main` as one squash commit, so `main` still carries every
`changelog.d/` fragment the reconciliation folded in and deleted. Back-merging
`main` restores all of them — 191 in the v3.8.49 run. Nothing breaks at that
instant; the next aggregation folds them in a SECOND time and the section grows
duplicates that have to be hand-unpicked.
New `scripts/release/sweep-stale-fragments.mjs` (`npm run sweep:stale-fragments`)
reports them, and `--apply` removes them. Report mode exits 1 so the back-merge
step can gate on it.
The identity rule took two attempts, and the second one exists because running the
script against the live repo refuted the first. Matching on any `#N` in the bullet
flagged `changelog.d/features/8980-deprecate-gemini-cli-provider.md` as stale,
because that bullet cites issue **#7034** for context and #7034 shipped in an
earlier cycle — it would have deleted an unreleased fragment and dropped its
credit. A bullet routinely cites issues it merely references; only the
`<PR-number>-<slug>.md` filename says which PR the fragment *is*. That case is now
a regression test.
Every ambiguous case resolves toward KEEPING: no number in the filename falls back
to normalized text, text shorter than 12 chars is never matched, and anything
matching neither is kept. A surviving duplicate is a nuisance someone notices; a
deleted fragment silently costs a contributor their credit.
node --import tsx/esm --test tests/unit/release-cycle-base-resolver.test.ts # 5 pass
node --import tsx/esm --test tests/unit/sweep-stale-fragments.test.ts # 11 pass
node scripts/release/list-uncovered-commits.mjs --json
→ base ed2db6cb19, baseSource "cycle-open", total 22 (was 1361)
node scripts/release/sweep-stale-fragments.mjs
→ 4 fragments, 0 stale, exit 0
* docs(changelog): fragment for #8985
* fix(ci): four quality gates that punished the wrong thing
Gaps 6, 9, 10 and 23 of the v3.8.49 process dossier. Each one either blocked
work it should have waved through, or reported a number that was never the
code's.
## 6 — test-masking is unusable at release scale
My own dossier entry for this was WRONG and the measurement says so:
tracked test files ............ 3977 (I had written 1277)
absolute tautology scan ....... ~1 s (I had written >30 min)
the diff uses base...HEAD three dots — already merge-base
diff vs release branch ........ 0 files, 0 s
diff vs main (today) .......... 3 files, 0 s
The base choice was never the problem, and it cannot be reproduced today at
all: `main` has since received the v3.8.49 squash, so the merge-base is recent.
The pathology only exists DURING a release, in the window before `main` gets the
squash — then the merge-base is the PREVIOUS cycle's fork point and the diff
legitimately spans the whole cycle (~1277 changed test files, each costing a
`git show` process plus a full regex pass). That is the same squash-merge
topology as gap 4, and it is why the check ran twice without finishing.
Fix: above 300 changed test files the per-file diff subchecks are skipped, since
every one of those files was already gated by this check on its own PR. The
absolute tautology scan still runs unconditionally over all 3977 files, so the
floor is untouched. The skip is deliberately loud — a silent skip is gap 12,
which cost two production bugs this cycle. `shouldSkipDiffSubchecks` never skips
on unparseable input, so a broken count cannot disable the gate.
## 9 — a capital letter invalidated 41 translations
`"Reset Defaults"` → `"Reset defaults"` marked the key stale in 41 locales. Every
translation was still correct, and in locales with no letter case the "fix" is
not expressible. Worse, the escape hatch (`__MISSING__:`) is BANNED in `vi` by
tests/unit/i18n-vi-completeness.test.ts, so `vi` had no legitimate way out.
`isCosmeticRewrite` folds case, whitespace runs and trailing punctuation — and
nothing else. Most of the nine tests exist to pin what is NOT cosmetic: a changed
word, an added word, and any edit inside an interpolation like `{count}` all
still flag. Two end-to-end tests hold both directions: a cosmetic edit leaves
every locale alone, a real rewrite still flags all of them.
## 10 — the ratchet compared numbers from two different auditors
`pipx install zizmor` was unpinned, so the runner installed whatever PyPI served
that day and measured 1 finding MORE than the devbox on the identical commit
(190 vs 189) — a second rebaseline push per release, chasing a number that was
never the code's. Pinned to 1.25.2 (what the devbox runs), and
check-workflows.mjs now prints `zizmorVersion=` next to the count so any future
rebaseline is traceable to the tool that produced it.
## 23 — a PR pointed at its own branch
#8912 has head == base == release/v3.8.50: no diff, can never merge, and it sits
in the queue with a full check board on every push to that branch. It survived
because nothing looks wrong — the checks pass, since there is nothing to check.
New guard in the `changes` job (one field comparison, before anything is spent).
The distinction that makes it safe to block on: an equal head/base BRANCH is
conclusive, an equal head/base SHA is NOT — a branch cut moments ago has an
identical tip and is legitimate, so that case warns instead of failing. Half a
signal never fails either.
node --import tsx/esm --test tests/unit/test-masking-release-scale.test.ts # 6 pass
node --import tsx/esm --test tests/unit/ui-value-drift-cosmetic.test.ts # 9 pass
node --import tsx/esm --test tests/unit/pr-self-target-guard.test.ts # 7 pass
check:workflows --ratchet → 178 findings, zizmorVersion=zizmor 1.25.2, baseline 190
the i18n suite is unaffected (5 files re-run, all green)
* fix(ci): allowlist the four CI-only env vars the new gates read
The env-doc-sync gate failed three unit shards plus Docs Gates on this PR, and it
was right to: it requires every `process.env.X` read in code to be documented in
`.env.example`, and this PR introduced four new reads.
They do not belong in `.env.example`. That file is OmniRoute's runtime
configuration; these are CI signals with no meaning in a user's `.env`:
HEAD_REF / HEAD_SHA / BASE_SHA the `changes` job passes github.head_ref,
github.base_ref and the PR head/base SHAs to
the self-targeting-PR guard
TEST_MASKING_MAX_CHANGED_TESTS the escape hatch that raises the test-masking
gate's release-scale skip threshold
So they go in IGNORE_FROM_CODE, which exists for exactly this and already carries
the precedent one line above: `BASE_REF`, allowlisted because CI passes it to the
OpenAPI breaking-change gate. `BASE_REF` being already listed is also why only
four of my five reads failed.
Each entry carries its justification and the script that reads it, per the
allowlist policy.
node --import tsx/esm --test tests/unit/issue-7793-env-doc-sync-repro.test.ts # 1 pass
npm run check:env-doc-sync → all three directions in sync
* fix(i18n): narrow the cosmetic-rewrite exemption to the scope actually reported
The gap-9 fix folded whitespace in addition to case, and that collided with a
pre-existing test which pins the opposite — tests/unit/i18n-ui-value-drift.test.ts,
"a value that only changes whitespace still counts as an edit". Its comment states
the reasoning:
Conservative on purpose: trailing-space churn is rare, and treating it as a
no-op would let a real reword slip through behind an innocuous-looking diff.
That is a documented decision by whoever wrote it. The problem actually reported
was CASE — `"Reset Defaults"` → `"Reset defaults"` invalidating 41 correct
translations — and whitespace was scope I added on my own. Reversing someone
else's reasoned call, silently, to fix something nobody reported is not this
change's job, so the exemption is narrowed to case + trailing terminal
punctuation. No test pins either of those.
The reported case is still fixed, verified end to end: that rewrite invalidates 0
locales. And whitespace is now asserted NON-cosmetic in my own test file too, so a
later tidy-up cannot quietly fold it back in.
node --import tsx/esm --test tests/unit/i18n-ui-value-drift.test.ts # 11 pass (pre-existing)
node --import tsx/esm --test tests/unit/ui-value-drift-cosmetic.test.ts # 10 pass
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* feat(sse): deprecate the gemini-cli upstream provider with a real migration path
Stored `gemini-cli` connections were being kept alive for nothing. Measured before
touching anything:
routable? absent from PROVIDERS, from REGISTRY, from OAUTH_PROVIDERS, and no
executor references it → the connection can NEVER serve a request
refreshing? yes, and successfully — it redeemed against PROVIDERS.gemini's client
(681255809395-oo8ft2o…), the same public Gemini CLI / Code Assist OAuth
client
So the scheduler made periodic upstream calls to Google to keep a credential fresh
that had nowhere to go. That is the waste this removes.
This is a deprecation, not a deletion, and the difference is deliberate. The path was
not dead code: #8232 added it after a user report (the UI advertises automatic OAuth
rotation and these rows never rotated), and #8275 narrowed it to exactly the legacy
refresh. Simply dropping it from `supportsTokenRefresh` would have produced a SILENT
skip — `Skipping … (refresh unsupported)` — leaving the row at "active" forever, doing
nothing. Worse than before.
Instead:
DEPRECATED_PROVIDERS + isDeprecatedProvider/getDeprecationNotice in tokenRefresh
one place naming the provider and where to migrate. A test asserts the migration
target is itself routable, so the notice can never point somewhere useless.
_getAccessTokenInternal returns the ESTABLISHED unrecoverable envelope
{ error: "unrecoverable_refresh_error", code: "provider_deprecated", migrateTo }
Reusing `error` means isUnrecoverableRefreshError and the manual-refresh route
already stop retrying — no new contract for callers to learn. The distinct `code`
is what makes it legible. A bare `null` would read as transient and retry forever.
tokenHealthCheck marks the connection terminal with the reason
Placed after the existing terminal-status guard, which makes it idempotent for
free: once "expired", later sweeps skip the row, so it writes once instead of
rewriting the same reason every cycle.
the manual-refresh route stops lying
It said "Refresh token expired. Please re-authenticate this account." — false
here: the token is fine, the provider is gone. Re-authenticating would loop
against something that no longer exists. It now reports the deprecation and the
migration target.
`gemini` uses the same OAuth client, so re-adding the account there is a working path,
not advice to start over.
Deliberately NOT touched:
Category A — the gemini-cli CLIENT identity (#7034): clientIdentityProfiles.ts,
clientApi.ts, googApiKeyAuth.ts. Same string, opposite direction — requests
ARRIVING from the Gemini CLI, where OmniRoute is the server. Deleting these is the
failure this change must never cause, so a test now asserts the profile survives.
Audited: `git diff --name-only` touches none of those files.
errorClassifier.ts's isCloudCodeProvider list still names gemini-cli. It is a
defensive 403→PROJECT_ROUTE_ERROR list shared with cloudcode/cloud-code; the entry
is unreachable for a non-routable provider, and editing a shared classification
path for a dead string is risk without upside.
Tests — 42 across the six files that mention the identifier, all green:
gemini-cli-legacy-refresh.test.ts 5 (3 assertions REWRITTEN, see below)
gemini-cli-deprecation.test.ts 5 (new)
client-identity-profiles.test.ts 9 (category A, untouched)
service-token-refresh.test.ts 14
errorclassifier-antigravity-403.test.ts 4
gemini-cli-ansi-sanitization.test.ts 5 (category C, untouched)
The three rewritten assertions in the legacy file are alignment, not weakening, and the
gate is right to ask: each is now STRONGER. "refresh succeeds against Google's token
endpoint" became "zero upstream calls happen at all"; "a 400 surfaces invalid_grant"
became "the envelope is unchanged but the code says provider_deprecated" plus a control
asserting `gemini` still reports invalid_grant, proving the real path was not blunted.
The file's header keeps the whole #8232 → #8275 → deprecation arc, because each step is
why the next made sense. Count unchanged; no test deleted, so no allowlist entry needed.
* docs(changelog): fragment for #8980
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* feat(ci): gate the publish on clean-install AND upgrade-over-previous
`check:pack-boot` proves a fresh install boots. It does not prove the path that actually
broke us: installing over an existing version, where ~110 SQLite migrations run against a
populated database. v3.8.48 shipped as a hotfix because the published 3.8.47 crashed on
boot, and the v3.8.49 upgrade path was only ever exercised end-to-end by hand — on VPS .16,
against a real 3.8.48 install with a 165 MB database, AFTER publishing. That is backwards.
New gate (`scripts/check/check-install-upgrade.mjs`), wired into npm-publish.yml as step 12,
BEFORE `npm stage publish` — so a broken upgrade never reaches the registry and a staged
package that is never approved simply expires, with no `npm deprecate` needed:
- Phase A: fresh prefix + fresh DATA_DIR, install the packed tarball, boot, health.
- Phase B: fresh prefix + fresh DATA_DIR, install the PREVIOUS published version, boot it
(creates + migrates the DB), stop, install the tarball over the SAME prefix, boot against
the SAME DATA_DIR. Asserts no table present before the upgrade was dropped.
- Schema convergence, and its DIRECTION is the whole point:
fresh − upgraded ≠ ∅ → FAIL. Structure a clean install creates but an upgrade does not
means every existing user is missing it. Not allowlistable.
upgraded − fresh ≠ ∅ → residue; fails only when NEW (allowlist carries the known ones).
A naive symmetric check would either block every release on harmless residue or, if relaxed,
let the dangerous direction through. Measured on VPS .16 (2026-07-30): a real 3.8.48 install
upgraded to 3.8.49 ended with 117 tables against 116 for a clean 3.8.49 install — the extra
being `cache_metrics`, recorded in config/quality/install-upgrade-allowlist.json with the
measurement. Both installs healthy, zero `no such table` in 150 log lines.
`evaluateConvergence` is exported and pure so the asymmetry is testable without packing,
installing or booting anything (same reason check-test-masking exports its helpers):
tests/unit/check-install-upgrade-convergence.test.ts, 8 cases, ~6ms.
A previous version that fails to boot degrades to a warning — a historically bad publish
must not block the current one. Uses node:sqlite (Node 24, already the publish job's
runtime): no new dependency.
* fix(ci): require the reused next-build artifact to come from this repository
CodeQL raised actions/artifact-poisoning/critical on the `next-build` fast path
this PR builds on (#8941). The finding is real and it sits on the path that
produces the published npm tarball.
The step picks a CI run by querying the runs API for `head_sha` and filtering on
`name == "CI" and conclusion == "success"`. That query also returns
`pull_request` runs from FORKS: they execute in this repository's context and
upload their own `next-build`, built from fork-controlled source. Measured
today, 57 runs in this repo have a `head_repository` other than the repo itself.
So the selection trusted bytes by coincidence of commit SHA — anything that made
a fork's head commit coincide with the publish commit could put attacker-built
bytes on npm.
Adds `and .head_repository.full_name == env.REPO` to the selection. Provenance
is now explicit; `head_sha` still carries tree-equality. Verified against the
live API using the expression extracted from the workflow itself — the same
single run (30518663668) is selected either way for the current tip, so the fast
path keeps working while every fork run is excluded.
Not a dismissal (hard rule #14) — the clause removes the flagged trust.
node --import tsx/esm --test tests/unit/npm-publish-artifact-provenance.test.ts
# 3 pass, 0 fail (base: 2 pass, 1 fail)
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* chore(sse): drop the iflow entry from the token-refresh TTL map
The `iflow` provider was removed from the product, but its 24-hour refresh-lead
entry outlived it in REFRESH_LEAD_MS. Surfaced during v3.8.49 homologation on the
production VPS, where startup logs carry:
[CREDENTIALS] Warning: unknown provider "iflow" in credentials file, skipping.
Measured across src/, open-sse/, tests/ and docs/ — the identifier had exactly two
occurrences repo-wide: the map entry and one test assertion. Nothing dispatches on
it, so `getRefreshLeadMs("iflow")` now falls through to TOKEN_EXPIRY_BUFFER_MS like
any other unknown provider.
The test assertion was not deleted, it was MOVED: from "returns explicit lead time
for known providers" to "falls back to TOKEN_EXPIRY_BUFFER_MS for unknown
providers". That is alignment to the new behavior and strictly more coverage than
before — a silent reintroduction of the entry now turns the fallback case red
instead of passing unnoticed. Flagged explicitly because the test-masking gate
rightly treats a removed assertion as suspicious.
Also removes the now-redundant "Non-rotating providers" section header: every
remaining entry under it is Google-backed and the following comment already says
"permanent (non-rotating)".
node --import tsx/esm --test tests/unit/service-token-refresh.test.ts
# 14 pass, 0 fail
* docs(changelog): fragment for #8966
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
v3.8.49 shipped with ZERO release assets. v3.8.48 had 16. Every gate was green.
Measured from run 30503231362, not inferred:
Build Electron (windows) ....... success
Build Electron (macos-intel) ... success
Build Electron (macos-arm64) ... success
Build Electron (linux) ......... failure
Create Release ................. skipped
Publish to npm ................. skipped
The linux leg died 8 min into "Creating an optimized production build" with
"The runner has received a shutdown signal" and no exit code, on runner
`GitHub Actions 1000378558` — github-hosted, so this was the VM being
reclaimed, not a Node heap error. Reproduced on a 32 GB machine from the exact
tag commit: the same build succeeds and peaks past 18 GB.
Three independent defects compounded, one fix each:
1. Turbopack allocates natively (Rust, off the V8 heap), so the existing
--max_old_space_size=6144 does not bound it. The project already documents
the webpack fallback as the escape hatch for RAM-constrained machines
(docs/reference/ENVIRONMENT.md, #6409), and nightly-compat already applies
it for the same reason on Node 26 (#8090). The linux leg now selects it;
Windows/macOS keep Turbopack since they build fine and it is faster.
2. `release` gated on `needs: [validate, build]` with no `if:`, so ONE failing
leg skipped it and discarded the three artifacts that DID build — 1.7 GB,
still retained — plus the source archives, which depend on no build at all.
Fail-closed made a partial failure look total. It is now fail-partial:
attach what exists, still requiring `validate` to have passed.
3. Nothing asserted the release HAS assets, so 16 binaries and 0 binaries were
indistinguishable to CI. New `verify-desktop-assets` job asserts one asset
per platform and fails loudly.
The check is a separate job on purpose: failing inside `release` would cascade
into `publish-npm` (`needs: [validate, release]`) and block the npm channel
over a desktop-only gap. Now the assets attach, npm still publishes, and an
incomplete desktop channel is a red job instead of silence.
TDD: 3 of the 4 new assertions fail on the tip of release/v3.8.50 and pass
with this change. The 4th asserts a negative (publish-npm must not gain a
dependency on the asset check) and guards against future regression rather
than reproducing the bug.
node --import tsx/esm --test tests/unit/electron-release-desktop-channel-8949.test.ts
# 4 pass, 0 fail (base: 1 pass, 3 fail)
check:workflows --ratchet → 189 findings, baseline 190, no regression
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* chore(ci): remove two fork-owned publish workflows that rode in by accident
Both files publish to a DIFFERENT owner's GHCR namespace, and both arrived as an
unrelated extra file inside an otherwise on-topic PR:
build-fork.yml added by #1528 (scope: SSE translator, Qiwen Chen)
env IMAGE_NAME: ghcr.io/kang-heewon/omniroute
if: github.repository == 'kang-heewon/OmniRoute'
100+ runs instantiated here
build-rinseaid-image.yml added by #8729 (scope: SSE reasoning)
tags: ghcr.io/rinseaid/omniroute:...
no repository guard at all — 0 runs
Neither can ever succeed: this repository's GITHUB_TOKEN cannot write to another
owner's namespace. The cost is not a breach, it is noise. build-fork.yml's guard
sits on the JOB, not the workflow, so GitHub instantiates a run on every push to
main and every v* tag and then skips the job — which is why every release check
board has carried a permanently skipped "Publish Fork Image to GHCR" entry.
build-rinseaid-image.yml never fires because its trigger branch
(`build-k3-reasoning-image`) does not exist in this repo.
Only build-fork.yml was pre-approved (2026-07-30). The second was found while
executing: grepping the workflow directory for registry namespaces turned up
ghcr.io/rinseaid alongside ghcr.io/kang-heewon. Same defect, same remedy, so both
go — easy to split if that is preferred.
Nothing else is touched. Specifically NOT touched: the 14 `kang-heewon` credit
links in CHANGELOG.md (real contributions), their 42 i18n mirrors, and the
historical `- **ci:** update build-fork workflow…` entry from #2055. Measured: 0
of the 14 credit mentions concern build-fork, so no credit line is involved
either way. `git status` shows exactly two deletions and one new test.
TDD — the guard names both offenders before the removal and passes after:
node --import tsx/esm --test tests/unit/workflows-no-foreign-fork-publishers.test.ts
# before: 0 pass, 2 fail → build-fork.yml → ghcr.io/kang-heewon
# build-rinseaid-image.yml → ghcr.io/rinseaid
# after: 2 pass, 0 fail
Zizmor findings drop 190 → 178 (both files use unpinned docker/* and checkout
actions). The baseline is deliberately NOT rebaselined here: the metric direction
is `down` so a drop cannot break the ratchet, tightening it to exactly 178 would
leave zero headroom and self-break on drift, and validate-release-green states
the convention outright — "Any drift above is rebaselined at release, not a
contributor concern."
* docs(changelog): fragment for #8967
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
