Increase PBKDF2 iterations for federation auth and server API key
hashes to better resist brute-force attacks and keep hashing behavior
aligned across leaderboard, score, and server connection flows.
Regenerate auto-generated docs entries for the Kiro setup,
gamification, and dashboard shakedown guides.
* fix(cli-tools): guard modelId type before calling indexOf
E2E shakedown v3.8.0: cli-tools quebrava com TypeError quando dynamicModels
continha entradas sem .id (objeto retornado diretamente em vez de string).
* fix(offline): avoid SSR/CSR hydration mismatch on navigator.onLine
Replace useState+lazy-initializer with useSyncExternalStore so the server
snapshot (() => false) and client snapshot (() => navigator.onLine) are
declared separately. React hydrates with the server value and switches to
the real online status client-side without a mismatch.
* chore(i18n): add missing en.json keys for translator, cli-tools, memory, onboarding
Adds 58 missing keys identified by the new dashboard audit script:
- cliTools: 18 custom CLI builder keys (CustomCliCard)
- translator: 24 keys covering stream transformer, live monitor, test bench
- memory: 12 health/pagination/dialog keys
- onboarding.tier: 8 keys for the tier tour walkthrough
Also adds scripts/i18n/audit-dashboard-pages.mjs which scans all dashboard
pages, reports t() calls referencing missing en.json keys, and flags
candidate hardcoded JSX/attribute strings.
* chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 1)
Subagents refactored 8 high-impact dashboard pages, replacing 81 of the
407 hardcoded English/PT strings flagged by the audit with proper
useTranslations() lookups. Added 73 corresponding keys to en.json across
the home, apiManager, providers, settings, and usage namespaces.
Pages affected:
- BudgetTab (27 → 0)
- HomePageClient (2 → 0)
- RoutingTab (25 → 7)
- ResilienceTab (38 → 18)
- SystemStorageTab (42 → 21)
- providers/[id] (17 → 15)
- ApiManagerPageClient (14 → 13)
- OneproxyTab (13 → 10)
Also adds two helper scripts:
- scripts/i18n/extract-keys-from-diff.mjs — extracts new keys from git diff
- scripts/i18n/merge-keys.mjs — merges a pending-keys JSON into en.json
Remaining hardcoded strings will be addressed in follow-up rounds.
* chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 2)
Continues round 1 (commit 8d34f4c65). Round-2 subagents refactored
additional dashboard pages, replacing 77 more hardcoded strings with
useTranslations() lookups. Added 79 corresponding keys to en.json
across the a2aDashboard, agents, analytics, apiManager, cliTools,
common, and settings namespaces.
Pages affected:
- a2a/page (new useTranslations + 6 keys)
- agent-skills/page (new useTranslations + 9 keys)
- AutoRoutingAnalyticsTab (new useTranslations + 6 keys)
- AppearanceTab (8 → 6 remaining)
- OneproxyTab (10 → 0)
- ResilienceTab (18 → 0 missing key)
- RoutingTab (7 → 0 missing key)
- VisionBridgeSettingsTab (new useTranslations + 6 keys)
- CopilotToolCard (7 → 0 missing key)
- ApiManagerPageClient (13 → 0 missing key)
- gamification/admin (new useTranslations + 7 keys)
Hardcoded total: 326 → 249. Real missing keys: 0 (the 6 still flagged
are false positives in exampleTemplates.tsx where t is passed as a
parameter — keys exist at translator.templatePayloads.*).
* chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 3)
Round-3 subagents and manual edits refactored 9 more dashboard pages
(plus 2 small extras), replacing ~80 hardcoded strings with
useTranslations() lookups. Added 79 corresponding keys to en.json
across analytics, cloudAgents, combos, common, health, settings, and
usage namespaces.
Pages affected:
- analytics/ComboHealthTab (new useTranslations + 15 keys)
- analytics/CompressionAnalyticsTab (new useTranslations + 11 keys)
- settings/SystemStorageTab (21 → 0 missing key)
- tokens/page (new useTranslations + 13 keys)
- usage/BudgetTab (9 missing fixed)
- health/page (manual: 6 keys)
- cloud-agents/page (manual: 3 keys)
- combos/page (manual: 1 key)
Hardcoded total: 249 → 164. Real missing keys: 0 (6 remaining are
exampleTemplates.tsx false positives).
Also adds scripts/i18n/build-pending-from-missing.mjs which reads
_audit.json and locates English values from HEAD to rebuild
_pending-keys.json after race-condition resets between subagent edits.
* chore(i18n): localize remaining dashboard settings labels
Replace hardcoded labels in compression and resilience settings with
translation lookups to continue the dashboard i18n cleanup.
Add the v3.8.0 dashboard shakedown runbook to document the manual
smoke-test process and known dev environment pitfalls.
* chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 4)
Round-4 subagent + manual key-resolution refactored remaining strings in
3 high-traffic settings/API tabs, plus extracted English values for
keys that were already added as t() calls but lost during the previous
en.json race-condition resets.
Pages affected:
- api-manager/ApiManagerPageClient (7 → 0 missing key)
- settings/CompressionSettingsTab (8 → 0 missing key)
- settings/MemorySkillsTab (8 → 0 missing key)
- settings/ResilienceTab (4 more keys recovered)
Hardcoded total: 164 → 140. Real missing keys: 0 (6 remaining are the
exampleTemplates.tsx false positives — t passed as parameter).
* chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 5)
Round-5 agent began processing the remaining smaller dashboard files.
Added 5 more keys to en.json for providers/[id]/page.tsx OAuth flow
labels and the cross-OS auto-detection hint.
Pages affected:
- providers/[id]/page.tsx (5 keys)
Hardcoded total: 140 → 136. Real missing keys: 0.
* chore(i18n): resolve last 2 missing providers/[id] keys
Adds providerDetailMyClaudeAccountPlaceholder and
providerDetailPathAutoDetected — the final user-visible labels in the
providers/[id] page that the round-5 subagent rewrote to t() calls
without yet adding to en.json.
Real missing keys: 0 (6 remaining are exampleTemplates.tsx false
positives — t is passed as a parameter so the audit cannot resolve the
namespace; keys do exist at translator.templatePayloads.*).
* chore(i18n): replace hardcoded UI text with t() calls across dashboard (round 6 — 10 parallel agents)
Round-6 dispatched 10 parallel subagents covering all 57 remaining
dashboard files. Each agent worked on a disjoint file set to avoid
en.json race conditions. Added ~60 new i18n keys across 9 namespaces
covering small UI labels, table headers, search placeholders, and
empty-state messages.
Major changes:
- analytics: SearchAnalyticsTab, ProviderUtilizationTab, DiversityScoreCard, CompressionAnalyticsTab (new useTranslations + keys)
- batch: BatchDetailModal, BatchListTab, FileDetailModal, FilesListTab (new useTranslations + keys)
- settings: CliproxyapiSettingsTab, PayloadRulesTab, ModelCooldownsCard, AppearanceTab, PricingTab (mostly new useTranslations)
- endpoint: TokenSaverCard, ApiEndpointsTab, EndpointPageClient
- cache: CachePerformance, IdempotencyLayer, ReasoningCacheTab, MediaPageClient, page
- combos: IntelligentComboPanel, page
- playground: ChatPlayground, SearchPlayground
- providers: ProviderCard
- onboarding: TierFlowDiagram
- changelog: ChangelogViewer
- home: ProviderTopology, TierCoverageWidget, BootstrapBanner, BadgeToast
- usage: BudgetTab, BudgetTelemetryCards, QuotaTable
- quotaShare: QuotaSharePageClient
- profile: page
- leaderboard: page
- skills: page
Hardcoded total: 131 → 60. Real missing keys: 0 plus 1 false-positive
for combos.modePack (lookup via prop-passed t).
* chore(i18n): finalize round-6 keys for batch/cache/endpoint/usage
Adds the remaining keys produced by parallel agents A4, A6, A8, A9:
- common: batch-related labels (BatchDetailModal, BatchListTab,
FileDetailModal, FilesListTab, page) + profile/leaderboard
- cache: hit rate, latency, retry, avg chars
- endpoint: token saver, API endpoints, copy URL, cloud/local labels
- usage: noSpend, activeSessions, quotaAlerts, budget timing
- skills: install/marketplace/filter
- proxyRegistry/quotaShare/mcpDashboard: misc labels
Hardcoded total: 60 → 48. Real missing keys: 0 (modePack remaining is a
false positive — combos.modePack exists but the audit can't resolve it
since IntelligentComboPanel receives t as a prop).
* fix(playground): dedupe filteredModels to avoid duplicate React key warning
The /v1/models endpoint can return the same model id twice (e.g., when a
model is listed by both an alias and its canonical provider), which made
the <Select> emit two <option> elements with the same key — triggering
"Encountered two children with the same key, codex/gpt-5.5".
Replace the chained filter + map with a single pass that skips ids
already added.
* fix(playground): guard against non-string model ids before .split/.startsWith
The /v1/models endpoint can include synthetic entries (combos, locals,
in-progress imports) with a null/undefined id. The playground used to
call m.id.split("/") in the provider-discovery loop, which threw on the
first non-string entry; the surrounding .catch(() => {}) silently
swallowed the error, so the provider/model/account dropdowns ended up
empty even though /v1/models returned thousands of valid entries.
- Skip entries without a string id before split/startsWith.
- Log the rejection in the .catch handler so future regressions are
visible in DevTools instead of silently emptying the UI.
* fix(playground): guard ChatPlayground filteredModels for non-string ids
Same root cause as commit 49fe356b9: ChatPlayground filtered models
with m.id.startsWith(...) which crashed on null/undefined ids returned
by /v1/models (synthetic combo entries). Apply the same defensive guard
and dedupe used in the parent page.
* fix(claude): drop orphan tool_result after fixToolAdjacency strip (discussion #2410)
Discussion #2410 reports Claude returning 400 for sequences like:
assistant: tool_use(id=X)
user: <plain text> ← breaks adjacency
user: tool_result(id=X)
The previous round added `fixToolAdjacency` (commit 44d9abac9) which
correctly strips the orphan tool_use from the assistant message. But
that left the now-unmatched tool_result intact, so the upstream
rejected the request with:
messages.N.content.M: unexpected `tool_use_id` found in `tool_result`
blocks: X. Each tool_result block must have a corresponding tool_use
block in the previous message.
Fix: after running `fixToolAdjacency`, re-run `fixToolPairs` to drop
the orphaned tool_result blocks. All three call sites updated:
- contextManager.purifyHistory (both inside the binary-search loop
and the final pass)
- BaseExecutor message-prep (Claude path)
- claudeCodeCompatible request signer
Also tightens an unrelated dynamic-key access in
readNestedString (claudeCodeCompatible) to satisfy the prototype-
pollution scanner triggered by the post-tool semgrep hook.
* fix(mitm): point runtime manager re-export to js entrypoint
Use the emitted `.js` path for the runtime manager re-export so dynamic
runtime loading resolves correctly outside the Turbopack alias handling.
* docs: add AgentRouter setup guide (#2422)
Integrated into release/v3.8.0 — AgentRouter setup guide docs.
* feat: add new feature on combos - falloverBeforeRetry (#2417)
Integrated into release/v3.8.0 — falloverBeforeRetry for per-model quota skipping in combos.
* feat(batch): implement 10 feature requests harvested (#2414)
Integrated into release/v3.8.0 — batch of 10 feature requests: llama.cpp local provider, upstream error exposure, Termux detection, providers rotate CLI, t3.chat web skeleton, Zed Docker integration, Kiro multi-account OAuth isolation, auto-combo cost blending, auto-combo context filter, combo provider-level exhaustion tracking (#1731). Conflicts with #2417 (falloverBeforeRetry) resolved.
* fix(gamification): resolve SQL bug, auth gap, pagination, and anomaly scoring (#2421)
Integrated into release/v3.8.0 — 6 critical gamification bug fixes: SQL SELECT in checkActionCountBadges, federation auth enforcement, leaderboard pagination offset, real z-score computation, addXp level calculation, and barrel index.ts
* docs(changelog): add post-release entries for #2414#2417#2421#2422
- feat(batch): T3-Chat-Web executor, exhaustedProviders set (#1731), Zed Docker
- feat(combos): falloverBeforeRetry + setTry loop (#2417 — @hartmark)
- fix(gamification): SQL SELECT bug, federation auth, pagination, z-score (#2421 — @oyi77)
- docs: AgentRouter setup guide (#2422 — @leninejunior)
* fix(security): resolve CodeQL random/password-hash alerts and sync docs & tests
---------
Co-authored-by: diegosouzapw <diego.souza.pw@gmail.com>
Co-authored-by: Lenine Júnior <lenine@engrene.com.br>
Co-authored-by: Markus Hartung <mail@hartmark.se>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
`bun add -g omniroute` (and any runtime that does not reliably run the
better-sqlite3 postinstall script) leaves the *.node binary undownloaded.
The `bindings()` loader then throws "Could not locate the bindings file"
BEFORE any DLOPEN happens, which the previous detector missed — the user
saw a generic 500 page instead of the friendly "Run npm rebuild
better-sqlite3" guide.
Extended isNativeSqliteLoadError() to recognise:
- "Could not locate the bindings file" (bindings module preflight)
- "Cannot find module 'better-sqlite3'" (package not even installed)
- code === "MODULE_NOT_FOUND" (Node loader fallback)
isNativeSqliteLoadError is now exported so tests can pin the contract; the
detector covers both the "wrong NODE_MODULE_VERSION" and "binary never
shipped" failure modes operators have hit in practice.
The kilocode provider uses OAuth device flow + direct HTTPS to api.kilo.ai
and never depends on the local kilocode CLI binary at runtime. The connection
test was hard-failing with "Local CLI runtime is not installed" even when the
OAuth token itself was perfectly valid, blocking all kilocode setups on hosts
where the CLI binary was not also installed.
Removed kilocode from CLI_RUNTIME_PROVIDER_MAP and extracted the constant to
a dedicated module so unit tests can pin the contract without dragging the
full Next.js route + DB initialization into the test runtime.
CLI Tools integration (/api/cli-tools/kilo-settings, used to configure the
Kilo VSCode extension to point at OmniRoute) keeps its own runtime check
since it actually does need the CLI binary to be present.
Remove the unsupported `timelineItems` field from `ghIssueView`, add
`ghPrSearchOpen` wrapper, and synthesize `issue.timelineItems` in the
main loop so `classifyIssue` stays unchanged.
Sync body of .agents/skills/implement-features/SKILL.md and
.claude/commands/implement-features-cc.md with the canonical
.agents/workflows/implement-features-ag.md (Phase 0 pre-flight
triage + comment templates already applied in the workflow file).
SKILL.md Codex Execution Notes section preserved.
Closes the gap between the v3.8.0 cut (PR #2323) and the current state of
release/v3.8.0 by listing 24 PRs that landed after the initial release and
crediting every contributor that was missing from the Hall of Fame table.
Added entries cover:
- 4 security hotfixes (CodeQL #243-247 + Kiro Google OAuth)
- 4 dependency bumps (mermaid, electron, prod/dev groups)
- 9 dashboard/CLI/codex features
- 3 Claude/OAuth fixes
- README acknowledgment restore
Extended Hall of Fame credits new contributors @terence71-glitch, @TF0rd,
@slider23, @t-way666, @Rikonorus, @8mbe and updates PR tallies for
@oyi77, @backryun, @thepigdestroyer, @mrmm, @dhaern, @hartmark, @gleber,
@congvc-dev, @herjarsa, @payne0420, @InkshadeWoods.
CodeQL re-flagged the HMAC variant from #2394 at high severity (#247) —
its data-flow analysis still sees an OAuth bearer reaching .update(token)
and applies js/insufficient-password-hash, regardless of whether the hash
primitive is createHash or createHmac.
Stop hashing the token at all. The session-pool Map is keyed by the
token verbatim, falling back to "anonymous" when the input is missing
or empty. This is safe because:
- The token is already held in CopilotSession.cookies for every pool
entry, so the Map key adds no new in-memory exposure.
- The pool is bounded by MAX_POOL_SIZE with LRU eviction, so memory
stays bounded regardless of how many distinct tokens appear.
- bcrypt/scrypt/argon2 — the only forms CodeQL accepts here — are the
wrong tool, since their slowness exists to thwart brute-force of
low-entropy human passwords we do not have.
Tests
- Replace the "16-char hex" shape assertion with verbatim-equality
assertions and an explicit "empty string → anonymous" case.
- Keep the regression guard that fails if anyone ever re-introduces
createHash/createHmac on the token (catches the alert reappearing
before CodeQL does).
- 16/16 copilot-web tests pass.
CodeQL re-flagged the SHA-256 inside sessionPoolKey at high severity even
after the rename/dedup in #2391 — its data-flow analysis still tracks the
OAuth bearer (accessToken → token) into createHash and applies the
js/insufficient-password-hash rule. Bcrypt/scrypt/argon2 would be wrong
here (the input is a high-entropy bearer, not a low-entropy human password
that needs brute-force protection).
Switch to HMAC-SHA-256 with a process-scope key generated at startup
(randomBytes(32)). HMAC is a MAC primitive, not a password hash, so the
CodeQL rule no longer applies; uniqueness, determinism-within-process,
and the 16-char hex shape all still hold, and as a small bonus an
off-process attacker can no longer precompute pool keys from a token
alone.
Tests
- Replace the "exact SHA-256 prefix" assertion with shape/uniqueness
checks and a regression guard that fails if the implementation ever
reverts to plain createHash.
- All 15 copilot-web tests pass.
Re-adds the "Special thanks to 9router by decolua" line at the top of the
Acknowledgments section. The reference was present through v3.7.x and was
inadvertently dropped during a docs cleanup; OmniRoute is a TypeScript
rewrite that originally built on 9router's design, so this credit belongs
alongside the other "inspired-by" entries (CLIProxyAPI, Caveman, RTK).
#243 (js/request-forgery, high) — providers/bulk/route.ts
- Replace `fetch(\${origin}/api/providers/validate)` (where origin came from
spoofable `new URL(request.url).origin`) with a direct in-process call to
validateProviderApiKey. Eliminates the SSRF vector and the HTTP round-trip
through the same app.
- Resolve proxy once outside the loop and reuse via runWithProxyContext.
- Drop now-unused passthroughAuthHeaders helper.
#244 (js/resource-exhaustion, warn) — copilot-web.ts::solveHashcash
- Clamp upstream-supplied `difficulty` to [1, 8] before `"0".repeat(difficulty)`
so a malicious/buggy server can't force a huge prefix allocation or push the
10M-iteration loop into effectively unbounded work.
#245 (js/insufficient-password-hash, warn) — copilot-web.ts::getSession
- Dedupe the inline `createHash("sha256").update(accessToken)` call by reusing
the existing sessionPoolKey helper.
- Rename its parameter from `accessToken` to `token` and document that the
input is a high-entropy OAuth bearer used only as an in-memory Map key —
bcrypt/scrypt/argon2 would be incorrect here, and SHA-256:16 is an
appropriate fingerprint per docs/security/PUBLIC_CREDS.md.
Tests
- Export solveHashcash and add unit tests asserting it returns null for
out-of-range / non-integer difficulty and produces a numeric nonce for the
common difficulty=1 case.
- All 26 tests in copilot-web-executor.test.ts and providers-bulk-route.test.ts
continue to pass; sessionPoolKey contract (SHA-256:16) preserved.
