7 Commits

Author	SHA1	Message	Date
Diego Rodrigues de Sa e Souza	36abd86929	fix(ci): clear the 08-08 base-red layers — dead-code, prod crash in chat.ts, Responses payload regression, born-red stdio test, gate drifts (#9757) ... * fix(ci): drop unused RadarReferrals type export — dead-code ratchet back to 227 baseline The radar referral-links feature (#9697) exported the inferred type RadarReferrals from feedSchema.ts but nothing imports it (the singular RadarReferral is the consumed type). knip counts it as a new dead export, pushing the dead-code ratchet to 228 > 227 and failing Fast Quality Gates on every PR born after the merge. RadarReferralsSchema itself stays — it is used by RadarFeedSchema. Refs #9737 * fix(ci): clear the 08-08 base-red layer — prod crash in chat.ts, Responses API payload regression, born-red stdio test, gate drifts Six independent base-reds from the 08-07 evening merge batch, each verified against the pure release/v3.8.50 tip: - src/sse/handlers/chat.ts: #9467's squash carried a refactor hunk that renamed the all-rate-limited breaker guard to an UNDEFINED variable (isAllRateLimited) — a production ReferenceError on the all-accounts-429 path (chat.ts is outside typecheck:core scope, so only tests caught it). Restore credentials?.allRateLimited. Guard: chat-rate-limit-body-lock (2/2), also un-breaks batch_api and chat-combo-live-test. - open-sse/utils/stream.ts: #9315 switched providerPayload summaries to the accumulated responseBody, but in passthrough paths that body is synthesized in chat-completion shape — Responses API lost its `response` object in the dashboard payload. Keep the events-derived summary for OPENAI_RESPONSES only. Guard: stream-utils + stream-collector-9315 suites (51/51). - tests/unit/mcp-stdio-json-purity.test.ts: born red — the full CLI chain takes ~10s (2x tsx import + DB init) and the test slept a fixed 4s. Poll for the first stdout line with a 60s deadline instead. - tests/unit/plugins-route-error-sanitization.test.ts: register #9445's new marketplace/install route in PLUGIN_ROUTES (route already sanitizes) (33/33). - tests/unit/provider-models-route-codex.test.ts: realign pinned GPT-5.6 input limit to #9432's deliberate 272000→922000 bump (7/7). - lint: fix 11 no-explicit-any errors in repro-9630 + specialty-9293 tests, prune 1 orphaned suppression, allowlist the opencode-ai devDependency (#8869, publisher-verified), and reword a doc line the fabricated-docs gate misread as an env var. Gates re-verified locally: lint:json --max-warnings 0 exit 0, dead-code 227, typecheck:core clean, check:deps OK, check:fabricated-docs OK. Refs #9737 * fix(ci): clear the third 08-08 base-red layer — invalid ru rule pack, stale event pin, orphaned UI repro test, pack/mutation/file-size drifts Follow-up to the previous layer: the serial fast-gates chain unmasked one more stratum after file-size/dead-code went green, all verified against the merged release/v3.8.50 tip: - compression rules ru/ultra.json (#9581): two rules shipped minIntensity "notes", which is not a valid CavemanIntensity (lite|full|ultra) — loading ANY language pack list threw and killed the rtk-loader suite. Mapped both to "ultra" (they are the most aggressive punctuation/case rules, matching the en pack tiers). 2/2. - plugins-welcome-banner-e2e: #9668 added the onStreamComplete builtin event (real emission path via runOnStreamCompleteHooks) and missed this pinned-list sibling. 35/35. - tests/unit/free-pool-frontend-repro (#9046): landed as .tsx with node:test semantics — no runner collects tests/unit/*.tsx, so it NEVER ran (test-discovery NEW-orphan). It contains zero JSX; renamed to .test.ts so the unit runner's existing glob collects it. 5/5 (first real run). - pack-policy: allow + require bin/mcpStdioConsoleGuard.mjs (#9281) — it is preloaded via node --import by bin/mcp-server.mjs, so a published artifact without it crashes 'omniroute --mcp' at startup. - stryker.conf.json: add 5 covering unit tests from the batch (#8779/#9204/ #9330/#9630/openrouter-passthrough) to tap.testFiles (--strict drift). - file-size-baseline: consolidate the base-drift rebaseline for the 12 files grown by the 08-06..08-08 batches (#9616's entries never reached the base; measured on this branch's tree — this PR's own source edits add zero lines to any frozen file). Local battery: file-size/deps/test-discovery/mutation/pack-policy/dead-code/ duplication/docs-all/secrets/vuln/workflows ratchets all exit 0; full lint gate --max-warnings 0 exit 0. Refs #9737 * fix(types): clear the 3 uncovered open-sse-typecheck regressions + realign combo skip-code siblings Fourth base-red layer unmasked by the serial gates. The other 4 typecheck regressions (codex.ts, kiro.ts, tierResolver.test.ts, translator/index.ts) already have dedicated open [TS7] PRs (#9748/#9753/#9742/#9747) — not duplicated here. This commit covers only what no open PR owns: - devin-agentic/serializer.ts TS2367: drop the dead 'role === "system"' branch — the guard above already narrows role to user|assistant (system throws unsupported_role). Devin suites 104/104. - raycast.ts TS2416: the buildHeaders 'override' never matched the base signature (2nd param is the signed payload string, not the stream boolean) — renamed to a private buildRaycastRequestHeaders helper so a polymorphic buildHeaders(credentials, true) call can never bind here. - modelMetadataRegistry.ts TS2352: PricingByProvider → nested-record cast now goes through unknown (shape is runtime-guarded by findInsensitive). - combo-routing-engine.test.ts: realign 2 pre-dispatch-skip expectations to #9630's deliberate ALL_TARGETS_SKIPPED contract (87/87). Refs #9737 * fix(ci): clear the fifth 08-08 base-red layer — reasoning-placeholder contract sweep, GPT-5.6 limits sweep, vi key parity The 08-08 merges (#9610 reasoning replay, #9432 GPT-5.6 limits, #9630 combo skip codes, #9336 provider key links) each changed a contract and left sibling tests pinning the old one. Full grep sweep per contract, not just the shard that happened to go red: - reasoning placeholder (#9573/#9610): the fix DELIBERATELY removed NON_ANTHROPIC_THINKING_PLACEHOLDER injection on cache miss — the model echoed the placeholder as its own reasoning (empty stop) and re-poisoned cache + client history; DeepSeek's 400 is specific to an EMPTY STRING, not an absent field. Realigned reasoning-cache (2 cases, renamed to describe omission) + tool-request-sanitization (1 case + dead import). 60/60. - GPT-5.6 Codex limits (#9432, 272000 -> 1050000 ctx / 922000 input): realigned vscode-token-routes-gpt56 (2) + vscode-token-routes (3). 43/43 together with t23-t24. - combo skip codes (#9630): t23-t24-fallback-resilience T24 now expects ALL_TARGETS_SKIPPED like the combo-routing-engine siblings. - vi.json key parity: #9336 added providers.getApiKey/getApiKeyDescription to en.json without syncing vi (the only locale with a parity gate). Translated both; providers block reordered to match en key order. 5/5. - pack-artifact-policy.test.ts: sibling of this PR's own required-paths change (bin/mcpStdioConsoleGuard.mjs). 10/10. - combo-routing-engine.test.ts: dropped the 6 comment lines added in the previous commit so the frozen test file-size stays at its baseline (the rationale lives in that commit message, not the test body). Gates: file-size, test-discovery, mutation-test-coverage, pack-policy, open-sse-typecheck, dead-code all exit 0. Refs #9737 * fix(translator): keep the reasoning_content placeholder for Xiaomi MiMo — #9610 traded one live 400 for another The xiaomi-mimo replay test (9router#1321) went red on the base after #9610 removed the NON_ANTHROPIC_THINKING_PLACEHOLDER injection globally. That test is NOT stale — it guards a documented upstream 400 ('Param Incorrect: The reasoning_content in the thinking mode must be passed back to the API'), so realigning it would have masked a reintroduced production bug. Two real bugs conflict here: - #9573: forwarding the placeholder makes the model continue its chain of thought FROM that text (echo -> empty stop) and re-poisons cache/history. - 9router#1321/#1337: omitting reasoning_content on a plain replay turn makes Xiaomi MiMo reject the request outright. #9610's evidence for omitting is provider-specific — it verified that deepseek-v4-flash accepts an ABSENT field. It does not extend to MiMo. So the omission stays for every provider #9610 covered, and the placeholder survives the cache miss only for xiaomi-mimo (new requiresReasoningContentPresence predicate next to isReasoningOnlyReplayTarget). The echo that comes back is still stripped on the way in by isInternalReasoningPlaceholder(), so #9573's cache/history poisoning stays fixed for MiMo too. Both contracts now hold simultaneously: xiaomi-mimo replay + reasoning-cache + tool-request-sanitization 61/61; placeholder-strip/responses/translator/combo regression sweep 168/168. Gates: file-size, open-sse-typecheck, dead-code, mutation-test-coverage exit 0; typecheck:core clean. A live check on the VPS (Hard Rule #18 path 2) is the only way to confirm the DeepSeek half of #9610's empirical claim; flagging it in the PR rather than widening this fix on speculation. Refs #9737 * test(translator): pin the reasoning-placeholder provider scope so neither half of the conflict can silently re-break #9610 removed the placeholder globally on the strength of ONE provider's observed behavior (deepseek-v4-flash accepting an absent reasoning_content), which re-opened the MiMo 400 (9router#1321). The previous commit scoped the placeholder to xiaomi-mimo; this pins BOTH directions in one test so the next global edit fails loudly instead of trading the bugs again: - xiaomi-mimo plain replay turn, cache miss -> reasoning_content present (narrowing the scope away from MiMo re-opens 9router#1321) - deepseek plain replay turn, cache miss -> reasoning_content absent (widening it back to DeepSeek re-opens the #9573 echo bug) Guard verified by mutation: forcing requiresReasoningContentPresence() to return true makes the DeepSeek half fail (1 pass / 1 fail), and the file was restored from the pre-probe copy before committing. Also checked kimi-coding/kimi-coding-apikey, the other strict-contract entries in REASONING_REPLAY_PROVIDERS: their originating PR (#7673) fixes capture and replay of REAL reasoning and documents no 400 on an absent field, so they stay out of the placeholder scope — evidence-scoped, not speculatively widened. Reasoning suites together: 87/87. Gates: file-size, test-discovery, mutation-test-coverage, dead-code exit 0; eslint clean. Refs #9737 --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-08 09:08:45 -03:00
Diego Rodrigues de Sa e Souza	a1c864373a	referrals from standalone /v1/referrals feed (no 30-day delay) (#9762) ... * feat(radar): sync referral links from standalone /v1/referrals/latest feed Referral links previously came from the catalog feed cache, which on the community tier can be up to 30 days stale -- a newly-added referral would not reach a free/community user for up to a month. Adds a new sync module (syncRadarReferrals), Ed25519-verified feed schema, and a dedicated radar_referrals_cache table (migration 142) so referrals sync on their own, much shorter cadence instead of inheriting the catalog's delay. getRadarReferrals()/getDefaultReferralFor() now read the new cache instead of the catalog feed's embedded referrals field (kept on RadarFeedSchema for backward-compat with already-cached catalog feeds, but no longer read). * feat(radar): wire sync-on-read + scheduler side-sync for referrals GET /api/radar/referrals now triggers syncRadarReferrals() inline whenever the cache is missing or older than 1h (shouldSyncReferralsOnRead), so fixed links show up promptly on the next dashboard load instead of waiting on a background timer. The route itself still never talks to the upstream feed server directly -- syncRadarReferrals() remains the only network touchpoint. radarSchedulerTick() also evaluates referrals staleness on the same hourly tick used for the catalog, independent of the catalog's own due-ness, as a best-effort side effect that never changes RadarTickResult's shape and is swallowed on error. * docs(radar): document the standalone referrals feed sync Explains the /v1/referrals/latest feed, its no-tier-field-in-body design (x-omniroute-feed-tier header is the only tier source), the sync-on-read + scheduler side-sync triggers, and the self-hosting note for forks that only serve the catalog feed. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-08 08:10:20 -03:00
Diego Rodrigues de Sa e Souza	0d7c019eec	campo de colar chave omr_ na tela de ativação (#9758) ... * feat(radar): shared supporter-key format validator Extract the "omr_" + 40 hex supporter-key regex out of the POST /api/radar/settings Zod schema into a pure, client-safe helper (src/lib/radar/supporterKey.ts) so the format rule lives in exactly one place and the upcoming activation-screen input can reuse it for a UX-only pre-check. Server-side Zod validation stays authoritative. Adds regression coverage: both directions of the format check, a combined opt-in+supporterKey POST persisting both fields with the key always masked (never raw) in either the POST or GET response body, and a flag-off inertia case for the same combined payload shape. * feat(dashboard): paste-key input on the Radar activation screen The Radar activation screen had opt-in and the two "get a key" claim buttons, but nowhere to paste a key someone already has — the last piece of the supporter flow. Add the field to the activation screen itself, as the primary path: pasting a key and submitting sends POST /api/radar/settings with { optIn: true, supporterKey } together, so pasting a valid key both sets it and unlocks the screen in one step. Client-side format validation (via the shared isValidSupporterKeyFormat helper) is a UX nicety only; the server's Zod schema already validates authoritatively. When a key is already set (hasSupporterKey from GET /api/radar/settings — e.g. set out of band before this UI existed), the screen shows the masked form instead of an empty input, with a "change key" control to paste a new one; the raw key is never displayed. The existing plain "Activate" button (no key, community tier) and the two claim/plans buttons are unchanged and still present below, so all three paths to this screen coexist. Adds 4 new i18n keys (keySectionTitle, keyInvalidFormatError, activateWithKeyButton, changeKeyButton) with an English fallback across all 43 locale files (172 entries) — no __MISSING__ sentinel, no price. * docs(radar): close the paste-key-input known gap RADAR.md documented a known gap: the activation screen had no dedicated key-paste input, only the two claim/plans buttons. That gap is closed — describe the new input, the combined opt-in+supporterKey submission, and the masked-key "already activated" state instead. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-08 08:10:14 -03:00
Diego Rodrigues de Sa e Souza	02534f4e8e	feat(radar): contributor + supporter claim buttons on the activation screen (#9710) ... * feat(radar): add F4/T7 contributor-claim / supporter-plans link config Pure, DB-free src/lib/radar/links.ts resolves the two outbound "get a supporter key" URLs (contributor GitHub-OAuth claim + supporter plans page), same env-override pattern as RADAR_FEED_URL. No pricing/value is ever resolved here (D14) — only the link. * feat(radar): relay F4/T7 claim/plans links via GET /api/radar/settings Smallest-surface option per spec: no dedicated route. The existing settings snapshot now also returns contributorClaimUrl/supporterPlansUrl so the dashboard client never reads process.env itself. Both are plain public URLs, gated by the same flag/auth checks as the rest of the response. * feat(radar): add contributor/supporter claim buttons to activation screen F4/T7 — "I'm a contributor" opens the GitHub OAuth claim flow; "Support the project" opens the plans/payment page. Both links come from the settings fetch (never a hardcoded URL in this client component) and open in a new tab. No price/value anywhere in the copy — the destination page is the only place pricing lives (D14). i18n: 5 new radarPage keys (claimSectionTitle, contributorButton, contributorHint, supporterButton, supporterHint) added to all 43 locale files with the English copy as fallback value. * docs(radar): document F4/T7 supporter-key acquisition paths RADAR.md: new "Getting a supporter key" section covering both claim flows, the two env-var overrides, and the current gap (no dedicated key-paste input in the dashboard yet — POST /api/radar/settings is the only way to set one today). ENVIRONMENT.md + .env.example: register RADAR_CONTRIBUTOR_CLAIM_URL / RADAR_SUPPORTER_PLANS_URL for check:env-doc-sync. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-07 16:41:00 -03:00
Diego Rodrigues de Sa e Souza	d86ea99713	feat(radar): referral links — free-credits tab + default provider link (#9697) ... * feat(radar): client-side schema + accessor for referral links (D28) Server already publishes a signed `referrals` section on the Radar feed ({fixed, campaigns}); this adds the client mirror: RadarFeedSchema gains a `.default()`-backed `referrals` field (old cached feeds without it stay valid) with https-only url validation, and src/lib/radar/index.ts exposes getRadarReferrals()/getDefaultReferralFor() (never throw: flag off, no cache, or a corrupt/old payload all resolve to the empty shape). The provider-default lookup itself lives in a new DB-free src/lib/radar/ referrals.ts so it stays safe to import from a "use client" component. * feat(radar): add GET /api/radar/referrals route (D28) Local-only route mirroring the /api/radar/catalog gate order: RADAR_ENABLED off => 404 before any auth check (byte-identical flag-off inertia), unauthenticated => 401, otherwise 200 with {fixed, campaigns, tier} read straight from the local cache. Never proxies the private feed server. * feat(dashboard): add "free credits" tab to the Radar page (D28) Reuses the existing /dashboard/radar page instead of a new route (less routing/i18n surface): a second tab lists fixed referral links (grouped by provider, with requiredAction + an external-link button) and temporary campaigns (with validUntil). When campaigns is empty and the served tier is community, shows a soft upsell note — never gates the fixed links list, which stays fully populated on every tier. Adds 10 new radarPage i18n keys (English fallback) to all 43 locale files to avoid dropping i18n-ui-coverage below threshold. * feat(providers): use Radar default referral link on the provider name (D28) ProviderPageHeader already linked the provider name to providerInfo.website with a precedent for a monetized link (the Kimi partner-link note); this lets a Radar default referral override that URL, reusing the exact same discreet note instead of a new visual treatment. Loose coupling: resolveProviderHeaderLink() in providerPageUtils.ts is a pure function with no @/lib/radar or @/lib/db/* import (asserted by the new test), so the providers dashboard never depends on the DB-touching Radar module to render. ProviderDetailPageClient (a "use client" component) is the only place that fetches Radar data, via the local /api/radar/referrals route (same pattern the Radar page itself uses) and the DB-free findDefaultReferral() helper. With RADAR_ENABLED off, no cache, or no default referral for the provider, the header renders byte-identical to before this feature existed. * docs(radar): document referral links / free credits (D28) Adds a "Referral links (free credits)" section covering the referrals feed shape, the getRadarReferrals()/getDefaultReferralFor() accessors, the new GET /api/radar/referrals route, the Radar page's "Free credits" tab, and the loosely-coupled referral link on the provider-name header. Also corrects the local-routes count (four -> five) now that /api/radar/ referrals exists. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-07 10:17:46 -03:00
Diego Rodrigues de Sa e Souza	1e15583f29	fix(radar): close audit gaps (auth, feed fields, opt-in state, sidebar gate, size cap) + daily sync scheduler (#9686) ... * fix(radar): preserve extended feed fields and honor local enable override applyFeed()'s MergedEntry shape omitted contextWindow/capabilities/limits/ setup even though FeedModel always carries them, so the dashboard's setup link, Context column, and capability badges never rendered and the setup page's provider lookup always failed. Both merge paths (mergeOne and feedModelToMerged) now copy the four fields through, respecting rule 1 (local override wins) same as every other field. feedModelToMerged() also unconditionally forced enabled:false when the feed disabled a feed-only entry, even when the operator had locally overridden enabled:true — mergeOne() already applies overrides after the disable rule and got this right. feedModelToMerged() now only force-disables when there is no local `enabled` override, matching mergeOne()'s semantics. * fix(radar): cap feed sync response body at 10MB syncRadar() buffered the entire feed response via Buffer.from(await res.arrayBuffer()) with no size limit, so a misconfigured or hostile RADAR_FEED_URL (or an upstream serving garbage) could force an unbounded in-memory buffer. Enforcement is two-layered: a Content-Length preflight skips reading an already-oversized body entirely, and a running-total check while reading the stream enforces the cap even when Content-Length is absent or understates the real size — concatenating the accumulated chunks preserves the exact bytes the signature check needs. Exceeding the cap returns a new { status: "too_large" } SyncStatus and leaves the cache untouched, following the same non-destructive pattern as every other sync failure (invalid_signature/invalid_schema/stale). * fix(radar): gate the sidebar radar item behind RADAR_ENABLED The "radar" sidebar item was registered unconditionally in sidebarVisibility/sections.ts, but Sidebar.tsx has no feature-flag awareness (it's a client component), so the link stayed visible and clickable with RADAR_ENABLED off, landing on a 404 dashboard page. Sidebar items gain an opt-in `featureFlagKey` field plus a pure isSidebarItemVisibleForFlags() filter (fails open when a flag isn't in the map, so a missing/not-yet-loaded key never hides an unrelated item). The resolved flag value piggy-backs on the /api/settings response the sidebar already fetches on mount (new `radarEnabled` field) rather than adding a dedicated round trip. * fix(radar): require auth on management routes, add GET settings GET /api/radar/catalog, POST /api/radar/sync, and POST /api/radar/settings had zero authentication — any client that could reach the local server could read the merged catalog, trigger a sync, or flip the opt-in/set the supporter key. All three (plus the new GET below) now call isAuthenticated() from the shared apiAuth guard, same gate as the rest of /api/settings/*. The RADAR_ENABLED flag-off 404 check keeps running FIRST so flag-off inertia stays byte-identical (no auth prompt just to learn the surface doesn't exist); auth runs after it, before any DB access. Adds GET /api/radar/settings, returning { optIn, hasSupporterKey, supporterKeyMasked } — the raw key never leaves the server on either verb. The dashboard page's fetchSettings() now calls this endpoint instead of inferring opt-in state from the catalog response (which always defaulted to unknown/null), so an already-activated operator no longer sees the activation screen on every reload. handleSync() also handles the new too_large sync status introduced by the response-cap fix, reusing the existing generic sync-failed copy (no new UI strings). * docs(radar): fix stale feed URL, document tier header/auth/size cap - RADAR_FEED_URL default was documented as radar.omniroute.dev in ENVIRONMENT.md; the actual default (src/lib/radar/sync.ts) and every other reference use radar.omniroute.online — fix the one stale spot. - Correct the FREE_MODEL_BUDGETS source path: it's declared in freeModelCatalog.data.ts, not freeModelCatalog.ts (which only re-exports it). - Document that the signed feed body's `tier` is always "live" (one signed artifact per version) and the actually-served tier comes from the `x-omniroute-feed-tier` response header, resolved with a Zod parse + fallback to the body field. - Document that all four /api/radar/* routes now require auth (isAuthenticated(), same gate as /api/settings/*), the new GET /api/radar/settings route, and the new too_large sync status from the 10MB response cap. * feat(radar): daily sync scheduler + auto-sync on page open Spec asks for a 1x/day sync while opted in and fresh data on every page open. The scheduler only arms itself when RADAR_ENABLED AND the opt-in are already on (boot) or right after the user opts in (settings route) — a flag-off install never creates the timer, preserving the inertia contract. The page auto-syncs once per mount when the cached feed is older than 6h. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-07 08:26:18 -03:00
Diego Rodrigues de Sa e Souza	e7f6b1d130	feat(radar): flag-gated signed free-model catalog overlay (#9515) ... * feat(dashboard): add RADAR_ENABLED flag (default off) * feat(db): radar feed cache + settings with encrypted supporter key * feat(radar): signed feed sync with pinned key and version floor - feedSchema.ts: Zod v4 schema mirroring the server feed format (discriminated union on budget.kind, enum constraints, etc.) - pinnedKeys.ts: Ed25519 SPKI-DER pinned key + env override for forks - verify.ts: signature verification over exact wire bytes, never throws - sync.ts: full download/verify/validate/cache pipeline with injectable deps, feature-flag gate, opt-in gate, version floor (numeric compare), and sanitized error reasons (no stack traces) - 40 tests covering: contract hash, key handling, sig verification, schema validation, version compare, all sync paths (disabled, opt_out, invalid_signature, invalid_schema, stale, updated, error), auth header injection, and cache-untouched assertions for every failure mode * feat(radar): read-time overlay merge rules over the free catalog Pure function applyFeed() merges the cached Radar feed over the static baseline catalog at read time, honoring 4 rules: 1. Feed never overwrites a local override field. 2. enabled:false disables the entry with disabledBy:"radar" provenance. 3. User-added entry NOT in the feed survives untouched. 4. User deletion tombstone prevents feed resurrection. getRadarCatalog() accessor in index.ts: flag off / no cache / corrupt payload all fall back to baseline. Valid cache applies the overlay and returns feed metadata (version, tier, fetchedAt). TDD: 19 tests (4 rules + dedup + origin + accessor flag/cache/corrupt/ valid/bad-feed + baselineToMergedEntries converter). * feat(dashboard): radar catalog and guided setup screens - API routes: GET /api/radar/catalog, POST /api/radar/sync, POST /api/radar/settings - All gated on RADAR_ENABLED flag (404 when off) - Error responses via buildErrorBody(), never raw stack/message - Settings never echoes clear supporter key (masked omr_****<last4>) - Sync delegates to syncRadar() server-side, never proxies feed URL - Dashboard pages: - /dashboard/radar: 4 states (flag off, opt-in pending, empty, populated) - /dashboard/radar/setup?provider=X: guided setup with steps, key URL, test connection - Uses existing Card component and next-intl patterns - Sidebar: radar entry in costs group with icon - i18n: pt-BR and en keys for radarPage and radarSetupPage namespaces - Tests: - radar-api-routes.test.ts: 11 tests (flag-off 404, flag-on shape, error sanitization) - radar-page-state.test.ts: 5 tests (pure state logic) - All 90 radar tests pass (including prior 74) * docs(radar): module doc and flag-off inertia test Add docs/frameworks/RADAR.md covering the flag gate, the separate data-sync opt-in and privacy promise, the Ed25519 signature/pinned-key security model, tiers, the read-time overlay merge rules, and the self-hosting env vars — plus index entries in CLAUDE.md/AGENTS.md/docs/README.md/REPOSITORY_MAP.md. Document RADAR_FEED_URL and RADAR_FEED_PUBKEY in .env.example and docs/reference/ENVIRONMENT.md to satisfy check:env-doc-sync, which was failing on this branch since the sync.ts commit added the reads. Add tests/unit/radar-inertia.test.ts as the single canonical place asserting the "RADAR_ENABLED off => zero behavioral delta" claim end to end: the three /api/radar/* routes 404, the flag resolves to the definition default with no override, getRadarCatalog() returns exactly the baseline without touching the cache, and computeFreeModelTotals() keeps its pinned values with the Radar module imported alongside it. * fix(db): renumber radar migration to 135 after collision with 134 The base branch introduced 134_proxy_logs_egress_ip while this branch carried 134_radar_cache_settings; the migration runner rejects duplicate numeric prefixes. This migration has never been applied to a real database (the PR is unmerged), so no retroactive isSchemaAlreadyApplied guard is needed. * i18n(radar): translate radar catalog and setup strings to all locales The UI-coverage ratchet measures (present - placeholder) / total_en, so the __MISSING__ sentinels that i18n:sync-ui writes do not count as covered — only real translations restore the metric. Scoped to this PR's namespaces (radarPage, radarSetupPage, sidebar.radar*) instead of a bulk sync, which would have pulled ~978 unrelated pending keys into this diff. Placeholders and code identifiers verified preserved across all 1682 strings. * fix(radar): trust the served-tier header instead of the signed body field The signed feed body always carries tier:"live" by design (one signed artifact per version — rewriting the field server-side per request would break the exact-bytes Ed25519 signature). The server now returns the tier ACTUALLY served via the x-omniroute-feed-tier response header, so free users on a delayed community snapshot no longer see "Ao vivo (tempo real)" in the UI. sync.ts now reads and validates that header (falling back to the body's tier only when the header is absent or holds an unrecognized value) and stores the served tier in the cache; index.ts already surfaces cache.tier to the UI unchanged. * test(combo): shorten an assert message that exceeded the line limit The assertion added by #9507 was 104 chars, so prettier reformatted it into five lines on the next commit that touched the file, pushing it past its frozen size (3449) and failing check:file-size. The message is shortened (the issue reference stays in the comment directly above); the assertion itself is unchanged, and the file is back to 3448 lines and prettier-clean. * i18n(radar): use the canonical zh-TW glossary terms The machine translation produced retired renderings the glossary gate blocks: 供應商 for provider (canonical 提供者) and 文檔 for documentation (canonical 文件). Fixed across the 11 affected radar strings; tests/unit/i18n-glossary-consistency-check.test.ts is back to 17/17. * fix(radar): point the default feed URL at the domain that exists radar.omniroute.dev was a placeholder for a domain that was never registered, so an out-of-the-box sync would fail DNS resolution for every user. The live feed is served from radar.omniroute.online (the subdomain the design always specified), now behind Cloudflare TLS. Forks still override it via RADAR_FEED_URL. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-06 05:58:58 -03:00