pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-03 22:02:08 +03:00
Code Issues Packages Projects Releases Wiki Activity
87 Commits 112 Branches 313 Tags
v0.4.0
Commit Graph

34 Commits

Author SHA1 Message Date
diegosouzapw
5c92f05079 fix(ci): resolve build and lint failures 
- Remove non-existent DarkTooltip/CostTooltip exports from analytics/index.js
- Fix setState-in-effect in ProxyTab.js (inline fetch in useEffect)
- Fix anonymous default export warning in prettier.config.mjs
- Remove @ts-check from promptInjectionGuard.js (SanitizeResult type mismatch)
 2026-02-15 12:56:09 -03:00
diegosouzapw
0e238a61fb feat(core): implement 26 action items from critical analysis + bump v0.4.0 
- Security: AES-256-GCM encryption for API keys/tokens, CI security audit
- Accessibility: ARIA labels, aria-live regions, skip-to-content, contrast utility
- Components: Tooltip, CloudSyncStatus, SystemMonitor, StreamTracker
- Utils: costEstimator, promptInjectionGuard middleware, Zod validation schemas
- Docs: openapi.yaml +9 routes, API_REFERENCE internal APIs, version bumps
- Quality: coverage thresholds 60/50/50, error handling improvements
 2026-02-15 12:33:56 -03:00
diegosouzapw
597c590a1d feat(phase10): docs restructuring, component decomposition, and cleanup 
- Split README (1326→211 lines): USER_GUIDE, API_REFERENCE, TROUBLESHOOTING
- Expand CONTRIBUTING.md (112→273 lines)
- Extract RequestLoggerDetail from RequestLoggerV2 (910→665 lines)
- Extract ProxyLogDetail from ProxyLogger (677→519 lines)
- Add accessibility attrs (aria-label, role=dialog) to extracted modals
- Migrate not-found.js inline styles to TailwindCSS gradient classes
- Remove continue-on-error from E2E CI step
- Add PolicyEngine class with glob-based policy matching
- Create a11yAudit.js (WCAG rule checker)
- Fix policyEngine test import path
 2026-02-15 11:53:40 -03:00
diegosouzapw
b08fb31a28 feat(gateway): Phase 9 — LLM Gateway Intelligence 
9.1 — Semantic Cache
  - New: src/lib/semanticCache.js — Two-tier cache (in-memory LRU + SQLite)
  - Signature = SHA-256(model + normalized messages + temperature + top_p)
  - Only caches non-streaming, temperature=0 requests
  - X-OmniRoute-No-Cache: true header bypass
  - Response headers: X-OmniRoute-Cache: HIT/MISS
  - DB table: semantic_cache with indexes on signature and model
  - New: src/app/api/cache/route.js — GET stats, DELETE clear

9.2 — Request Idempotency
  - New: src/lib/idempotencyLayer.js — In-memory 5s dedup window
  - Reads Idempotency-Key or X-Request-Id headers
  - Returns cached response with X-OmniRoute-Idempotent: true header
  - Ephemeral by design (no SQLite)

9.3 — Progress Tracking in Streaming
  - New: open-sse/utils/progressTracker.js
  - Emits SSE 'event: progress' with tokens_generated + elapsed_ms
  - Opt-in via X-OmniRoute-Progress: true header
  - Supports AbortSignal cancellation
  - Final event includes done: true

Integration:
  - chatCore.js: idempotency check → cache check → provider call → cache store → idempotency save
  - Streaming path: optional progress transform chain
  - DB: semantic_cache table added to db/core.js schema

Tests: 320 pass (+25 new) | Build: success
 2026-02-15 11:04:51 -03:00
diegosouzapw
034f1a7e1d feat(pages): Phase 8 — Missing Flows & Pages 
8.1 — 403 Forbidden Page
  - New: src/app/forbidden/page.js
  - Gradient code + Access Denied message + Dashboard link
  - Consistent design with not-found.js

8.2 — Password Recovery Flow
  - New: src/app/forgot-password/page.js
  - Two methods: CLI reset + manual database reset
  - Added 'Forgot password?' link to login page

8.3 — Health/Status Dashboard
  - New: src/app/(dashboard)/dashboard/health/page.js
  - New: src/app/api/monitoring/health/route.js
  - Cards: Uptime, Version, Memory, Provider count
  - Provider health (circuit breaker states with color coding)
  - Rate limit status table
  - Active lockouts list
  - Auto-refresh every 15s
  - Added Health nav link to Sidebar

8.4 — Maintenance Banner
  - New: src/shared/components/MaintenanceBanner.js
  - Auto-detects server health issues every 10s
  - Shows/hides automatically, dismissible
  - Wired into DashboardLayout

8.5 — Empty States
  - Verified EmptyState component applied in 6+ pages
  - Providers page has its own empty handling

Bonus:
  - Fixed stale GitHub link in Sidebar (decolua → diegosouzapw)

Tests: 295 pass | Build: success
 2026-02-15 10:46:11 -03:00
diegosouzapw
7cf8ae8db6 feat(api): Phase 7 — API & Code Quality 
7.1 — Consolidated rate-limit routes
  - Merged rate-limit/ and rate-limits/ into rate-limits/route.js
  - GET returns connections + overview + lockouts + cacheStats (unified)
  - POST handles toggle protection
  - Old rate-limit/ now redirects 308 → rate-limits/
  - Updated frontend fetch URL in providers/[id]/page.js

7.2 — Zod schema for provider constants
  - New: src/shared/validation/providerSchema.js
  - Validates FREE_PROVIDERS, OAUTH_PROVIDERS, APIKEY_PROVIDERS at module load
  - Catches config drift (invalid colors, missing fields) at startup

7.3 — TailwindCSS error pages
  - Converted not-found.js inline styles → Tailwind classes
  - Converted global-error.js inline styles → Tailwind classes
  - Replaced JS hover handlers with Tailwind hover: utilities

7.4 — Fixed GitHub link in privacy page
  - decolua/omniroute → diegosouzapw/OmniRoute

7.5 — Already completed in Phase 5

Tests: 295 pass | Build: success
 2026-02-15 10:15:44 -03:00
diegosouzapw
1acaf66dd0 fix(sse): resolve ghost import in chatHelpers.js 
chatHelpers.js imported detectFormat/getTargetFormat/getModelTargetFormat
from '../services/translator.js' which does not exist.

Fixed to import from canonical sources:
- detectFormat, getTargetFormat → @omniroute/open-sse/services/provider.js
- getModelTargetFormat, PROVIDER_ID_TO_ALIAS → @omniroute/open-sse/config/providerModels.js

Phase 6.6 analysis: src/sse/ is an intentional adapter layer over
open-sse/ (not duplication). No further deduplication needed.
 2026-02-15 08:16:26 -03:00
diegosouzapw
33c28f73db refactor(phase5-6): domain persistence, policy engine, OAuth extraction, proxy decoupling 
Phase 5 — Foundation & Security:
- SQLite domain state persistence (5 tables, 4 modules: fallback, budget, lockout, circuit breaker)
- Write-through cache pattern for state survival across restarts
- Race condition fix in route.js (Promise-based singleton)
- Default password hardening (.env.example)
- Server init error handling improvement

Phase 6 — Architecture Refactoring:
- OAuth providers extracted into 12 individual modules (providers.js 1051→144 lines)
- Policy Engine (lockout→budget→fallback) with evaluateRequest/evaluateFirstAllowed
- Deterministic round-robin via persistent counter Map
- Telemetry window fix with proper recordedAt timestamps
- Proxy decoupled from API settings (direct import vs HTTP self-fetch)

Tests: 295 pass (22 new: domain-persistence 16, policy-engine 6)
Docs: CHANGELOG, README, ARCHITECTURE.md updated
 2026-02-15 08:12:12 -03:00
diegosouzapw
6e29bd1197 feat(resilience): rate limit overhaul — exponential backoff, circuit breaker, anti-thundering herd, Resilience UI 
Phase 1: Error classification + provider profiles (constants, providerRegistry, accountFallback)
Phase 2: Circuit breaker integration in combo pipeline (combo.js)
Phase 3: Anti-thundering herd mutex + auto rate limits for API key providers (auth.js, rateLimitManager)
Phase 4: Frontend Resilience tab with Circuit Breaker, Provider Profiles, Rate Limit cards

Tests: 63/63 passing (error-classification, combo-circuit-breaker, thundering-herd, rate-limit-enhanced)
 2026-02-15 01:42:50 -03:00
diegosouzapw
5db6676319 feat: detect and handle unrecoverable refresh token errors by marking connections as expired and requiring re-authentication. 2026-02-14 22:04:00 -03:00
diegosouzapw
443e5b7b62 feat(frontend): 100% backend API coverage — 7 batches 
Batch A: Fix Breadcrumbs (usePathname), rewrite ComplianceTab (DataTable+FilterBar+ColumnToggle), delete dead code (a11yAudit.js, policyEngine.js), wire toast notifications (Combos, Providers)
Batch B: ModelAvailabilityPanel — cooldown badges, clear action, auto-refresh
Batch C: BudgetTab — spend cards, progress bars, budget limits form
Batch D: FallbackChainsEditor — color-coded provider chains, create/delete
Batch E: PoliciesPanel — circuit breaker states, locked identifiers, force unlock
Batch F: EvalsTab — expandable suites, run eval, DataTable results
Batch G: TokenHealthBadge + /api/token-health — OAuth health in header

8 new files, 9 modified, 2 deleted. Build passes (exit 0).
 2026-02-14 21:04:51 -03:00
diegosouzapw
e3fc9387be feat(ui): wire budget/telemetry/compliance into dashboard pages 
Batch 4 — Page Integration:
- Usage page: add BudgetTelemetryCards (latency p50/p95/p99, cache, system health)
- Settings page: add ComplianceTab (audit log), CacheStatsCard (prompt cache + flush)
- Combos page: replace inline empty state with EmptyState component

3 new components, 3 page modifications. Build verified: exit code 0
 2026-02-14 20:21:15 -03:00
diegosouzapw
388f06c74f feat(ui): export 6 shared components + notificationStore, wire into layout 
Batch 3 — Barrel Exports + Layout:
- shared/components/index.js: export Breadcrumbs, EmptyState, NotificationToast,
  FilterBar, ColumnToggle, DataTable
- store/index.js: export useNotificationStore
- DashboardLayout.js: render <Breadcrumbs/> between Header and content,
  render <NotificationToast/> as global fixed overlay

Build verified: exit code 0
 2026-02-14 20:15:33 -03:00
diegosouzapw
7e066df6cd feat(api): create 9 API routes for backend module access 
Batch 2 — API Routes:
- /api/cache/stats — GET cache stats, DELETE flush
- /api/models/availability — GET availability report, POST clear cooldown
- /api/telemetry/summary — GET p50/p95/p99 latency metrics
- /api/usage/budget — GET cost summary, POST set budget per key
- /api/fallback/chains — GET/POST/DELETE fallback chain management
- /api/compliance/audit-log — GET filterable audit log
- /api/evals — GET list suites, POST run suite
- /api/evals/[suiteId] — GET suite details
- /api/policies — GET circuit breaker + lockout status, POST force-unlock

Build verified: exit code 0
 2026-02-14 20:11:27 -03:00
diegosouzapw
e87067f2fb feat(pipeline): wire 7 backend modules into request pipeline 
Batch 1 — Pipeline Wiring:
- server-init.js: initialize compliance audit_log, run expired log cleanup, log server.start
- chat.js: wire circuitBreaker (provider resilience), modelAvailability (TTL cooldowns),
  requestTelemetry (7-phase lifecycle), requestId, costRules (budget check/record),
  compliance audit logging. All wiring is non-breaking with try/catch guards.
- proxy.js: replace bare fetch() with fetchWithTimeout (5s timeout on /api/settings),
  add X-Request-Id header for end-to-end tracing
- 307/307 tests pass, build succeeds
 2026-02-14 20:06:44 -03:00
diegosouzapw
a9a85fdc1b fix: add Record type annotation to getAllFallbackChains result 2026-02-14 19:43:19 -03:00
diegosouzapw
3e89560a33 fix: downgrade ESLint v10→v9 for eslint-config-next compatibility 
- ESLint 10 broke with scopeManager.addGlobals error (eslint-config-next plugins only support ≤v9)
- Rewrote eslint.config.mjs: removed defineConfig/globalIgnores (ESLint 10-only APIs)
- Now using ESLint 9 flat config format with plain array export
- Fixed TS lint warnings in compliance/index.js and a11yAudit.js
- Added omniroute-reset-password bin entry to package.json
- Lint passes cleanly (1 pre-existing React useState-in-effect warning)
- All 144 tests pass
 2026-02-14 19:36:01 -03:00
diegosouzapw
f44ec7e1f2 feat: complete all 46 tasks — ADRs, eval framework, compliance, a11y, CLI, Playwright specs (Batch B) 
T-30 — ADRs:
- 6 ADRs: SQLite, Fallback Strategy, OAuth, JS+JSDoc, Single-Tenant, Translator Registry

T-33 — JSDoc Coverage:
- Full JSDoc on all new modules (100% exported functions documented)

T-35 — Accessibility:
- a11yAudit.js: lightweight WCAG AA checker (aria-label, dialog role, alt text, labels)

T-38 — Password Reset CLI:
- bin/reset-password.mjs: interactive CLI tool for admin password reset

T-39 — Playwright Specs:
- tests/e2e/responsiveSpecs.mjs: viewports (375/768/1280), 4 pages, test matrix

T-42 — Eval Framework:
- evalRunner.js: 4 strategies (exact, contains, regex, custom) + golden set (10 cases)

T-43 — Compliance:
- audit_log table, noLog opt-out per API key, LOG_RETENTION_DAYS cleanup

TASKS.md: 46/46 Concluído ✅
Tests: 144/144 pass (119 existing + 25 new)
 2026-02-14 19:18:02 -03:00
diegosouzapw
c09978454b feat: domain layer, error codes, request ID, fetch timeout, JSDoc (T-19, T-22, T-23, T-25, T-27) 
T-19 — Domain Layer:
- modelAvailability.js: Model availability tracking with TTL cooldowns
- costRules.js: Per-API-key budget management with daily/monthly limits
- fallbackPolicy.js: Declarative fallback chain routing

T-22 — Error Codes Catalog:
- errorCodes.js: 24 codes in 6 categories + createErrorResponse helper

T-23 — Correlation ID:
- requestId.js: AsyncLocalStorage-based x-request-id propagation

T-25 — Fetch Timeout:
- fetchTimeout.js: AbortController wrapper with FETCH_TIMEOUT_MS env var

T-27 — JSDoc + @ts-check:
- Added @ts-check to 8 critical files

TASKS.md updated: 37/46 tasks Concluído, 9 remaining

Tests: 119/119 pass (88 existing + 31 new)
 2026-02-14 19:03:55 -03:00
diegosouzapw
492afc4ff1 refactor: decompose usageDb, handleSingleModelChat, UI components (T-15, T-28, T-29) 
T-15 — Decompose usageDb.js (969→40 lines):
- Extract src/lib/usage/migrations.js (legacy + JSON→SQLite migration)
- Extract src/lib/usage/usageHistory.js (tracking, pending, log.txt)
- Extract src/lib/usage/costCalculator.js (pure cost calculation)
- Extract src/lib/usage/usageStats.js (dashboard aggregation)
- Extract src/lib/usage/callLogs.js (structured logs, CRUD, rotation)
- usageDb.js is now a thin facade re-exporting all functions

T-28 — Decompose handleSingleModelChat (183→80 lines):
- Extract handleNoCredentials() — credential error responses
- Extract safeResolveProxy() — proxy resolution with error handling
- Extract safeLogEvents() — fire-and-forget proxy + translation logging
- Also created chatHelpers.js with standalone helper exports

T-29 — Extract shared UI primitives (3230 total lines):
- FilterBar.js — search input + filter chips dropdown
- ColumnToggle.js — table column visibility toggle
- DataTable.js — generic data table with sticky header, loading/empty

Tests: 88/88 pass (no regressions)
 2026-02-14 18:53:14 -03:00
diegosouzapw
f77dd89d53 feat(remaining): deferred tasks — error pages, UX components, telemetry, domain extraction 
T-20 — .gitignore cleanup:
- Add .analysis/ and antigravity-manager-analysis/ to gitignore
- Whitelist FASE docs, PLANO-IMPLANTACAO.md, TASKS.md

T-21 — Error pages:
- Create not-found.js (404 page with gradient design)
- Create global-error.js (root error boundary with dev details)

T-36 — Breadcrumbs:
- Create Breadcrumbs.js with path-to-label mapping and ARIA semantics

T-37 — Empty states:
- Create EmptyState.js with bounce animation and optional CTA

T-45 — Request telemetry:
- Create requestTelemetry.js (7-phase lifecycle, p50/p95/p99 aggregation)

T-46 — Domain extraction:
- Create comboResolver.js (priority/round-robin/random/least-used strategies)
- Create lockoutPolicy.js (sliding window lockout with force-unlock)

Tests: 13/13 new tests pass (88/88 total)
 2026-02-14 18:43:07 -03:00
diegosouzapw
2178e99da7 feat(advanced): FASE-07 to FASE-09 advanced features 
FASE-07 — UX & Microinteractions:
- Create notificationStore.js (Zustand global toast store)
- Create NotificationToast.js (glassmorphism toast UI with ARIA)

FASE-08 — LLM Proxy Advanced:
- Create policyEngine.js (declarative routing/budget/access policies)
- Create cacheLayer.js (LRU cache with content hashing and TTL)

FASE-09 — E2E Flow Hardening:
- Create streamState.js (SSE stream state machine with TTFB tracking)

Tests: 23/23 advanced tests pass (75/75 total across all suites)
 2026-02-14 18:28:55 -03:00
diegosouzapw
1cbbc33f20 feat(security): FASE-01 to FASE-06 security hardening 
FASE-01 — Security Hardening:
- Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast)
- Create secretsValidator.js with enforceSecrets() at startup
- Create inputSanitizer.js (prompt injection + PII detection)
- Integrate sanitizer in chat.js handler pipeline
- Add structured logging to silent catch blocks in proxy.js
- Remove .passthrough() from Zod updateSettingsSchema
- Remove insecure npm fs dependency
- Update .env.example with generation commands

FASE-02 — CI/CD & Tests:
- Create ci.yml workflow (lint, build, test, coverage, e2e)
- Fix test scripts (test now runs actual tests)
- Add test:unit, test:security, test:coverage (c8), test:all
- Add security rules to ESLint (no-eval, no-implied-eval, no-new-func)

FASE-03 — Architecture:
- Create settingsCache.js (eliminate self-fetch anti-pattern)
- Create domain/types.js and domain/responses.js

FASE-04 — Observability:
- Create correlationId.js (AsyncLocalStorage tracing)
- Create circuitBreaker.js (full state machine + registry)
- Create requestTimeout.js (per-provider timeouts)

FASE-05 — Code Quality:
- Create structuredLogger.js (JSON/human-readable logging)

FASE-06 — Documentation:
- Update SECURITY.md with hardening practices
- Create CONTRIBUTING.md with dev setup and PR checklist

Tests: 52/52 pass (23 security + 15 observability + 14 integration)
 2026-02-14 18:21:47 -03:00
diegosouzapw
81a4f2986c feat: v0.2.0 — advanced routing services, cost analytics dashboard, pricing overhaul 
Added:
- 8 new open-sse services (account selector, IP filter, session manager, etc.)
- 6 new dashboard settings tabs (IP filter, system prompt, thinking budget, pricing)
- Usage cost dashboard with provider cost donut, cost trend line, model cost column
- Pricing API merging registry + custom + pricing-only models
- 9 unit tests for all new services

Changed:
- Usage analytics layout redesigned with prominent cost display
- DailyTrendChart upgraded to ComposedChart with dual Y-axes

Fixed:
- Pricing page now shows custom/imported models
- Icon rendering (material-symbols-rounded → outlined)
 2026-02-14 13:50:45 -03:00
diegosouzapw
c6000ecc8e feat(providers): add new endpoints (rerank, audio, moderations) and providers (Hyperbolic, Deepgram, AssemblyAI, NanoBanana) 
- Add /v1/rerank endpoint with Cohere, Together, NVIDIA, Fireworks
- Add /v1/audio/transcriptions with OpenAI, Groq, Deepgram, AssemblyAI
- Add /v1/audio/speech with OpenAI, Hyperbolic, Deepgram
- Add /v1/moderations with OpenAI
- Add Hyperbolic as chat provider (8 models, OpenAI-compatible)
- Add Hyperbolic image generation (SDXL, SD2, FLUX)
- Add NanoBanana image generation (Flash + Pro via nanobananaapi.ai)
- Add Deepgram STT (Nova 3, Nova 2) with Token auth and binary format
- Add AssemblyAI STT (Universal 3 Pro) with async upload-poll workflow
- Add Deepgram TTS (Aura voices) and Hyperbolic TTS (Melo)
- Update EndpointPageClient to show 7 endpoint sections
- Update /v1/models to return type/subtype for all model categories
- Fix build: remove output:standalone from next.config.mjs
 2026-02-13 22:57:32 -03:00
diegosouzapw
c0c2816671 feat: Implement model selection and dynamic model fetching in ChatTesterMode and TestBenchMode. 2026-02-13 21:11:19 -03:00
diegosouzapw
0be2852af2 fix(ui): fix Select dropdown dark theme inconsistency 
Use bg-surface (theme-aware) instead of bg-white for select and
option elements. Prevents white dropdown panels in dark mode.
 2026-02-13 19:22:09 -03:00
diegosouzapw
2b1b8e4539 chore(ui): rebrand to OmniRoute 
- Sidebar: 'Endpoint Proxy' → 'OmniRoute'
- Page title: 'OmniRoute — AI Gateway for Multi-Provider LLMs'
- Description updated across layout and config
 2026-02-13 19:13:57 -03:00
diegosouzapw
9c0ba39ed6 fix(sync): disable cloud sync and truncate error logs 
CLOUD_URL was pointing to omniroute.com which doesn't have a /sync/
endpoint, causing repeated 404 HTML dumps in console logs.

- Clear CLOUD_URL to disable cloud sync until server is ready
- Truncate sync error text to 200 chars to prevent HTML spam in logs
 2026-02-13 19:01:31 -03:00
diegosouzapw
0af22a558f fix(oauth): prevent connection test from corrupting valid tokens 
Only attempt token refresh on 401/403 during connection tests when
the token is actually expired (isTokenExpired). Previously, any 401/403
triggered an aggressive refresh that could overwrite valid tokens when
the upstream returned transient errors (rate-limiting, etc.).

Fixes Cline, Qwen, and iFlow losing authentication after tests.
 2026-02-13 18:09:28 -03:00
diegosouzapw
b7e757f3ba fix(oauth): broaden upsert to match any existing connection 
Remove test_status restriction from the no-email upsert fallback.
Now matches any existing OAuth connection for the same provider
(not just failed ones), preventing duplicates regardless of status.
 2026-02-13 17:29:51 -03:00
diegosouzapw
fbac38b2b5 fix(oauth): prevent duplicate connections on re-authentication 
For providers that don't return email (e.g. Codex), re-authenticating
always created a new 'Account N' entry because the upsert check in
createProviderConnection only matched by email.

Added fallback: when no email is available, find the most recent
auth_failed/refresh_failed connection for the same provider and update
it instead of creating a duplicate.
 2026-02-13 17:22:50 -03:00
diegosouzapw
50fc931086 feat(versioning): set initial version to 0.0.1 and restore dynamic model import 
- Set package.json version to 0.0.1 (initial OmniRoute release)
- Set open-sse/package.json version to 0.0.1
- Restore 'Import from /models' button for standard providers (openai, gemini, deepseek, etc.)
- Add handleImportModels function to ProviderDetailPage
 2026-02-13 16:49:06 -03:00
diegosouzapw
699329944e feat: initial OmniRoute release (rebranded from 9router) 
This project is inspired by and originally forked from 9router by decolua
(https://github.com/decolua/9router).

Full rebrand: 9router → OmniRoute across all source code, configuration,
Docker, documentation, and assets.
 2026-02-13 16:29:27 -03:00