pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-01 21:02:12 +03:00
Code Issues Packages Projects Releases Wiki Activity
3,924 Commits 100 Branches 313 Tags
8316c618b2652e86ce7358f2bdbf76ebfaeb8a33
Commit Graph

3924 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
diegosouzapw
8316c618b2 feat(quota): enforce quota-exclusive keys by pool provider (Phase A3) 
Keys with non-empty allowedQuotas may only use models whose provider belongs
to their pools' provider set; anything outside → 403 QUOTA_ONLY.
Normal allowedModels/allowedCombos checks are bypassed for quota-exclusive keys.
 2026-05-30 20:53:35 -03:00
diegosouzapw
c29d6ed7a4 feat(quota): add resolveQuotaKeyScope helper (Phase A2) 
Introduces src/lib/quota/quotaKey.ts with resolveQuotaKeyScope(), a
pure async helper that maps an API key's allowedQuotas pool-ID list to
the concrete connectionIds and provider slugs it is permitted to use.
Covers empty/null/undefined input, missing pools, orphaned connectionIds,
and multi-pool deduplication. No behaviour change to existing code paths.
 2026-05-30 20:40:33 -03:00
diegosouzapw
51b586c2af feat(quota): add allowed_quotas allow-list field to api_keys (Phase A1) 2026-05-30 18:58:23 -03:00
diegosouzapw
6b0e89fb42 fix(authz): derive LOCAL_ONLY locality from Host header (middleware has no socket IP) 
The authz pipeline runs in the Next middleware runtime (proxy.ts -> runAuthzPipeline)
where ctx.request is a NextRequest with no .socket/.ip. requestPeerAddress therefore
returned null, so isLoopbackRequest was ALWAYS false and every LOCAL_ONLY path 403'd
even from loopback (Services/MCP/Traffic-Inspector were unusable). Read the Host
header instead — exactly what isLoopbackHost/isPrivateLanHost were built to parse —
which restores loopback and, combined with isPrivateLanHost, enables the
owner-authorized private-LAN access. Spawn-capable endpoints still require
manage-scope auth after this gate.
 2026-05-30 18:20:39 -03:00
diegosouzapw
270c2eb925 fix(i18n): add missing settings proxy tab labels (proxyGlobalConfigTab/proxyPoolTab/freePoolTab/proxyDocumentationTab) 2026-05-30 17:51:34 -03:00
diegosouzapw
5a61ae9a98 feat(authz): allow LOCAL_ONLY paths from private-LAN peer IPs (owner-authorized) 
Services + Traffic-Inspector (LOCAL_ONLY, spawn-capable) returned 403 when the
dashboard was reached via the LAN IP (192.168.0.x) instead of loopback. Add
isPrivateLanHost (RFC1918 IPv4 + IPv6 ULA/link-local) and widen ONLY the
local-only PATH gate to accept private-LAN socket peer IPs — based on the real
socket peer address (not the spoofable Host header), so public-internet clients
present public IPs and stay blocked. The CLI-token gate stays strictly loopback;
paths remain LOCAL_ONLY-classified (Hard Rules 15/17 unchanged). Enforcement-layer
carve-out for a LAN-deployed instance, authorized by the operator.
 2026-05-30 17:26:10 -03:00
diegosouzapw
6095842ef0 fix(quota-share): guard usage.dimensions to stop "reading 'length'" ISE 
The pool usage snapshot can come back without a dimensions array (e.g. when the
plan resolves to empty for catalog-only providers). PoolCard.computeStatus and
hasDimensions read usage.dimensions.length directly, crashing the whole page
("Cannot read properties of undefined (reading 'length')"). Normalize to [] in
PoolCard and in usePoolsUsageAggregate (dimensions/perKey).
 2026-05-30 16:52:09 -03:00
diegosouzapw
f1d0416d72 feat(search-tools): Compare shows full results in side-by-side columns (Layout A) 
- Capture full search results (title/url/snippet) per provider, not just URLs.
- Render one column per selected provider: metrics header + result list
  (title link, snippet, url), horizontal scroll for N providers.
- Mark results whose URL appears across providers with a star (overlap).
- Remove the 4-provider cap (MAX_PROVIDERS); add Select all / Clear; compare
  every configured provider. Raise max_results 5 -> 10.
 2026-05-30 14:57:31 -03:00
diegosouzapw
36c276a6d7 feat(playground): Compare freeze fix, Chat provider/model selects, Build wizard (Phase 4) 
- Chat (StudioConfigPane): add Provider + Model selects reusing the translator
  hooks; order Endpoint -> Provider -> Model; ConfigState gains optional provider.
- Compare (CompareTab): add a user-prompt input and include it in the request
  body; throttle per-column stream updates via requestAnimationFrame to stop the
  UI freeze (was setColumns per chunk x N columns with an empty user message).
- Build (BuildTab + build/BuildWizard): redesign as a guided 3-step wizard
  (What to test -> Configure -> Run) reusing ToolsBuilder/StructuredOutputEditor;
  all run/tool-call handlers preserved.
- i18n: playground.build.* (18 keys) in en + pt-BR.
 2026-05-30 12:54:58 -03:00
diegosouzapw
8eacd78be4 feat(memory): health auto-check, enable toggle, sqlite-vec hint (Phase 3) 
- MemoriesTab: auto-run health check on mount + poll every 30s (was manual-only).
- page: add enable/disable memory toggle (role=switch) via useMemorySettings.save({ enabled }).
- MemoryEngineStatus: show "npm install sqlite-vec" hint when vector store backend is "none".
- i18n: memory.memoryEnabled + memory.engine.vectorStoreInstallHint (en + pt-BR).
 2026-05-30 12:45:27 -03:00
diegosouzapw
a03d7b40d7 fix(audit): translate event types and A2A task states (Phase 2) 
- Add compliance.eventTypes (36 labels) to en.json + pt-BR.json.
- ComplianceTab: render translated label via t.has/t fallback instead of raw entry.action.
- A2aAuditTab: render translated task state via a2aState* keys instead of raw task.state.
- Memory type/strategy dropdowns needed no i18n change — keys already exist; the
  Phase 1 Select fix makes them render.
 2026-05-30 12:38:23 -03:00
diegosouzapw
a59a90e6a1 fix(dashboard): v3.8.8 screen quick wins (Phase 1) 
- search-tools: export modal no longer opens by default / stuck — guard on
  exportOpen and drop the invalid isOpen prop the modal never read.
- logs: remove duplicate proxy/console tabs + SegmentedControl (dedicated
  /dashboard/logs/proxy and /console pages already exist in the menu).
- memory: order tabs Memories -> Engine -> Playground.
- ui(Select): render children and suppress the placeholder/options branch when
  children are provided — fixes the "empty" memory type/strategy dropdowns
  (children were being shadowed by the component's own option list).
- test: source-level regression guards for all four.
 2026-05-30 12:31:08 -03:00
diegosouzapw
cad06d85a6 fix(agent-bridge): strip non-serializable handler before Server→Client boundary 
The /dashboard/tools/agent-bridge page (Server Component) passed ALL_TARGETS
directly to AgentBridgePageClient (a Client Component). Each MitmTarget carries
a `handler: () => Promise<...>` function, which Next.js forbids across the
Server/Client boundary, raising at SSR time:
  "Functions cannot be passed directly to Client Components ..."
This broke the whole page ("erro ao carregar").

Fix: introduce MitmTargetView = Omit<MitmTarget, "handler"> and pass a
sanitized array (ALL_TARGETS.map(({ handler, ...rest }) => rest)). The UI never
invokes handler, so behavior is unchanged. Adds a regression test asserting the
sanitized targets are function-free and JSON-serializable.
 2026-05-30 11:06:38 -03:00
diegosouzapw
468354f8ff clean 2026-05-30 10:06:02 -03:00
diegosouzapw
37890ba007 chore: remove audit logs tab from logs page 
Remove the AuditLogTab from the dashboard logs page now that audit logs
live under the dedicated /dashboard/audit route. Update integration wiring
expectations and add metadata frontmatter to studio framework docs.
 2026-05-30 09:11:17 -03:00
Diego Rodrigues de Sa e Souza
9515375114 Merge pull request #2869 from diegosouzapw/refactor/pages-v3-C-playground-search-tools 
feat(playground,search-tools): Playground Studio + Search Tools Studio (planos 17+18)
 2026-05-30 04:30:57 -03:00
diegosouzapw
18641c9d87 fix(docs): document 2 PLAYGROUND_* env vars in ENVIRONMENT.md (env-doc-sync drift) 2026-05-30 04:30:25 -03:00
diegosouzapw
ac0e9d5272 Merge release/v3.8.8 into refactor/pages-v3-C (Playground + Search Tools Studio — plans 17+18) 
Conflicts: migration 076_playground_presets->084; localDb/.env union; REPOSITORY_MAP dedup; package.json keep base (version 3.8.7, coverage --functions 40); .source regenerated (+3 docs); deps cli-table3/wtfnode/@types/bun/uuid (npm install).

i18n pt-BR: 19 collisions — 18 playground keys -> HEAD pt-BR translations (base had untranslated EN: Send->Enviar, Cancel->Cancelar etc), costsSection -> base Custos. Rule: prefer side != en.json (translated).

openapi: --theirs base + 3 playground/search paths + 2 schemas + 1 tag (js-yaml surgical insert; union-blind breaks YAML). No open-sse, typecheck:core 0 errors.
 2026-05-30 04:19:49 -03:00
Diego Rodrigues de Sa e Souza
b7242579f4 Merge pull request #2873 from diegosouzapw/refactor/pages-v3-21-memory-engine-redesign 
feat(memory): memory engine redesign — sqlite-vec + hybrid RRF + Studio UI (plan 21)
 2026-05-30 04:13:23 -03:00
diegosouzapw
dd8f7aa6a1 Merge release/v3.8.8 into refactor/pages-v3-21 (Memory engine redesign — sqlite-vec + RRF + Studio) 
Conflicts: migration 073_memory_vec->083; localDb/.env/REPOSITORY_MAP union; request.ts->base; i18n auto-merged; .source regenerated (+3 docs).

openapi: --theirs base + surgically inserted 14 memory paths + 4 schemas + Memory tag via js-yaml extract (union-blind broke YAML structure). +938 lines, base formatting preserved, gen-openapi validates.

deps: @huggingface/transformers + sqlite-vec added (package.json); npm install ran, lock regenerated. chatCore auto-merged (memory + quota hooks coexist, transform OK). typecheck:core 0 errors.
 2026-05-30 04:04:20 -03:00
Diego Rodrigues de Sa e Souza
6253f31166 Merge pull request #2849 from diegosouzapw/refactor/pages-v3-20-batch-files-functional-redesign 
feat(batch): functional & explanatory redesign for /batch + /batch/files
 2026-05-30 03:51:35 -03:00
diegosouzapw
f4605828b1 Merge release/v3.8.8 into refactor/pages-v3-20 (Batch files functional redesign) 
Conflicts: CLAUDE.md base; i18n en/pt-BR deep-merge — 3 apiManager keys resolved to base pt-BR translations (HEAD had stale EN), costsSection=Custos; .source --theirs+regenerated. 40 other locales auto-merged. No migrations/open-sse. Batch redesign confirmed complete in prior code review.
 2026-05-30 03:42:04 -03:00
Diego Rodrigues de Sa e Souza
1ee177d065 Merge pull request #2827 from diegosouzapw/refactor/pages-v3-15-skills-pages-redesign 
feat(skills): redesign agent-skills + omni-skills with dynamic 42-skill catalog + MCP/A2A discovery
 2026-05-30 03:37:42 -03:00
diegosouzapw
db27ae5006 Merge release/v3.8.8 into refactor/pages-v3-15 (Skills pages redesign) 
Conflicts: CLAUDE.md base; openapi union + i18n deep-merge (costsSection=Custos); .source regenerated (fumadocs-mdx, +5 docs); openapi.generated regenerated.

open-sse/mcp-server/server.ts: union — registers BOTH agentSkillTools (#2827) AND pluginTools (base plugin system) via two separate forEach loops; tool count sums both; skills handler keeps @ts-expect-error, plugins keeps @ts-ignore. server.ts type-safe (0 TS errors).
 2026-05-30 03:29:19 -03:00
Diego Rodrigues de Sa e Souza
da527508db Merge pull request #2839 from diegosouzapw/refactor/pages-v3-14-cli-pages-redesign 
feat(dashboard,cli): redesign CLI pages — CLI Code's + CLI Agents + ACP Agents (Plan 14)
 2026-05-30 03:22:20 -03:00
diegosouzapw
275018ffce fix(test): TOOLS_GROUP expected includes agent-bridge/traffic-inspector 
Plan 14 (#2839) test listed only cli-code/cli-agents/acp-agents/cloud-agents; #2858 added agent-bridge/traffic-inspector to TOOLS_GROUP. Align test to real code (both feature sets).
 2026-05-30 03:21:57 -03:00
diegosouzapw
968addf54f Merge release/v3.8.8 into refactor/pages-v3-14 (CLI pages redesign) 
Conflicts: CLAUDE.md base; i18n deep-merge (costsSection=Custos); .source regenerated (fumadocs-mdx, +1 doc); openapi regenerated.

CLIToolsPageClient.tsx: accepted #2839 deletion (redesign replaced cli-tools/ with cli-code/cli-agents/acp-agents; base #2858 only removed obsolete MITM cards; AgentBridge reachable via sidebar; 0 orphan refs). sidebar-visibility test passes (cli items + agent-bridge merged).
 2026-05-30 03:10:34 -03:00
Diego Rodrigues de Sa e Souza
d024365410 Merge pull request #2847 from diegosouzapw/refactor/pages-v3-19-translator-friendly-redesign 
feat(translator): friendly redesign (5 tabs → 2)
 2026-05-30 03:05:41 -03:00
diegosouzapw
0b405d51f0 Merge release/v3.8.8 into refactor/pages-v3-19 (Translator friendly redesign) 
Conflict: CLAUDE.md coverage rule kept at base (>=40%); i18n en/pt-BR auto-merged clean (0 __MISSING__). No migrations/sidebar/env vars/open-sse touched.
 2026-05-30 02:54:58 -03:00
Diego Rodrigues de Sa e Souza
dcba31a6ed Merge pull request #2858 from diegosouzapw/refactor/pages-v3-A-agent-bridge-traffic-inspector 
feat(mitm,inspector): AgentBridge + Traffic Inspector (planos 11+12 / Group A)
 2026-05-30 02:47:45 -03:00
diegosouzapw
ef6e6c74a5 Merge release/v3.8.8 into refactor/pages-v3-A (AgentBridge+Inspector) + fix test gaps 
Conflicts: migrations 073/074/075->080/081/082; localDb/.env.example/openapi union; i18n deep-merge; request.ts+i18n-fallback->base (deepMergeFallback, drop old getNestedValue); REPOSITORY_MAP dedup; .source regenerated via fumadocs-mdx (+AGENTBRIDGE/TRAFFIC_INSPECTOR docs).

Pre-existing #2858 gaps fixed: sidebar-visibility.test.ts expected list missing agent-bridge/traffic-inspector (code already had them); documented 10 INSPECTOR/AGENTBRIDGE env vars in ENVIRONMENT.md; NODE_TLS_REJECT_UNAUTHORIZED added to env-doc-sync IGNORE_FROM_CODE (instruction snippet, not OmniRoute config).
 2026-05-30 02:45:27 -03:00
Diego Rodrigues de Sa e Souza
715809a150 Merge pull request #2859 from diegosouzapw/refactor/pages-v3-B-monitoring-quota-share 
feat(monitoring,costs,quota): Monitoring reorg + Costs section + Quota Share Engine (planos 16+22)
 2026-05-30 02:17:11 -03:00
diegosouzapw
1b0d3c75e9 Merge release/v3.8.8 into refactor/pages-v3-B (Monitoring+Costs+Quota) + fix transform bug 
Conflicts: migrations 073/074/075->077/078/079 (collision w/ base 073-076); localDb union (quota + tokenLimits/plugins re-exports); i18n en/pt-BR deep-merge (base translations win over __MISSING__ placeholders; sidebar.costsSection=Custos); CLAUDE.md keeps base coverage rule (>=40%).

Pre-existing #2859 bugs surfaced by validation & fixed: chatCore onStreamComplete 'await import'->'import().then()' (await was outside async fn, broke tsx transform of 17 chat-* test files); documented 5 QUOTA_* env vars in ENVIRONMENT.md to fix env-doc-sync drift.
 2026-05-30 02:02:38 -03:00
Diego Rodrigues de Sa e Souza
53c8ffcc34 Merge PR #2926: fix Turbopack Docker build — plugin loader fork→spawn (+ IPC test) 
URGENT: Fix Docker release build failure for v3.8.7
v3.8.7 		2026-05-29 21:47:09 -03:00
R.D.
150869198b Address plugin loader review feedback 2026-05-29 20:31:56 -04:00
R.D.
dad82d59f7 Fix plugin loader Turbopack build 2026-05-29 20:27:33 -04:00
Diego Rodrigues de Sa e Souza
7720d5bd47 docs(i18n): sync 41 llm.txt mirrors to v3.8.7 (#2924) 
Root llm.txt was bumped to 3.8.7 but the i18n mirrors were still at 3.8.5,
breaking check:docs-sync on main after the v3.8.7 release merge (#2919).
Regenerated via scripts/i18n/sync-llm-mirrors.mjs (headers preserved).
 2026-05-29 20:30:04 -03:00
Diego Rodrigues de Sa e Souza
191009dd23 Release v3.8.7 (#2919) 
* feat(plugins): WordPress-style plugin system backend

* fix(plugins): address code review feedback

- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior

Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>

* fix(plugins): replace vm with child_process, add auth to all routes

Addresses all remaining code review feedback:

1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
   for proper process-level isolation. Complies with Rule 3 (no eval).
   Each plugin runs in a separate Node.js process with IPC communication.

2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
   API route files (list, install, scan, details, activate, deactivate, config).

3. **Env filtering**: Only safe env vars passed to plugin processes unless
   "env" permission is granted.

Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>

* fix(plugins): security + ESM fixes for loader and manager

loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)

manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)

hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)

* feat(discovery): add discovery tool stub service

Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)

* chore(plugins): slop cleanup — pino logger, remove redundant sorts

- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import

* test(plugins): add scanner, loader, manager unit tests

- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing

* fix(settings): add missing home page pin keys to updateSettingsSchema

* feat(plugins): add i18n keys to all 42 locales

* fix(settings): add missing security keys to updateSettingsSchema and add tests

* fix(usage): analytics route reads combo_name/requested_model from call_logs only

The 3.8.6 variant of #2904 added SELECTs of combo_name/requested_model
against usage_history, but those columns only exist in call_logs (no
migration adds them to usage_history). This returned HTTP 500 on
/api/usage/analytics. Restore the working query shape from the 3.8.7
variant. Fixes 18 failing usage-analytics-route tests.

* fix(types,test): resolve noImplicitAny in progressiveAging + align semaphore test to #2903 gate pruning

- progressiveAging: type compression results so messages[0].content is
  indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate.
- services-branch-hardening: #2903 (perf-ram) prunes idle rate-limit gates
  on zero; assert no-running/empty-queue without assuming the entry persists.

* fix(analytics): address merged review regressions

* fix(executor): normalize max effort for openai shape providers

* Make zero-latency combo optimizations opt-in

* Address zero-latency combo review feedback

* chore(release): sync v3.8.7 touchpoints + credit contributors

- llm.txt → 3.8.7 (Current version + Key Features header)
- CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors
- version already 3.8.7 across package.json/open-sse/electron/openapi (from #2909)

* fix(cleanup): restore usage history cutoff boundary

* docs(changelog): rank 3.8.6 contributors in a commits table with their PRs

* fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode

* fix(settings): add missing home page pin keys to updateSettingsSchema

* fix(settings): add missing security keys to updateSettingsSchema and add tests

* fix(executor): normalize max effort for openai shape providers

* Make zero-latency combo optimizations opt-in

* Address zero-latency combo review feedback

* fix(analytics): address merged review regressions

* fix(cleanup): restore usage history cutoff boundary

* feat(plugins): WordPress-style plugin system backend

* fix(plugins): address code review feedback

- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior

Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>

* fix(plugins): replace vm with child_process, add auth to all routes

Addresses all remaining code review feedback:

1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
   for proper process-level isolation. Complies with Rule 3 (no eval).
   Each plugin runs in a separate Node.js process with IPC communication.

2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
   API route files (list, install, scan, details, activate, deactivate, config).

3. **Env filtering**: Only safe env vars passed to plugin processes unless
   "env" permission is granted.

Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>

* fix(plugins): security + ESM fixes for loader and manager

loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)

manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)

hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)

* feat(discovery): add discovery tool stub service

Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)

* chore(plugins): slop cleanup — pino logger, remove redundant sorts

- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import

* test(plugins): add scanner, loader, manager unit tests

- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing

* feat(plugins): add i18n keys to all 42 locales

* chore(plugins): remove duplicate migration 059_create_plugins.sql

* chore(plugins): remove duplicate migration 059_create_plugins.sql (post-merge)

* fix(sse): guard non-string error.code in proxyFetch + harden model parsing (#2463) (#2923)

Integrated into release/v3.8.7

* fix(docker): add runner-web stage with Playwright Chromium (#2832) (#2846)

Integrated into release/v3.8.7

* docs(changelog): document NVIDIA NIM and error code type-crash fix (#2463)

* test: ignore NVIDIA_BASE_URL and NVIDIA_MODEL in env contract check

---------

Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com>
Co-authored-by: Halil Tezcan KARABULUT <info@hlltzcnkb.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
 2026-05-29 19:54:00 -03:00
dependabot[bot]
5d2d10d281 chore(deps): bump actions/setup-node from 4 to 6 (#2920) 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-29 19:30:26 -03:00
dependabot[bot]
edf89b2d6e chore(deps): bump actions/upload-artifact from 4 to 7 (#2921) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-29 19:30:12 -03:00
dependabot[bot]
81579ac052 chore(deps): bump actions/download-artifact from 4 to 8 (#2922) 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-29 19:29:56 -03:00
Diego Rodrigues de Sa e Souza
8264dfe608 Merge pull request #2914 from apoapostolov/fix/topology-controls-dark-mode 
fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode
 2026-05-29 17:11:22 -03:00
Apostol Apostolov
cdb1a6b3a0 fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode 2026-05-29 21:52:14 +03:00
Diego Rodrigues de Sa e Souza
ad14d99580 Merge release/v3.8.7 into main (#2909) 
Hotfixes da release/v3.8.7 (perf RAM #2903, self-service #2908, analytics #2904, bump 3.8.7, docs) na main consolidada com 3.8.6.
 2026-05-29 15:22:46 -03:00
diegosouzapw
95023d6eb1 merge: sync origin/main into release/v3.8.7 (keep newer analytics columns from main) 2026-05-29 15:21:38 -03:00
Diego Rodrigues de Sa e Souza
ddb61686c2 Merge release/v3.8.6 into main (#2910) 
Sincroniza a main com os 103 commits acumulados em release/v3.8.6 após o release v3.8.6 (agy provider, web-cookie providers, zero-latency combos, per-API-key limits, security fixes, etc). Conflito pt-BR.json resolvido por união de chaves.
 2026-05-29 15:18:09 -03:00
diegosouzapw
4b15a992d6 merge: sync origin/main into release/v3.8.6 (resolve pt-BR.json) 2026-05-29 15:10:41 -03:00
diegosouzapw
a086862c97 docs: add 3.8.7 changelog and release branch guidance 
Update the main and localized changelogs with the 3.8.7 release notes, including new API self-service status, analytics retention, RAM optimizations, and token accounting fixes.

Clarify release skill instructions to ensure new release branches are always created from the latest main branch.
 2026-05-29 13:57:57 -03:00
mi
94682d2a76 perf(ram): reduce server memory footprint (#2903) 
Integrated into release/v3.8.7
 2026-05-29 13:21:36 -03:00
Halil Tezcan KARABULUT
a1a225209c Fix analytics history and log token accounting (#2904) 
Integrated into release/v3.8.6
 2026-05-29 13:20:13 -03:00