* fix(build): exec native tool binaries directly in runBuildTool
#8858 routed every resolved local bin through process.execPath to avoid
Windows .cmd shims — but esbuild >=0.25 ships bin/esbuild as the NATIVE
platform executable (ELF on Linux), so Node parsed machine code as JS and
build:cli died with 'SyntaxError: Invalid or unexpected token', turning
dast-smoke red for every PR.
runBuildTool now sniffs the entry's magic bytes (ELF / Mach-O / PE) and
execs native binaries directly; JS entries keep going through this Node
binary (the .cmd-shim avoidance #8858 wanted).
Validation (RED->GREEN on this box):
- RED: node node_modules/esbuild/bin/esbuild --version -> SyntaxError (ELF)
- GREEN: the exact failing CI step reproduced via the new logic bundles
open-sse/mcp-server/server.ts successfully (4.2MB output, 1.3s).
* fix(docs): add MDX frontmatter to the 20 remaining docs without it
Same failure class as AGENTROUTER_WAF (#9503) and DOCKER_RELEASE_CHANNELS
(this run's dast-smoke red): any doc without frontmatter breaks the
fumadocs MDX loader during next build, killing build:cli/dast-smoke for
every PR. Swept ALL of docs/ (i18n mirrors excluded) in one pass so this
class cannot recur one file at a time.
* docs(env): document OMNIROUTE_INTERNAL_SERVICE_TOKEN(+_FILE), OPENROUTER_PROVIDER_STATS_* and embedded-Redis binding vars
Pre-existing env/docs contract drift from recently merged features made
check:env-doc-sync red for any docs-touching PR. Values and defaults read
from the defining modules (internalServiceAuth.ts, openrouterProviderStats.ts).
* fix(build): resolve bundled npm-cli.js in the standard Unix layout + safe npm fallback off-Windows
The opencode-plugin step hard-failed on GitHub runners because
resolveBundledNpmEntry only looked next to the node binary (Windows zip
layout); hostedtoolcache Node keeps npm at <prefix>/lib/node_modules/npm.
Added that candidate, and when neither exists on non-Windows the step now
falls back to plain 'npm' — the .cmd-shim hazard #8858 avoids is
Windows-only.
* test(mutation): register xai-agent-tools-passthrough.test.ts in stryker tap.testFiles
The test landed on release/v3.8.50 covering
open-sse/handlers/chatCore/passthroughHelpers.ts without the stryker
registration, so Fast Quality Gates' drift detection reds any PR that
carries it. Mechanical registration so its mutant kills count.
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
* Create WEB-COOKIE-GUIDE.md for Web Cookie providers
Added a comprehensive guide for using Web Cookie providers with OmniRoute, including setup instructions, credential formats, limitations, and troubleshooting tips.
* Fix formatting in WEB-COOKIE-GUIDE.md
* Add Web Cookie Providers section to providers guide
Added section for Web Cookie Providers with a reference to the WEB-COOKIE-GUIDE.md.
* Enhance CLAUDE_WEB.md with user guidance
Added introductory information and guidance for new users of the Claude Web provider.
Release v3.8.42 — full CHANGELOG in CHANGELOG.md.
CI: 103 checks green incl. CodeQL (all languages), Semgrep, all 8 unit shards,
coverage, Node 24 compat, and integration tests. Full unit suite validated
locally: 19437 pass / 0 fail. The 3 red checks are advisory and do not gate
main (no required status checks): SonarCloud/SonarQube new-code coverage gate,
and PR Test Policy (test-masking detector flagging the legitimate dead-Phind
provider removal in #5530 — reviewed, correct).
Includes cycle-close reconciliation + repair of inherited base-red tests from
#5480/#5527/#5427/#5521 that the PR->release fast-path did not exercise.
