fix(security): container/Fly REQUIRE_API_KEY posture + free-tier usage leak (#13679)

PR E of the #13679 insecure-defaults umbrella (items #6, #7; item #8 analyzed
as by-design, no change). The published Docker image and fly.toml shipped
without REQUIRE_API_KEY set, so a bare `docker run` (README/QUICK-START
one-liners, no --env-file) or a `fly deploy` combined "keyless" with
"world-reachable" for the anonymous /v1 LLM proxy. docker-compose.yml already
mitigates this via loopback-only binding (#12568) and correctly keeps
following the operator's own .env, so it is untouched. The npm/CLI
local-first REQUIRE_API_KEY=false default in featureFlagDefinitions.ts is
also untouched per the owner's decision.

/api/free-tier/summary ships an unconditional Access-Control-Allow-Origin: "*"
and always included the operator's own local usedThisMonth/remaining usage
regardless of auth — a low-severity info leak to any reachable origin. Both
fields are now withheld from unauthenticated callers while the intentionally
public catalog data stays served to everyone.

The gemini-SSE (openai-to-gemini-sse.ts) sub-finding needed no code change:
/v1beta/models/*:streamGenerateContent is already classified CLIENT_API and
fronted by clientApiPolicy through src/proxy.ts before the translator ever
runs, and its CORS-header echo was already hardened fail-closed by #12573.
REQUIRE_API_KEY=true (this PR's container/Fly default) closes the dependency
that finding cited. Added a locking regression test confirming this chain.

Regression tests:
- tests/unit/issue-13679-container-posture-require-api-key.test.ts
- tests/unit/issue-13679-free-tier-summary-usage-leak.test.ts
- tests/unit/issue-13679-gemini-sse-requires-api-key.test.ts (confirmation)

Refs #13679

.env.example

@@ -2748,6 +2748,13 @@ APP_LOG_TO_FILE=true
 # tokens (accessToken / refreshToken / providerSpecificData). Default OFF —
 # only non-credential metadata is synced. See docs/security/SOCKET_DEV_FINDINGS.md §5.
 # OMNIROUTE_CLOUD_SYNC_SECRETS=false
+#
+# Set to "true" to reject an UNSIGNED Cloud sync response when no local secret
+# is configured (#13679). Default OFF keeps v3.8.x back-compat for peers that
+# have not rotated in a shared secret yet; v3.9 flips the default to enforced.
+# A signature that IS present is always verified, and always rejected when
+# OMNIROUTE_CLOUD_SYNC_SECRET is unset, regardless of this flag.
+# OMNIROUTE_CLOUD_SYNC_ENFORCE_SIGNATURE=false
 
 # ─── Zed import legacy compat (v3.8.6) ──────────────────────────────────────
 # Set to "true" to fall back to the v3.8.5 one-step "import everything from

.github/workflows/ci.yml

@@ -542,6 +542,11 @@ jobs:
       # in eight. Fix is `sync-ui-keys --locale=<codes> --translate-markers`.
       - name: i18n key completeness (every locale carries every en.json key)
         run: node scripts/i18n/check-key-completeness.mjs
+      # Same gate for the CLI catalogs (bin/cli/locales). check:cli-i18n only compares
+      # pt-BR / zh-CN / zh-TW; 38 locales shipped with 1–24 of 830 keys for months
+      # (audit 2026-09-16) and the CLI silently fell back to English for them.
+      - name: i18n key completeness (CLI catalogs)
+        run: node scripts/i18n/check-key-completeness.mjs --catalog=cli
 
   # #8038: cheap glossary/protected-terms consistency gate —
   # complements i18n-ui-coverage (key parity) and the ICU `i18n` job below

.github/workflows/release-acceptance.yml

@@ -1,42 +0,0 @@
-name: Release acceptance
-
-on:
-  push:
-    branches: ["release/v*"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: release-acceptance-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  acceptance:
-    name: Release acceptance
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v5
-        with:
-          node-version: "22"
-          cache: npm
-      - run: npm ci
-      - name: Emit shadow acceptance report
-        run: |
-          node scripts/quality/validate-release-acceptance.mjs \
-            --plan tests/fixtures/release-acceptance/plan-lint.json \
-            --manifests tests/fixtures/release-acceptance/shadow-manifests \
-            --out release-acceptance-report.json
-        continue-on-error: true
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: release-acceptance-report
-          path: release-acceptance-report.json
-          if-no-files-found: ignore
-          retention-days: 30

AGENTS.md

@@ -56,7 +56,7 @@ Repository map and Reference Documentation sections below.
 | Translators   | `open-sse/translator/`  | Format conversion (OpenAI↔Claude↔Gemini)                                                                                                                                  |
 | Transformer   | `open-sse/transformer/` | Responses API ↔ Chat Completions                                                                                                                                          |
 | Services      | `open-sse/services/`    | Combo routing, rate limits, caching, etc                                                                                                                                  |
-| Database      | `src/lib/db/`           | SQLite domain modules (177 migrations)                                                                                                                                    |
+| Database      | `src/lib/db/`           | SQLite domain modules (176 migrations)                                                                                                                                    |
 | Domain/Policy | `src/domain/`           | Policy engine, cost rules, fallback logic                                                                                                                                 |
 | MCP Server    | `open-sse/mcp-server/`  | 110 tools (45 canonical + memory/skill/GitHub/pool/gamification/plugin/Notion/Obsidian/local-corpus/RTK modules), 3 transports (stdio / SSE / Streamable HTTP), 33 scopes |
 | A2A Server    | `src/lib/a2a/`          | JSON-RPC 2.0 agent protocol                                                                                                                                               |

Dockerfile

@@ -227,6 +227,18 @@ ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_MEMORY_MB}"
 ENV DATA_DIR=/app/data
 RUN mkdir -p /app/data
 
+# #13679: default the PUBLISHED image to requiring an API key. A bare
+# `docker run -p 20128:20128 … diegosouzapw/omniroute` (README/QUICK-START
+# one-liners) does not pass `--env-file .env`, so without this default the
+# anonymous /v1 LLM proxy would be both keyless AND world-reachable on the
+# published container. This does NOT change the npm/CLI local-dev default
+# (`REQUIRE_API_KEY` stays `"false"` in featureFlagDefinitions.ts) — only the
+# shipped deployment artifact's posture. docker-compose.yml is unaffected: it
+# loads the operator's own `.env` (env_file:) which overrides this ENV, and
+# already binds loopback-only by default (#12568). Override with
+# `-e REQUIRE_API_KEY=false` for an intentionally keyless deployment.
+ENV REQUIRE_API_KEY=true
+
 # `npm run build` (build-next-isolated → assembleStandalone) bundles ALL runtime
 # files into .build/next/standalone/ — .next, node_modules, migrations, scripts,
 # docs, and the previously hand-COPY'd modules below (@swc/helpers, pino-*, split2,

README.md

@@ -1268,7 +1268,7 @@ Métricas canônicas em 2026-08-24: **1.029 vídeos únicos** · **11.132.922 vi
   <tr><td nowrap><b>Runtime</b></td><td>Node.js 22.x / 24.x LTS — <code>&gt;=22.22.2 &lt;23 || &gt;=24.0.0 &lt;27</code></td></tr>
   <tr><td nowrap><b>Language</b></td><td>TypeScript 6.0 — <b>100% TypeScript</b> across <code>src/</code> and <code>open-sse/</code> (zero <code>any</code> in core since v2.0)</td></tr>
   <tr><td nowrap><b>Framework</b></td><td>Next.js 16 + React 19 + Tailwind CSS 4</td></tr>
-  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 122 domain modules, 177 migrations</td></tr>
+  <tr><td nowrap><b>Database</b></td><td>better-sqlite3 (SQLite, WAL journaling) + LowDB (JSON legacy) — 122 domain modules, 176 migrations</td></tr>
   <tr><td nowrap><b>Memory</b></td><td>SQLite FTS5 full-text + int8-quantized vector embeddings, typed decay</td></tr>
   <tr><td nowrap><b>Schemas</b></td><td>Zod 4 — MCP tool I/O validation + API contracts</td></tr>
   <tr><td nowrap><b>Protocols</b></td><td>MCP (stdio / HTTP / SSE) + A2A v0.3 (JSON-RPC 2.0 + SSE)</td></tr>

bin/cli/locales/am.json

@@ -30,7 +30,7 @@
     "opencode": "ከOpenCode ጋር የተካተተውን @omniroute/opencode-plugin ጫን እና አዋቅር"
   },
   "doctor": {
-    "title": "OmniRoute Doctor",
+    "title": "OmniRoute ዶክተር",
     "dbOk": "የውሂብ ጎታ፦ ደህና ({path})",
     "dbMissing": "የውሂብ ጎታ፦ አልተጀመረም — `omniroute setup` ያስኪዱ",
     "portOk": "ወደብ {port}፦ ይገኛል",
@@ -256,6 +256,7 @@
     "max_restarts": "ከመተው በፊት በ30s ውስጥ የሚፈቀደው ከፍተኛ የብልሽት ዳግም መጀመር ብዛት (ነባሪ፦ 2)",
     "tray": "በስርዓት ትሪ ውስጥ አስጀምር (ለዴስክቶፕ ብቻ፣ በፈቃድ)",
     "no_tray": "የስርዓት ትሪ አዶን አሰናክል",
+    "ready_timeout": "የዝግጁነት ምርመራ ጊዜ ማብቂያ በሚሊሰከንድ (እንዲሁም OMNIROUTE_READY_TIMEOUT_MS፣ ነባሪ 60000)",
     "tls_cert": "HTTPSን ለማቅረብ የTLS ሰርተፍኬት (PEM) ዱካ (OMNIROUTE_TLS_CERTም ጭምር)",
     "tls_key": "HTTPSን ለማቅረብ የTLS የግል ቁልፍ (PEM) ዱካ (OMNIROUTE_TLS_KEYም ጭምር)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP ሰርቨር እየሰራ ነው ({transport})",
     "stopped": "MCP ሰርቨር ቆሟል።",
     "restarted": "MCP ሰርቨር እንደገና ተጀምሯል።",
+    "stoppedHint": "ለማብራት `omniroute mcp enable`ን ያሂዱ።",
+    "enabled": "MCP አገልጋይ ነቅቷል።",
+    "disabled": "MCP አገልጋይ ተሰናክሏል።",
+    "enable": {
+      "description": "MCP አገልጋዩን አንቃ",
+      "transport": "ጥቅም ላይ የሚውል ማጓጓዣ፦ stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP አገልጋዩን አሰናክል"
+    },
     "call": {
       "description": "የMCP መሣሪያን በቀጥታ ይጥሩ",
       "args": "የJSON ነጋሪ እሴቶች ኦብጀክት (በቦታው)",

bin/cli/locales/el.json

@@ -256,6 +256,7 @@
     "max_restarts": "Μέγιστος αριθμός επανεκκινήσεων λόγω σφάλματος εντός 30 δευτερολέπτων πριν την οριστική διακοπή (προεπιλογή: 2)",
     "tray": "Εκκίνηση στην περιοχή ειδοποιήσεων (μόνο για επιτραπέζιους υπολογιστές, προαιρετικό)",
     "no_tray": "Απενεργοποίηση εικονιδίου περιοχής ειδοποιήσεων",
+    "ready_timeout": "Χρονικό όριο λήξης του ελέγχου ετοιμότητας σε ms (επίσης OMNIROUTE_READY_TIMEOUT_MS, προεπιλογή 60000)",
     "tls_cert": "Διαδρομή προς πιστοποιητικό TLS (PEM) για εξυπηρέτηση HTTPS (επίσης OMNIROUTE_TLS_CERT)",
     "tls_key": "Διαδρομή προς το ιδιωτικό κλειδί TLS (PEM) για εξυπηρέτηση HTTPS (επίσης OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Ο διακομιστής MCP εκτελείται ({transport})",
     "stopped": "Ο διακομιστής MCP διακόπηκε.",
     "restarted": "Ο διακομιστής MCP επανεκκινήθηκε.",
+    "stoppedHint": "Εκτελέστε `omniroute mcp enable` για να το ενεργοποιήσετε.",
+    "enabled": "Ο διακομιστής MCP ενεργοποιήθηκε.",
+    "disabled": "Ο διακομιστής MCP απενεργοποιήθηκε.",
+    "enable": {
+      "description": "Ενεργοποίηση του διακομιστή MCP",
+      "transport": "Μέθοδος μεταφοράς προς χρήση: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Απενεργοποίηση του διακομιστή MCP"
+    },
     "call": {
       "description": "Άμεση κλήση εργαλείου MCP",
       "args": "Αντικείμενο ορισμάτων JSON (ενσωματωμένο)",
@@ -1093,7 +1104,7 @@
     }
   },
   "combo": {
-    "title": "Combos",
+    "title": "Συνδυασμοί",
     "switched": "Ενεργό combo: {name}",
     "created": "Δημιουργήθηκε combo: {name}",
     "deleted": "Διαγράφηκε combo: {name}",

bin/cli/locales/et.json

@@ -30,7 +30,7 @@
     "opencode": "Installi ja seadista OpenCode'i jaoks kaasas olev @omniroute/opencode-plugin"
   },
   "doctor": {
-    "title": "OmniRoute Doctor",
+    "title": "OmniRoute'i diagnostika",
     "dbOk": "Andmebaas: korras ({path})",
     "dbMissing": "Andmebaas: pole lähtestatud — käivita `omniroute setup`",
     "portOk": "Port {port}: saadaval",
@@ -256,6 +256,7 @@
     "max_restarts": "Maksimaalne krahhijärgsete taaskäivituste arv 30 sekundi jooksul enne alla andmist (vaikimisi: 2)",
     "tray": "Käivita süsteemisalves (ainult töölaual, valikuline)",
     "no_tray": "Keela süsteemisalve ikoon",
+    "ready_timeout": "Valmisolekukontrolli ajalõpp millisekundites (ka OMNIROUTE_READY_TIMEOUT_MS, vaikimisi 60000)",
     "tls_cert": "TLS-sertifikaadi (PEM) tee HTTPS-i teenindamiseks (ka OMNIROUTE_TLS_CERT)",
     "tls_key": "TLS privaatvõtme (PEM) tee HTTPS-i teenindamiseks (ka OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP server töötab ({transport})",
     "stopped": "MCP server peatatud.",
     "restarted": "MCP server taaskäivitatud.",
+    "stoppedHint": "Selle sisselülitamiseks käivitage `omniroute mcp enable`.",
+    "enabled": "MCP-server on lubatud.",
+    "disabled": "MCP-server on keelatud.",
+    "enable": {
+      "description": "Luba MCP-server",
+      "transport": "Kasutatav transport: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Keela MCP-server"
+    },
     "call": {
       "description": "Käivita MCP tööriist otse",
       "args": "JSON argumentide objekt (otseselt sisestatud)",

bin/cli/locales/ga.json

@@ -256,6 +256,7 @@
     "max_restarts": "Uaslíon atosuithe titim laistigh de 30 sula bhfágann tú suas (réamhshocrú: 2)",
     "tray": "Tosaigh i mbosca córas (leicsitheoir amháin, roghnach)",
     "no_tray": "Díchumasaigh deilbhín bosca córas",
+    "ready_timeout": "Teorainn ama an tseiceála ullmhachta i ms (OMNIROUTE_READY_TIMEOUT_MS freisin, réamhshocrú 60000)",
     "tls_cert": "Cosán go dtí deimhniú TLS (PEM) chun HTTPS a sheirbhísiú (freisin OMNIROUTE_TLS_CERT)",
     "tls_key": "Cosán go dtí eochair phríobháideach TLS (PEM) chun HTTPS a sheirbhísiú (freisin OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Tá freastalaí MCP ag rith ({transport})",
     "stopped": "Tá freastalaí MCP stoptha.",
     "restarted": "Tá freastalaí MCP atosaíte.",
+    "stoppedHint": "Rith `omniroute mcp enable` chun é a chur ar siúl.",
+    "enabled": "Freastalaí MCP cumasaithe.",
+    "disabled": "Freastalaí MCP díchumasaithe.",
+    "enable": {
+      "description": "Cumasaigh an freastalaí MCP",
+      "transport": "Iompar le húsáid: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Díchumasaigh an freastalaí MCP"
+    },
     "call": {
       "description": "Glaoigh ar uirlis MCP go díreach",
       "args": "Réimse argóintí JSON (inlíne)",

bin/cli/locales/ha.json

@@ -256,6 +256,7 @@
     "max_restarts": "Matsakaicin sake farawa bayan rushewa cikin daƙiƙa 30 kafin a haƙura (tsoho: 2)",
     "tray": "Fara a tiren tsarin (na kwamfutar tebur kawai, sai an zaɓa)",
     "no_tray": "Kashe gunkin tiren tsarin",
+    "ready_timeout": "Lokacin ƙarewar gwajin shiri a ms (har ila yau OMNIROUTE_READY_TIMEOUT_MS, tsoho 60000)",
     "tls_cert": "Hanyar zuwa takardar shaidar TLS (PEM) don samar da HTTPS (haka kuma OMNIROUTE_TLS_CERT)",
     "tls_key": "Hanyar zuwa maɓallin sirri na TLS (PEM) don samar da HTTPS (haka kuma OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Sabar MCP tana aiki ({transport})",
     "stopped": "An dakatar da sabar MCP.",
     "restarted": "An sake kunna sabar MCP.",
+    "stoppedHint": "Gudanar da `omniroute mcp enable` don kunna shi.",
+    "enabled": "An kunna sabar MCP.",
+    "disabled": "An kashe sabar MCP.",
+    "enable": {
+      "description": "Kunna sabar MCP",
+      "transport": "Hanyar jigilar da za a yi amfani da ita: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Kashe sabar MCP"
+    },
     "call": {
       "description": "Kira kayan aikin MCP kai tsaye",
       "args": "Abun hujjojin JSON (a cikin layi)",
@@ -475,7 +486,7 @@
     }
   },
   "tunnel": {
-    "title": "Tunnels",
+    "title": "Ramuka",
     "listDescription": "Jera tunnels masu aiki",
     "createDescription": "Ƙirƙiri tunnel",
     "created": "An ƙirƙiri tunnel: {url}",

bin/cli/locales/hr.json

@@ -256,6 +256,7 @@
     "max_restarts": "Maksimalni broj ponovnih pokretanja nakon pada unutar 30 s prije odustajanja (zadano: 2)",
     "tray": "Pokretanje u programskoj traci (samo za stolna računala, po izboru)",
     "no_tray": "Onemogući ikonu programske trake",
+    "ready_timeout": "Vremensko ograničenje provjere spremnosti u ms (također OMNIROUTE_READY_TIMEOUT_MS, zadano 60000)",
     "tls_cert": "Putanja do TLS certifikata (PEM) za posluživanje HTTPS-a (također OMNIROUTE_TLS_CERT)",
     "tls_key": "Putanja do TLS privatnog ključa (PEM) za posluživanje HTTPS-a (također OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP poslužitelj je pokrenut ({transport})",
     "stopped": "MCP poslužitelj je zaustavljen.",
     "restarted": "MCP poslužitelj je ponovo pokrenut.",
+    "stoppedHint": "Pokrenite `omniroute mcp enable` da biste ga uključili.",
+    "enabled": "MCP poslužitelj omogućen.",
+    "disabled": "MCP poslužitelj onemogućen.",
+    "enable": {
+      "description": "Omogući MCP poslužitelj",
+      "transport": "Prijenos koji će se koristiti: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Onemogući MCP poslužitelj"
+    },
     "call": {
       "description": "Izravno pozovi MCP alat",
       "args": "JSON objekt argumenata (unutarnji)",

bin/cli/locales/hy.json

@@ -256,6 +256,7 @@
     "max_restarts": "Վթարից հետո վերագործարկումների առավելագույն քանակը 30 վրկ-ի ընթացքում՝ մինչև փորձերը դադարեցնելը (լռելյայն՝ 2)",
     "tray": "Գործարկել համակարգային սկուտեղում (միայն աշխատասեղանի տարբերակում, ըստ ցանկության)",
     "no_tray": "Անջատել համակարգային սկուտեղի պատկերակը",
+    "ready_timeout": "Պատրաստության ստուգման սպասաժամը՝ մվ-ով (նաև OMNIROUTE_READY_TIMEOUT_MS, լռելյայն՝ 60000)",
     "tls_cert": "HTTPS սպասարկելու համար TLS վկայագրի (PEM) ուղին (նաև՝ OMNIROUTE_TLS_CERT)",
     "tls_key": "HTTPS սպասարկելու համար TLS գաղտնի բանալու (PEM) ուղին (նաև՝ OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP սերվերը գործարկված է ({transport})",
     "stopped": "MCP սերվերը կանգնեցվել է։",
     "restarted": "MCP սերվերը վերագործարկվել է։",
+    "stoppedHint": "Այն միացնելու համար գործարկեք `omniroute mcp enable` հրամանը։",
+    "enabled": "MCP սերվերը միացված է։",
+    "disabled": "MCP սերվերն անջատված է։",
+    "enable": {
+      "description": "Միացնել MCP սերվերը",
+      "transport": "Օգտագործվող փոխադրման եղանակը՝ stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Անջատել MCP սերվերը"
+    },
     "call": {
       "description": "Անմիջապես կանչել MCP գործիք",
       "args": "JSON արգումենտների օբյեկտ (ներտողային)",

bin/cli/locales/ig.json

@@ -256,6 +256,7 @@
     "max_restarts": "Ọnụọgụ mmalitegharị kachasị elu mgbe ọ dara n'ime 30s tupu ịkwụsị mbọ (ndabara: 2)",
     "tray": "Malite na tray sistemụ (naanị na desktọpụ, ma ọ bụrụ na ahọrọ ya)",
     "no_tray": "Gbanyụọ akara ngosi tray sistemụ",
+    "ready_timeout": "Oge njedebe nyocha ịdị njikere na ms (yana OMNIROUTE_READY_TIMEOUT_MS, ndabara bụ 60000)",
     "tls_cert": "Ụzọ gaa na asambodo TLS (PEM) iji nye HTTPS (nakwa OMNIROUTE_TLS_CERT)",
     "tls_key": "Ụzọ gaa na igodo nzuzo TLS (PEM) iji nye HTTPS (nakwa OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Sava MCP na-arụ ọrụ ({transport})",
     "stopped": "Sava MCP akwụsịla.",
     "restarted": "Amalitegharịrị sava MCP.",
+    "stoppedHint": "Gbaa `omniroute mcp enable` iji gbanye ya.",
+    "enabled": "Agbanyela sava MCP.",
+    "disabled": "Agbanyụọla sava MCP.",
+    "enable": {
+      "description": "Gbanye sava MCP",
+      "transport": "Usoro mbufe a ga-eji: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Gbanyụọ sava MCP"
+    },
     "call": {
       "description": "Kpọọ ngwa MCP ozugbo",
       "args": "Ihe arụmụka JSON (n'ime ahịrị)",

bin/cli/locales/ka.json

@@ -256,6 +256,7 @@
     "max_restarts": "30 წამში ავარიული გათიშვის შემდეგ ხელახალი გაშვებების მაქსიმალური რაოდენობა დანებებამდე (ნაგულისხმევი: 2)",
     "tray": "სისტემურ უჯრაში გაშვება (მხოლოდ დესკტოპისთვის, სურვილისამებრ)",
     "no_tray": "სისტემური უჯრის ხატულის გამორთვა",
+    "ready_timeout": "მზადყოფნის შემოწმების მოლოდინის დრო მილიწამებში (ასევე OMNIROUTE_READY_TIMEOUT_MS, ნაგულისხმევად 60000)",
     "tls_cert": "HTTPS-ისთვის TLS სერტიფიკატის (PEM) გზა (ასევე OMNIROUTE_TLS_CERT)",
     "tls_key": "HTTPS-ისთვის TLS პირადი გასაღების (PEM) გზა (ასევე OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP სერვერი მუშაობს ({transport})",
     "stopped": "MCP სერვერი გაჩერდა.",
     "restarted": "MCP სერვერი გადაიტვირთა.",
+    "stoppedHint": "მის ჩასართავად გაუშვით `omniroute mcp enable`.",
+    "enabled": "MCP სერვერი ჩართულია.",
+    "disabled": "MCP სერვერი გამორთულია.",
+    "enable": {
+      "description": "MCP სერვერის ჩართვა",
+      "transport": "გამოსაყენებელი ტრანსპორტი: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP სერვერის გამორთვა"
+    },
     "call": {
       "description": "MCP ხელსაწყოს პირდაპირ გამოძახება",
       "args": "JSON არგუმენტების ობიექტი (ჩაშენებული)",

bin/cli/locales/km.json

@@ -86,7 +86,7 @@
     }
   },
   "keys": {
-    "title": "API Keys",
+    "title": "សោ API",
     "addDescription": "បន្ថែម ឬធ្វើបច្ចុប្បន្នភាព API key សម្រាប់អ្នកផ្តល់សេវា",
     "listDescription": "រាយ API keys ដែលបានកំណត់រចនាសម្ព័ន្ធទាំងអស់",
     "removeDescription": "លុប API key សម្រាប់អ្នកផ្តល់សេវា",
@@ -226,7 +226,7 @@
     "description": "ផ្ញើ chat prompt មួយលើកទៅ OmniRoute",
     "file": "អាន prompt ពីឯកសារ",
     "stdin": "អាន prompt ពី stdin",
-    "system": "System prompt",
+    "system": "ប្រូមប្រព័ន្ធ",
     "model": "Model ID (លំនាំដើម៖ auto)",
     "max_tokens": "ចំនួន token អតិបរមាក្នុងការឆ្លើយតប",
     "temperature": "សីតុណ្ហភាព sampling (0–2)",
@@ -256,6 +256,7 @@
     "max_restarts": "ចំនួនអតិបរមានៃការចាប់ផ្តើមឡើងវិញបន្ទាប់ពីគាំងក្នុងរយៈពេល 30s មុនពេលបោះបង់ (លំនាំដើម៖ 2)",
     "tray": "ចាប់ផ្ដើមក្នុងថាសប្រព័ន្ធ (សម្រាប់កុំព្យូទ័រលើតុប៉ុណ្ណោះ និងត្រូវជ្រើសរើសបើក)",
     "no_tray": "បិទរូបតំណាងថាសប្រព័ន្ធ",
+    "ready_timeout": "រយៈពេលអស់ពេលនៃការត្រួតពិនិត្យភាពរួចរាល់ គិតជាមិល្លីវិនាទី (ក៏អាចប្រើ OMNIROUTE_READY_TIMEOUT_MS ផងដែរ, លំនាំដើម 60000)",
     "tls_cert": "ផ្លូវទៅកាន់វិញ្ញាបនបត្រ TLS (PEM) សម្រាប់បម្រើ HTTPS (ក៏ជា OMNIROUTE_TLS_CERT ផងដែរ)",
     "tls_key": "ផ្លូវទៅកាន់សោឯកជន TLS (PEM) សម្រាប់បម្រើ HTTPS (ក៏ជា OMNIROUTE_TLS_KEY ផងដែរ)"
   },
@@ -347,6 +348,16 @@
     "running": "ម៉ាស៊ីនមេ MCP កំពុងដំណើរការ ({transport})",
     "stopped": "ម៉ាស៊ីនមេ MCP បានឈប់ដំណើរការ។",
     "restarted": "ម៉ាស៊ីនមេ MCP បានចាប់ផ្តើមឡើងវិញ។",
+    "stoppedHint": "ដំណើរការ `omniroute mcp enable` ដើម្បីបើកវា។",
+    "enabled": "ម៉ាស៊ីនមេ MCP ត្រូវបានបើក។",
+    "disabled": "ម៉ាស៊ីនមេ MCP ត្រូវបានបិទ។",
+    "enable": {
+      "description": "បើកម៉ាស៊ីនមេ MCP",
+      "transport": "មធ្យោបាយបញ្ជូនដែលត្រូវប្រើ៖ stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "បិទម៉ាស៊ីនមេ MCP"
+    },
     "call": {
       "description": "ហៅប្រើឧបករណ៍ MCP ដោយផ្ទាល់",
       "args": "អាប់ជិចអាគុយម៉ង់ JSON (ក្នុងបន្ទាត់)",

bin/cli/locales/kn.json

@@ -256,6 +256,7 @@
     "max_restarts": "ಬಿಟ್ಟುಕೊಡುವ ಮೊದಲು 30s ಒಳಗೆ ಕ್ರ್ಯಾಶ್ನಿಂದ ಗರಿಷ್ಠ ಮರುಪ್ರಾರಂಭಗಳ ಸಂಖ್ಯೆ (ಡೀಫಾಲ್ಟ್: 2)",
     "tray": "ಸಿಸ್ಟಮ್ ಟ್ರೇಯಲ್ಲಿ ಪ್ರಾರಂಭಿಸಿ (ಡೆಸ್ಕ್ಟಾಪ್ ಮಾತ್ರ, ಆಯ್ಕೆ ಮಾಡಿದಲ್ಲಿ)",
     "no_tray": "ಸಿಸ್ಟಮ್ ಟ್ರೇ ಐಕಾನ್ ನಿಷ್ಕ್ರಿಯಗೊಳಿಸಿ",
+    "ready_timeout": "ಸಿದ್ಧತಾ ಪ್ರೋಬ್ ಕಾಲಮಿತಿ ಮಿಲಿಸೆಕೆಂಡುಗಳಲ್ಲಿ (OMNIROUTE_READY_TIMEOUT_MS ಕೂಡ, ಡೀಫಾಲ್ಟ್ 60000)",
     "tls_cert": "HTTPS ಒದಗಿಸಲು TLS ಪ್ರಮಾಣಪತ್ರದ (PEM) ಪಥ (OMNIROUTE_TLS_CERT ಸಹ)",
     "tls_key": "HTTPS ಒದಗಿಸಲು TLS ಖಾಸಗಿ ಕೀಲಿಯ (PEM) ಪಥ (OMNIROUTE_TLS_KEY ಸಹ)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP ಸರ್ವರ್ ಚಾಲನೆಯಲ್ಲಿದೆ ({transport})",
     "stopped": "MCP ಸರ್ವರ್ ನಿಲ್ಲಿಸಲಾಗಿದೆ.",
     "restarted": "MCP ಸರ್ವರ್ ಮರುಪ್ರಾರಂಭಿಸಲಾಗಿದೆ.",
+    "stoppedHint": "ಇದನ್ನು ಸಕ್ರಿಯಗೊಳಿಸಲು `omniroute mcp enable` ಅನ್ನು ಚಲಾಯಿಸಿ.",
+    "enabled": "MCP ಸರ್ವರ್ ಸಕ್ರಿಯಗೊಳಿಸಲಾಗಿದೆ.",
+    "disabled": "MCP ಸರ್ವರ್ ನಿಷ್ಕ್ರಿಯಗೊಳಿಸಲಾಗಿದೆ.",
+    "enable": {
+      "description": "MCP ಸರ್ವರ್ ಅನ್ನು ಸಕ್ರಿಯಗೊಳಿಸಿ",
+      "transport": "ಬಳಸಬೇಕಾದ ಟ್ರಾನ್ಸ್ಪೋರ್ಟ್: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP ಸರ್ವರ್ ಅನ್ನು ನಿಷ್ಕ್ರಿಯಗೊಳಿಸಿ"
+    },
     "call": {
       "description": "MCP ಟೂಲ್ ಅನ್ನು ನೇರವಾಗಿ ಆಹ್ವಾನಿಸಿ",
       "args": "JSON ಆರ್ಗ್ಯುಮೆಂಟ್ಗಳ ಆಬ್ಜೆಕ್ಟ್ (ಇನ್ಲೈನ್)",

bin/cli/locales/lt.json

@@ -256,6 +256,7 @@
     "max_restarts": "Didžiausias paleidimų iš naujo po strigties skaičius per 30 s prieš nutraukiant bandymus (numatyta: 2)",
     "tray": "Paleisti sistemos dėkle (tik darbalaukio programoje, pasirenkama)",
     "no_tray": "Išjungti sistemos dėklo piktogramą",
+    "ready_timeout": "Parengties patikros skirtasis laikas ms (taip pat OMNIROUTE_READY_TIMEOUT_MS, numatytoji reikšmė 60000)",
     "tls_cert": "Kelias į TLS sertifikatą (PEM), skirtą HTTPS teikti (taip pat OMNIROUTE_TLS_CERT)",
     "tls_key": "Kelias į privatųjį TLS raktą (PEM), skirtą HTTPS teikti (taip pat OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP serveris veikia ({transport})",
     "stopped": "MCP serveris sustabdytas.",
     "restarted": "MCP serveris paleistas iš naujo.",
+    "stoppedHint": "Norėdami jį įjungti, paleiskite `omniroute mcp enable`.",
+    "enabled": "MCP serveris įjungtas.",
+    "disabled": "MCP serveris išjungtas.",
+    "enable": {
+      "description": "Įjungti MCP serverį",
+      "transport": "Naudotinas perdavimo būdas: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Išjungti MCP serverį"
+    },
     "call": {
       "description": "Tiesiogiai iškviesti MCP įrankį",
       "args": "JSON argumentų objektas (įterptasis)",

bin/cli/locales/lv.json

@@ -256,6 +256,7 @@
     "max_restarts": "Maksimālās avāriju restartēšanas 30 sekunžu laikā pirms padoties (noklusējums: 2)",
     "tray": "Sākt sistēmas tray (tikai darbvirsmas, izvēlēties)",
     "no_tray": "Atspējot sistēmas tray ikonu",
+    "ready_timeout": "Gatavības pārbaudes taimauts milisekundēs (arī OMNIROUTE_READY_TIMEOUT_MS, noklusējuma vērtība 60000)",
     "tls_cert": "Ceļš uz TLS sertifikātu (PEM) HTTPS apkalpošanai (arī OMNIROUTE_TLS_CERT)",
     "tls_key": "Ceļš uz TLS privāto atslēgu (PEM) HTTPS apkalpošanai (arī OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP serveris darbojas ({transport})",
     "stopped": "MCP serveris apturēts.",
     "restarted": "MCP serveris restartēts.",
+    "stoppedHint": "Lai to ieslēgtu, palaidiet `omniroute mcp enable`.",
+    "enabled": "MCP serveris ir iespējots.",
+    "disabled": "MCP serveris ir atspējots.",
+    "enable": {
+      "description": "Iespējot MCP serveri",
+      "transport": "Izmantojamais transports: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Atspējot MCP serveri"
+    },
     "call": {
       "description": "Izsaukt MCP rīku tieši",
       "args": "JSON argumentu objekts (iekšējais)",

bin/cli/locales/ml.json

@@ -256,6 +256,7 @@
     "max_restarts": "ഉപേക്ഷിക്കുന്നതിന് മുമ്പ് 30s-നുള്ളിൽ അനുവദിക്കുന്ന പരമാവധി ക്രാഷ് പുനരാരംഭങ്ങൾ (ഡിഫോൾട്ട്: 2)",
     "tray": "സിസ്റ്റം ട്രേയിൽ ആരംഭിക്കുക (ഡെസ്ക്ടോപ്പിൽ മാത്രം, സ്വമേധയാ തിരഞ്ഞെടുക്കാവുന്നത്)",
     "no_tray": "സിസ്റ്റം ട്രേ ഐക്കൺ പ്രവർത്തനരഹിതമാക്കുക",
+    "ready_timeout": "റെഡിനസ് പ്രോബ് സമയപരിധി ms-ൽ (OMNIROUTE_READY_TIMEOUT_MS എന്നതും, സ്ഥിരസ്ഥിതി 60000)",
     "tls_cert": "HTTPS നൽകുന്നതിനുള്ള TLS സർട്ടിഫിക്കറ്റിന്റെ (PEM) പാത (OMNIROUTE_TLS_CERT-ലും)",
     "tls_key": "HTTPS നൽകുന്നതിനുള്ള TLS സ്വകാര്യ കീയുടെ (PEM) പാത (OMNIROUTE_TLS_KEY-ലും)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP സെർവർ പ്രവർത്തിക്കുന്നു ({transport})",
     "stopped": "MCP സെർവർ നിർത്തി.",
     "restarted": "MCP സെർവർ പുനരാരംഭിച്ചു.",
+    "stoppedHint": "ഇത് പ്രവർത്തനക്ഷമമാക്കാൻ `omniroute mcp enable` പ്രവർത്തിപ്പിക്കുക.",
+    "enabled": "MCP സെർവർ പ്രവർത്തനക്ഷമമാക്കി.",
+    "disabled": "MCP സെർവർ പ്രവർത്തനരഹിതമാക്കി.",
+    "enable": {
+      "description": "MCP സെർവർ പ്രവർത്തനക്ഷമമാക്കുക",
+      "transport": "ഉപയോഗിക്കേണ്ട ട്രാൻസ്പോർട്ട്: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP സെർവർ പ്രവർത്തനരഹിതമാക്കുക"
+    },
     "call": {
       "description": "ഒരു MCP ടൂൾ നേരിട്ട് പ്രവർത്തിപ്പിക്കുക",
       "args": "JSON ആർഗ്യുമെന്റുകളുടെ ഒബ്ജക്റ്റ് (ഇൻലൈൻ)",

bin/cli/locales/mt.json

@@ -256,6 +256,7 @@
     "max_restarts": "L-ogħla numru ta' restarts wara crash fi żmien 30s qabel ma jċedi (default: 2)",
     "tray": "Bda' fil-caffettar tal-pajjiż (biss desktop, għażla)",
     "no_tray": "Iddiżattiva l-ikona tal-caffettar tal-pajjiż",
+    "ready_timeout": "Limitu taż-żmien tal-verifika tat-tħejjija f'ms (ukoll OMNIROUTE_READY_TIMEOUT_MS, valur predefinit 60000)",
     "tls_cert": "Triq għal ċertifikat TLS (PEM) biex isservi HTTPS (ukoll OMNIROUTE_TLS_CERT)",
     "tls_key": "Triq għas-sieqa privata tal-TLS (PEM) biex isservi HTTPS (ukoll OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Servier MCP qed jaħdem ({transport})",
     "stopped": "Servier MCP waqaf.",
     "restarted": "Servier MCP restartat.",
+    "stoppedHint": "Ħaddem `omniroute mcp enable` biex tattivah.",
+    "enabled": "Is-server MCP huwa attivat.",
+    "disabled": "Is-server MCP huwa diżattivat.",
+    "enable": {
+      "description": "Attiva s-server MCP",
+      "transport": "Trasport li għandu jintuża: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Iddiżattiva s-server MCP"
+    },
     "call": {
       "description": "Sejjaħ għodda MCP direttament",
       "args": "Oġġett argomenti JSON (internament)",

bin/cli/locales/my.json

@@ -26,7 +26,7 @@
     "testFailed": "Provider စမ်းသပ်မှု မအောင်မြင်ပါ: {error}",
     "loginEnabled": "လော့ဂ်အင်: ဖွင့်ထားသည် (စကားဝှက်ကို အပ်ဒိတ်လုပ်ပြီး)",
     "loginDisabled": "လော့ဂ်အင်: ပိတ်ထားသည်",
-    "providerInfo": "Provider: {info}",
+    "providerInfo": "ပံ့ပိုးသူ: {info}",
     "opencode": "OpenCode အတွက် တွဲဖက်ပါရှိသော @omniroute/opencode-plugin ကို ထည့်သွင်းပြီး စီစဉ်သတ်မှတ်ရန်"
   },
   "doctor": {
@@ -41,7 +41,7 @@
     "warnings": "သတိပေးချက် {count} ခု — အပေါ်တွင် ကြည့်ပါ။"
   },
   "providers": {
-    "title": "Providers",
+    "title": "ပံ့ပိုးသူများ",
     "noProviders": "မည်သည့် provider ကိုမျှ စီစဉ်သတ်မှတ်မထားပါ။ လုပ်ဆောင်ရန်: omniroute setup",
     "testing": "{name} ကို စမ်းသပ်နေသည်...",
     "available": "အသုံးပြုနိုင်သော provider {count} ခု",
@@ -86,7 +86,7 @@
     }
   },
   "keys": {
-    "title": "API Keys",
+    "title": "API သော့များ",
     "addDescription": "ဝန်ဆောင်မှုပေးသူတစ်ခုအတွက် API key ကို ထည့်ရန် သို့မဟုတ် အပ်ဒိတ်လုပ်ရန်",
     "listDescription": "ပြင်ဆင်သတ်မှတ်ထားသော API key အားလုံးကို စာရင်းပြုစုရန်",
     "removeDescription": "ဝန်ဆောင်မှုပေးသူတစ်ခုအတွက် API key ကို ဖယ်ရှားရန်",
@@ -152,7 +152,7 @@
     "file": "ဖိုင်မှ prompt ကို ဖတ်ပါ",
     "stdin": "stdin မှ prompt ကို ဖတ်ပါ",
     "model": "Model ID (မူလသတ်မှတ်ချက်: auto)",
-    "system": "System prompt",
+    "system": "စနစ်ညွှန်ကြားချက်",
     "combo": "သတ်မှတ်ထားသော combo တစ်ခုကို အမည်ဖြင့် မဖြစ်မနေ အသုံးပြုပါ",
     "max_tokens": "Response အတွင်း အများဆုံး token အရေအတွက်",
     "responses_api": "/v1/chat/completions အစား /v1/responses ကို အသုံးပြုပါ",
@@ -226,7 +226,7 @@
     "description": "OmniRoute သို့ တစ်ကြိမ်တည်းသုံး chat prompt ပို့ရန်",
     "file": "ဖိုင်မှ prompt ကို ဖတ်ရန်",
     "stdin": "stdin မှ prompt ကို ဖတ်ရန်",
-    "system": "System prompt",
+    "system": "စနစ်ညွှန်ကြားချက်",
     "model": "Model ID (မူလသတ်မှတ်ချက်: auto)",
     "max_tokens": "တုံ့ပြန်ချက်တွင် ပါဝင်မည့် token အရေအတွက် အများဆုံး",
     "temperature": "နမူနာရွေးချယ်မှု temperature (0–2)",
@@ -256,6 +256,7 @@
     "max_restarts": "လက်လျှော့မတိုင်မီ 30s အတွင်း ပျက်သွား၍ ပြန်လည်စတင်နိုင်သည့် အများဆုံးအကြိမ်ရေ (မူလသတ်မှတ်ချက်: 2)",
     "tray": "စနစ် tray တွင် စတင်ပါ (desktop အတွက်သာ၊ ရွေးချယ်ဖွင့်သုံးရန်)",
     "no_tray": "စနစ် tray အိုင်ကွန်ကို ပိတ်ပါ",
+    "ready_timeout": "အဆင်သင့်ဖြစ်မှု စစ်ဆေးချက်၏ အချိန်ကုန်ဆုံးကာလကို ms ဖြင့် သတ်မှတ်ပါ (OMNIROUTE_READY_TIMEOUT_MS လည်းဖြစ်ပြီး မူလတန်ဖိုးမှာ 60000 ဖြစ်သည်)",
     "tls_cert": "HTTPS ဖြင့် ဝန်ဆောင်မှုပေးရန် TLS certificate (PEM) သို့ လမ်းကြောင်း (OMNIROUTE_TLS_CERT လည်းဖြစ်သည်)",
     "tls_key": "HTTPS ဖြင့် ဝန်ဆောင်မှုပေးရန် TLS private key (PEM) သို့ လမ်းကြောင်း (OMNIROUTE_TLS_KEY လည်းဖြစ်သည်)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP ဆာဗာ လည်ပတ်နေသည် ({transport})",
     "stopped": "MCP ဆာဗာ ရပ်တန့်သွားပါပြီ။",
     "restarted": "MCP ဆာဗာကို ပြန်လည်စတင်ပြီးပါပြီ။",
+    "stoppedHint": "၎င်းကို ဖွင့်ရန် `omniroute mcp enable` ကို လုပ်ဆောင်ပါ။",
+    "enabled": "MCP ဆာဗာကို ဖွင့်ထားသည်။",
+    "disabled": "MCP ဆာဗာကို ပိတ်ထားသည်။",
+    "enable": {
+      "description": "MCP ဆာဗာကို ဖွင့်ရန်",
+      "transport": "အသုံးပြုမည့် ပို့ဆောင်မှုနည်းလမ်း: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP ဆာဗာကို ပိတ်ရန်"
+    },
     "call": {
       "description": "MCP ကိရိယာတစ်ခုကို တိုက်ရိုက် ခေါ်ယူအသုံးပြုရန်",
       "args": "JSON အငြင်းပွားဖွယ်ရာ အရာဝတ္ထု (စာကြောင်းအတွင်း)",
@@ -633,7 +644,7 @@
       "content": "Memory စာသားအကြောင်းအရာ",
       "file": "ဖိုင်မှ အကြောင်းအရာကို ဖတ်ရန်",
       "type": "Memory အမျိုးအစား (မူလသတ်မှတ်ချက်: user)",
-      "metadata": "JSON metadata object",
+      "metadata": "JSON မက်တာဒေတာ အရာဝတ္ထု",
       "api_key": "API key နှင့် ချိတ်ဆက်ရန်"
     },
     "clear": {
@@ -667,7 +678,7 @@
     },
     "start": {
       "description": "provider တစ်ခုအတွက် OAuth ခွင့်ပြုချက် flow ကို စတင်ရန်",
-      "provider": "Provider ID (gemini, copilot, cursor, …)",
+      "provider": "ပံ့ပိုးသူ ID (gemini, copilot, cursor, …)",
       "no_browser": "URL ကိုသာ ဖော်ပြရန် — browser ကို မဖွင့်ပါနှင့်",
       "import_system": "စက်တွင်း system config မှ အထောက်အထားများကို အလိုအလျောက် ထည့်သွင်းရန်",
       "social": "Social login provider (google|github) — kiro အတွက် လိုအပ်သည်",
@@ -704,7 +715,7 @@
         "prompt_file": "ဖိုင်မှ prompt ကို ဖတ်ရန်",
         "repo": "လုပ်ဆောင်စရာအတွက် clone ပြုလုပ်မည့် repository URL",
         "branch": "အသုံးပြုမည့် branch အမည်",
-        "metadata": "JSON metadata object"
+        "metadata": "JSON မက်တာဒေတာ အရာဝတ္ထု"
       },
       "list": {
         "description": "agent လုပ်ဆောင်စရာများကို စာရင်းပြုရန်",
@@ -1268,7 +1279,7 @@
     "description": "LLM ဖြင့် အပြန်အလှန် ဆွေးနွေးမှုအကြိမ်များစွာ ပြုလုပ်နိုင်သော REPL",
     "model": "အသုံးပြုမည့် မော်ဒယ် (ပုံသေ- auto)",
     "combo": "အသုံးပြုမည့် Combo အမည်",
-    "system": "System prompt",
+    "system": "စနစ်ညွှန်ကြားချက်",
     "resume": "သိမ်းဆည်းထားသော session ကို အမည်ဖြင့် ပြန်လည်စတင်ရန်"
   },
   "plugin": {

bin/cli/locales/ne.json

@@ -226,11 +226,11 @@
     "description": "OmniRoute मा एकपटकको chat prompt पठाउनुहोस्",
     "file": "file बाट prompt पढ्नुहोस्",
     "stdin": "stdin बाट prompt पढ्नुहोस्",
-    "system": "System prompt",
+    "system": "प्रणाली प्रम्प्ट",
     "model": "Model ID (पूर्वनिर्धारित: auto)",
     "max_tokens": "response मा अधिकतम tokens",
     "temperature": "sampling temperature (0–2)",
-    "top_p": "Top-p nucleus sampling",
+    "top_p": "Top-p न्युक्लियस नमुना चयन",
     "reasoning_effort": "तर्क प्रयासको स्तर (low|medium|high)",
     "thinking_budget": "विस्तारित सोचाइको token बजेट",
     "combo": "नामद्वारा कुनै विशिष्ट combo प्रयोग गर्न बाध्य पार्नुहोस्",
@@ -256,6 +256,7 @@
     "max_restarts": "प्रयास छोड्नुअघि 30s भित्र क्र्यासपछि पुनः सुरु गर्ने अधिकतम सङ्ख्या (पूर्वनिर्धारित: 2)",
     "tray": "सिस्टम ट्रेमा सुरु गर्नुहोस् (डेस्कटपमा मात्र, स्वैच्छिक)",
     "no_tray": "सिस्टम ट्रे आइकन असक्षम गर्नुहोस्",
+    "ready_timeout": "मिलिसेकेन्डमा तत्परता प्रोबको समयसीमा (OMNIROUTE_READY_TIMEOUT_MS पनि, पूर्वनिर्धारित 60000)",
     "tls_cert": "HTTPS सेवा दिन TLS प्रमाणपत्र (PEM) को पथ (OMNIROUTE_TLS_CERT पनि)",
     "tls_key": "HTTPS सेवा दिन TLS निजी कुञ्जी (PEM) को पथ (OMNIROUTE_TLS_KEY पनि)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP सर्भर चलिरहेको छ ({transport})",
     "stopped": "MCP सर्भर रोकियो।",
     "restarted": "MCP सर्भर पुनः सुरु गरियो।",
+    "stoppedHint": "यसलाई सक्रिय गर्न `omniroute mcp enable` चलाउनुहोस्।",
+    "enabled": "MCP सर्भर सक्रिय गरियो।",
+    "disabled": "MCP सर्भर निष्क्रिय गरियो।",
+    "enable": {
+      "description": "MCP सर्भर सक्रिय गर्नुहोस्",
+      "transport": "प्रयोग गर्ने ट्रान्सपोर्ट: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP सर्भर निष्क्रिय गर्नुहोस्"
+    },
     "call": {
       "description": "MCP उपकरणलाई सिधै आह्वान गर्नुहोस्",
       "args": "JSON आर्गुमेन्ट अब्जेक्ट (इनलाइन)",

bin/cli/locales/or.json

@@ -256,6 +256,7 @@
     "max_restarts": "ହାର ମାନିବା ପୂର୍ବରୁ 30s ମଧ୍ୟରେ ସର୍ବାଧିକ କ୍ରାଶ୍ ପୁନଃଆରମ୍ଭ ସଂଖ୍ୟା (ଡିଫଲ୍ଟ: 2)",
     "tray": "ସିଷ୍ଟମ୍ ଟ୍ରେରେ ଆରମ୍ଭ କରନ୍ତୁ (କେବଳ ଡେସ୍କଟପ୍, ଇଚ୍ଛାଧୀନ)",
     "no_tray": "ସିଷ୍ଟମ୍ ଟ୍ରେ ଆଇକନ୍ ଅକ୍ଷମ କରନ୍ତୁ",
+    "ready_timeout": "ମିଲିସେକେଣ୍ଡରେ ପ୍ରସ୍ତୁତି ପ୍ରୋବ୍ର ସମୟସୀମା (OMNIROUTE_READY_TIMEOUT_MS ମଧ୍ୟ, ଡିଫଲ୍ଟ 60000)",
     "tls_cert": "HTTPS ପରିବେଷଣ ପାଇଁ TLS ସର୍ଟିଫିକେଟ୍ (PEM)ର ପଥ (OMNIROUTE_TLS_CERT ମଧ୍ୟ)",
     "tls_key": "HTTPS ପରିବେଷଣ ପାଇଁ TLS ବ୍ୟକ୍ତିଗତ କୀ (PEM)ର ପଥ (OMNIROUTE_TLS_KEY ମଧ୍ୟ)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP ସର୍ଭର ଚାଲୁଛି ({transport})",
     "stopped": "MCP ସର୍ଭର ବନ୍ଦ ହୋଇଛି।",
     "restarted": "MCP ସର୍ଭର ପୁନଃଚାଲୁ ହୋଇଛି।",
+    "stoppedHint": "ଏହାକୁ ସକ୍ରିୟ କରିବା ପାଇଁ `omniroute mcp enable` ଚଲାନ୍ତୁ।",
+    "enabled": "MCP ସର୍ଭର୍ ସକ୍ରିୟ ହୋଇଛି।",
+    "disabled": "MCP ସର୍ଭର୍ ନିଷ୍କ୍ରିୟ ହୋଇଛି।",
+    "enable": {
+      "description": "MCP ସର୍ଭର୍କୁ ସକ୍ରିୟ କରନ୍ତୁ",
+      "transport": "ବ୍ୟବହାର କରିବାକୁ ଥିବା ପରିବହନ: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP ସର୍ଭର୍କୁ ନିଷ୍କ୍ରିୟ କରନ୍ତୁ"
+    },
     "call": {
       "description": "ସିଧାସଳଖ ଏକ MCP ଟୁଲ୍ ଆହ୍ୱାନ କରନ୍ତୁ",
       "args": "JSON ଆର୍ଗୁମେଣ୍ଟ ଅବଜେକ୍ଟ (ଇନ୍‌ଲାଇନ୍)",

bin/cli/locales/pa.json

@@ -256,6 +256,7 @@
     "max_restarts": "ਹਾਰ ਮੰਨਣ ਤੋਂ ਪਹਿਲਾਂ 30s ਦੇ ਅੰਦਰ ਕ੍ਰੈਸ਼ ਤੋਂ ਬਾਅਦ ਮੁੜ-ਚਾਲੂ ਕਰਨ ਦੀ ਵੱਧ ਤੋਂ ਵੱਧ ਗਿਣਤੀ (ਡਿਫਾਲਟ: 2)",
     "tray": "ਸਿਸਟਮ ਟਰੇ ਵਿੱਚ ਸ਼ੁਰੂ ਕਰੋ (ਸਿਰਫ਼ ਡੈਸਕਟਾਪ, ਚੋਣਵਾਂ)",
     "no_tray": "ਸਿਸਟਮ ਟਰੇ ਆਈਕਨ ਅਸਮਰੱਥ ਕਰੋ",
+    "ready_timeout": "ਰੈਡੀਨੈੱਸ ਪ੍ਰੋਬ ਦਾ ਟਾਈਮਆਉਟ ਮਿਲੀਸਕਿੰਟਾਂ ਵਿੱਚ (OMNIROUTE_READY_TIMEOUT_MS ਵੀ, ਡਿਫਾਲਟ 60000)",
     "tls_cert": "HTTPS ਸਰਵ ਕਰਨ ਲਈ TLS ਸਰਟੀਫਿਕੇਟ (PEM) ਦਾ ਪਾਥ (OMNIROUTE_TLS_CERT ਵੀ)",
     "tls_key": "HTTPS ਸਰਵ ਕਰਨ ਲਈ TLS ਨਿੱਜੀ ਕੁੰਜੀ (PEM) ਦਾ ਪਾਥ (OMNIROUTE_TLS_KEY ਵੀ)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP ਸਰਵਰ ਚੱਲ ਰਿਹਾ ਹੈ ({transport})",
     "stopped": "MCP ਸਰਵਰ ਰੋਕਿਆ ਗਿਆ।",
     "restarted": "MCP ਸਰਵਰ ਮੁੜ ਚਾਲੂ ਕੀਤਾ ਗਿਆ।",
+    "stoppedHint": "ਇਸਨੂੰ ਚਾਲੂ ਕਰਨ ਲਈ `omniroute mcp enable` ਚਲਾਓ।",
+    "enabled": "MCP ਸਰਵਰ ਚਾਲੂ ਹੈ।",
+    "disabled": "MCP ਸਰਵਰ ਬੰਦ ਹੈ।",
+    "enable": {
+      "description": "MCP ਸਰਵਰ ਚਾਲੂ ਕਰੋ",
+      "transport": "ਵਰਤਣ ਲਈ ਟ੍ਰਾਂਸਪੋਰਟ: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP ਸਰਵਰ ਬੰਦ ਕਰੋ"
+    },
     "call": {
       "description": "ਕਿਸੇ MCP ਟੂਲ ਨੂੰ ਸਿੱਧੇ ਚਲਾਓ",
       "args": "JSON ਆਰਗੂਮੈਂਟ ਆਬਜੈਕਟ (ਇਨਲਾਈਨ)",

bin/cli/locales/pt-BR.json

@@ -30,7 +30,7 @@
     "opencode": "Instala e configura o plugin @omniroute/opencode-plugin incluído para o OpenCode"
   },
   "doctor": {
-    "title": "OmniRoute Doctor",
+    "title": "Diagnóstico do OmniRoute",
     "dbOk": "Banco de dados: OK ({path})",
     "dbMissing": "Banco de dados: não inicializado — execute `omniroute setup`",
     "portOk": "Porta {port}: disponível",
@@ -256,6 +256,7 @@
     "max_restarts": "Máximo de reinícios em 30s antes de desistir (padrão: 2)",
     "tray": "Mostrar ícone na bandeja do sistema (apenas desktop, opt-in)",
     "no_tray": "Desabilitar ícone na bandeja do sistema",
+    "ready_timeout": "Tempo limite da verificação de prontidão em ms (também OMNIROUTE_READY_TIMEOUT_MS, padrão 60000)",
     "tls_cert": "Caminho para um certificado TLS (PEM) para servir HTTPS (também OMNIROUTE_TLS_CERT)",
     "tls_key": "Caminho para a chave privada TLS (PEM) para servir HTTPS (também OMNIROUTE_TLS_KEY)"
   },
@@ -301,7 +302,7 @@
     "noServer": "Servidor não está em execução. Inicie com: omniroute serve",
     "title": "Saúde",
     "status": "Status: {status}",
-    "uptime": "Uptime: {uptime}",
+    "uptime": "Tempo de atividade: {uptime}",
     "requests": "Requisições (24h): {count}",
     "cost": "Custo (24h): ${cost}"
   },
@@ -344,6 +345,19 @@
   },
   "mcp": {
     "title": "Servidor MCP",
+    "running": "Servidor MCP em execução ({transport})",
+    "stopped": "Servidor MCP parado.",
+    "restarted": "Servidor MCP reiniciado.",
+    "stoppedHint": "Execute `omniroute mcp enable` para ativá-lo.",
+    "enabled": "Servidor MCP ativado.",
+    "disabled": "Servidor MCP desativado.",
+    "enable": {
+      "description": "Ativar o servidor MCP",
+      "transport": "Transporte a ser usado: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Desativar o servidor MCP"
+    },
     "call": {
       "description": "Invocar uma ferramenta MCP diretamente",
       "args": "Objeto JSON de argumentos (inline)",
@@ -371,10 +385,7 @@
     },
     "audit": {
       "description": "Log de auditoria MCP (alias para audit --source mcp)"
-    },
-    "running": "Servidor MCP em execução ({transport})",
-    "stopped": "Servidor MCP parado.",
-    "restarted": "Servidor MCP reiniciado."
+    }
   },
   "a2a": {
     "skills": {
@@ -1093,7 +1104,7 @@
     }
   },
   "combo": {
-    "title": "Combos",
+    "title": "Combinações",
     "switched": "Combo ativo: {name}",
     "created": "Combo criado: {name}",
     "deleted": "Combo removido: {name}",
@@ -1268,7 +1279,7 @@
     "description": "REPL interativo multi-turn com LLM",
     "model": "Modelo a usar (padrão: auto)",
     "combo": "Nome do combo a usar",
-    "system": "System prompt",
+    "system": "Prompt do sistema",
     "resume": "Retomar sessão salva pelo nome"
   },
   "plugin": {

bin/cli/locales/si.json

@@ -256,6 +256,7 @@
     "max_restarts": "අත්හැරීමට පෙර තත්පර 30ක් තුළ සිදු කළ හැකි උපරිම බිඳවැටීම්-පසු නැවත ආරම්භ කිරීම් ගණන (පෙරනිමිය: 2)",
     "tray": "පද්ධති ට්රේ තුළ ආරම්භ කරන්න (ඩෙස්ක්ටොප් සඳහා පමණි, කැමැත්තෙන් සක්රිය කළ යුතුය)",
     "no_tray": "පද්ධති ට්රේ නිරූපකය අක්රිය කරන්න",
+    "ready_timeout": "සූදානම්දැයි පරීක්ෂා කිරීමේ කල් ඉකුත්වීම ms වලින් (OMNIROUTE_READY_TIMEOUT_MS ද අදාළ වේ, පෙරනිමිය 60000)",
     "tls_cert": "HTTPS සේවය සැපයීම සඳහා TLS සහතිකයකට (PEM) ඇති මාර්ගය (OMNIROUTE_TLS_CERT ද අදාළ වේ)",
     "tls_key": "HTTPS සේවය සැපයීම සඳහා TLS පුද්ගලික යතුරට (PEM) ඇති මාර්ගය (OMNIROUTE_TLS_KEY ද අදාළ වේ)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP සේවාදායකය ක්රියාත්මකයි ({transport})",
     "stopped": "MCP සේවාදායකය නවතා ඇත.",
     "restarted": "MCP සේවාදායකය නැවත ආරම්භ කරන ලදී.",
+    "stoppedHint": "එය සක්රීය කිරීමට `omniroute mcp enable` ධාවනය කරන්න.",
+    "enabled": "MCP සේවාදායකය සක්රීය කර ඇත.",
+    "disabled": "MCP සේවාදායකය අක්රීය කර ඇත.",
+    "enable": {
+      "description": "MCP සේවාදායකය සක්රීය කරන්න",
+      "transport": "භාවිත කළ යුතු ප්රවාහන ක්රමය: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP සේවාදායකය අක්රීය කරන්න"
+    },
     "call": {
       "description": "MCP මෙවලමක් සෘජුවම කැඳවන්න",
       "args": "JSON තර්ක වස්තුව (පේළිය තුළ)",
@@ -1093,7 +1104,7 @@
     }
   },
   "combo": {
-    "title": "Combos",
+    "title": "සංයෝජන",
     "switched": "සක්රිය combo එක: {name}",
     "created": "Combo එක සාදන ලදී: {name}",
     "deleted": "Combo එක මකා දමන ලදී: {name}",

bin/cli/locales/sl.json

@@ -256,6 +256,7 @@
     "max_restarts": "Največje število ponovnih zagonov po sesutju v 30 s, preden se poskušanje opusti (privzeto: 2)",
     "tray": "Zaženi v sistemski vrstici (samo za namizne sisteme, po izbiri)",
     "no_tray": "Onemogoči ikono sistemske vrstice",
+    "ready_timeout": "Časovna omejitev preverjanja pripravljenosti v ms (tudi OMNIROUTE_READY_TIMEOUT_MS, privzeto 60000)",
     "tls_cert": "Pot do potrdila TLS (PEM) za streženje prek HTTPS (tudi OMNIROUTE_TLS_CERT)",
     "tls_key": "Pot do zasebnega ključa TLS (PEM) za streženje prek HTTPS (tudi OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Strežnik MCP deluje ({transport})",
     "stopped": "Strežnik MCP je ustavljen.",
     "restarted": "Strežnik MCP je znova zagnan.",
+    "stoppedHint": "Za vklop zaženite `omniroute mcp enable`.",
+    "enabled": "Strežnik MCP je omogočen.",
+    "disabled": "Strežnik MCP je onemogočen.",
+    "enable": {
+      "description": "Omogoči strežnik MCP",
+      "transport": "Prenos, ki naj se uporabi: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Onemogoči strežnik MCP"
+    },
     "call": {
       "description": "Neposredno prikliči orodje MCP",
       "args": "Objekt argumentov JSON (v vrstici)",

bin/cli/locales/sr.json

@@ -256,6 +256,7 @@
     "max_restarts": "Maksimalan broj ponovnih pokretanja pri padu u toku 30s pre odustajanja (podrazumevano: 2)",
     "tray": "Покретање у системској траци (само десктоп, опционо)",
     "no_tray": "Онемогући икону у системској траци",
+    "ready_timeout": "Временско ограничење провере спремности у ms (такође OMNIROUTE_READY_TIMEOUT_MS, подразумевано 60000)",
     "tls_cert": "Путања до TLS сертификата (PEM) за HTTPS (такође OMNIROUTE_TLS_CERT)",
     "tls_key": "Путања до TLS приватног кључа (PEM) за HTTPS (такође OMNIROUTE_TLS_KEY)"
   },
@@ -300,7 +301,7 @@
     "description": "Провери здравље сервера и статус компоненти",
     "noServer": "Сервер није покренут. Покрените са: omniroute serve",
     "title": "Здравље",
-    "status": "Status: {status}",
+    "status": "Статус: {status}",
     "uptime": "Vreme rada: {uptime}",
     "requests": "Zahtevi (24h): {count}",
     "cost": "Trošak (24h): ${cost}"
@@ -347,6 +348,16 @@
     "running": "MCP server je pokrenut ({transport})",
     "stopped": "MCP server je zaustavljen.",
     "restarted": "MCP server je ponovo pokrenut.",
+    "stoppedHint": "Покрените `omniroute mcp enable` да бисте га укључили.",
+    "enabled": "MCP сервер је омогућен.",
+    "disabled": "MCP сервер је онемогућен.",
+    "enable": {
+      "description": "Омогући MCP сервер",
+      "transport": "Протокол за пренос: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Онемогући MCP сервер"
+    },
     "call": {
       "description": "Direktno pozovi MCP alat",
       "args": "JSON objekat argumenata (inline)",
@@ -810,7 +821,7 @@
     }
   },
   "program": {
-    "description": "OmniRoute — Smart AI Router with Auto Fallback",
+    "description": "OmniRoute — паметни AI рутер са аутоматским пребацивањем на резервну опцију",
     "version": "Прикажи верзију и изађи",
     "output": "Формат излаза (table, json, jsonl, csv)",
     "quiet": "Сакрий небитан излаз",

bin/cli/locales/uz.json

@@ -256,6 +256,7 @@
     "max_restarts": "Taslim bo‘lishdan oldin 30 soniya ichidagi nosozlikdan keyingi qayta ishga tushirishlarning maksimal soni (standart: 2)",
     "tray": "Tizim treyida ishga tushirish (faqat ish stoli versiyasida, ixtiyoriy)",
     "no_tray": "Tizim treyi belgisini o‘chirish",
+    "ready_timeout": "Tayyorlik tekshiruvi uchun kutish vaqti, ms (shuningdek OMNIROUTE_READY_TIMEOUT_MS, standart qiymat 60000)",
     "tls_cert": "HTTPS orqali xizmat ko‘rsatish uchun TLS sertifikati (PEM) yo‘li (shuningdek, OMNIROUTE_TLS_CERT)",
     "tls_key": "HTTPS orqali xizmat ko‘rsatish uchun TLS maxfiy kaliti (PEM) yo‘li (shuningdek, OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "MCP serveri ishlamoqda ({transport})",
     "stopped": "MCP serveri toʻxtatildi.",
     "restarted": "MCP serveri qayta ishga tushirildi.",
+    "stoppedHint": "Uni yoqish uchun `omniroute mcp enable` buyrugʻini ishga tushiring.",
+    "enabled": "MCP serveri yoqildi.",
+    "disabled": "MCP serveri oʻchirildi.",
+    "enable": {
+      "description": "MCP serverini yoqish",
+      "transport": "Foydalaniladigan transport: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "MCP serverini oʻchirish"
+    },
     "call": {
       "description": "MCP vositasini bevosita chaqirish",
       "args": "JSON argumentlar obyekti (ichki)",

bin/cli/locales/yo.json

@@ -256,6 +256,7 @@
     "max_restarts": "Iye ìtunbẹ̀rẹ̀ lẹ́yìn ìkọ̀lù tó pọ̀ jù láàárín 30s kí ó tó jáwọ́ (àìyípadà: 2)",
     "tray": "Bẹ̀rẹ̀ nínú atẹ eto (dẹ́sítọ́ọ̀pù nìkan, àṣàyàn ni)",
     "no_tray": "Pa àmì atẹ eto rẹ́",
+    "ready_timeout": "Àkókò ìdádúró tó pọ̀ jù fún àyẹ̀wò ìmúrasílẹ̀ ní ms (bákan náà OMNIROUTE_READY_TIMEOUT_MS, àìyípadà 60000)",
     "tls_cert": "Ọ̀nà sí ìwé-ẹ̀rí TLS kan (PEM) láti pèsè HTTPS (bákan náà OMNIROUTE_TLS_CERT)",
     "tls_key": "Ọ̀nà sí kọ́kọ́rọ́ àdáni TLS (PEM) láti pèsè HTTPS (bákan náà OMNIROUTE_TLS_KEY)"
   },
@@ -347,6 +348,16 @@
     "running": "Olùpín MCP ń ṣiṣẹ́ ({transport})",
     "stopped": "Olùpín MCP ti dá iṣẹ́ dúró.",
     "restarted": "A ti tún olùpín MCP bẹ̀rẹ̀.",
+    "stoppedHint": "Ṣe `omniroute mcp enable` láti mú un ṣiṣẹ́.",
+    "enabled": "A ti mú olupin MCP ṣiṣẹ́.",
+    "disabled": "A ti pa olupin MCP.",
+    "enable": {
+      "description": "Mú olupin MCP ṣiṣẹ́",
+      "transport": "Ọ̀nà ìgbéṣùmọ̀ tí a ó lò: stdio|sse|streamable-http"
+    },
+    "disable": {
+      "description": "Pa olupin MCP"
+    },
     "call": {
       "description": "Pe ohun èlò MCP kan ní tààrà",
       "args": "Ohun àríyànjiyàn JSON (níbẹ̀-níbẹ̀)",

bin/cli/locales/zh-CN.json

@@ -14,18 +14,6 @@
     "jsonOpt": "以 JSON 格式输出",
     "yesOpt": "跳过确认"
   },
-  "program": {
-    "description": "OmniRoute — 具有自动故障转移的智能 AI 路由器",
-    "version": "打印版本并退出",
-    "output": "输出格式（table, json, jsonl, csv）",
-    "quiet": "禁止非必要输出",
-    "no_color": "禁用彩色输出",
-    "timeout": "HTTP 请求超时（毫秒）",
-    "api_key": "OmniRoute 服务器的 API 密钥",
-    "base_url": "OmniRoute 服务器的基础 URL",
-    "context": "此命令使用的服务器上下文/配置文件",
-    "lang": "设置 CLI 显示语言（覆盖 OMNIROUTE_LANG）"
-  },
   "setup": {
     "title": "OmniRoute 设置",
     "passwordPrompt": "管理员密码",
@@ -145,6 +133,20 @@
       "listTitle": "{days} 天内过期的密钥："
     }
   },
+  "authExport": {
+    "description": "导出已解密的提供者凭据（仅限本地，明文输出）",
+    "idOpt": "仅导出与此 id/名称/提供者匹配的连接",
+    "formatOpt": "输出格式：json 或 env",
+    "outOpt": "将输出写入文件而非标准输出（以 0600 权限写入）",
+    "forceOpt": "确认你了解此操作会打印/写入明文密钥",
+    "warning": "⚠ 此操作会打印/写入已解密的明文 API 密钥和 OAuth 令牌。请确保你的屏幕、shell 历史记录以及任何输出文件保持私密。",
+    "confirmHeading": "⚠ 警告：此操作会以明文导出已解密的提供者凭据",
+    "confirmBody": "此命令会为所选连接解密并打印/写入 apiKey、accessToken、refreshToken 和\nidToken。请将输出视为机密。",
+    "confirmFooter": "如需确认，请运行：\n  omniroute auth export --force",
+    "missingKey": "导出凭据需要 STORAGE_ENCRYPTION_KEY。",
+    "notFound": "未找到连接：{id}",
+    "invalidFormat": "无效格式：{format}。请使用 json 或 env。"
+  },
   "stream": {
     "description": "使用 SSE 检查模式流式传输聊天响应",
     "file": "从文件读取提示",
@@ -302,7 +304,7 @@
     "status": "状态：{status}",
     "uptime": "运行时间：{uptime}",
     "requests": "请求数（24h）：{count}",
-    "cost": "成本（24h）："
+    "cost": "成本（24h）：${cost}"
   },
   "quota": {
     "description": "显示提供者配额使用情况",
@@ -818,6 +820,18 @@
       "event": "要模拟的事件类型（默认：request.completed）"
     }
   },
+  "program": {
+    "description": "OmniRoute — 具有自动故障转移的智能 AI 路由器",
+    "version": "打印版本并退出",
+    "output": "输出格式（table, json, jsonl, csv）",
+    "quiet": "禁止非必要输出",
+    "no_color": "禁用彩色输出",
+    "timeout": "HTTP 请求超时（毫秒）",
+    "api_key": "OmniRoute 服务器的 API 密钥",
+    "base_url": "OmniRoute 服务器的基础 URL",
+    "context": "此命令使用的服务器上下文/配置文件",
+    "lang": "设置 CLI 显示语言（覆盖 OMNIROUTE_LANG）"
+  },
   "files": {
     "description": "管理文件（上传、列出、获取、下载、删除）",
     "list": {
@@ -918,6 +932,11 @@
       "model": "按模型筛选"
     }
   },
+  "radar": {
+    "description": "检查并同步本地 Radar 目录订阅源",
+    "status": "显示本地 Radar 设置和订阅源缓存状态",
+    "sync": "通过本地服务器同步目录、推荐、优惠和 Intel"
+  },
   "resilience": {
     "description": "检查和管理弹性机制",
     "status": {
@@ -1245,8 +1264,8 @@
     "description": "管理 OmniRoute 开机自启（Linux：systemd 用户服务）",
     "enable": "启用开机自启",
     "disable": "禁用开机自启",
-    "status": "显示自启状态",
-    "toggle": "切换开机自启"
+    "toggle": "切换开机自启",
+    "status": "显示自启状态"
   },
   "runtime": {
     "description": "管理本地运行时依赖",
@@ -1273,25 +1292,6 @@
     "update": "更新已安装的插件",
     "scaffold": "搭建新的插件模板"
   },
-  "authExport": {
-    "description": "导出已解密的提供者凭据（仅限本地，明文输出）",
-    "idOpt": "仅导出与此 id/名称/提供者匹配的连接",
-    "formatOpt": "输出格式：json 或 env",
-    "outOpt": "将输出写入文件而非标准输出（以 0600 权限写入）",
-    "forceOpt": "确认你了解此操作会打印/写入明文密钥",
-    "warning": "⚠ 此操作会打印/写入已解密的明文 API 密钥和 OAuth 令牌。请确保你的屏幕、shell 历史记录以及任何输出文件保持私密。",
-    "confirmHeading": "⚠ 警告：此操作会以明文导出已解密的提供者凭据",
-    "confirmBody": "此命令会为所选连接解密并打印/写入 apiKey、accessToken、refreshToken 和\nidToken。请将输出视为机密。",
-    "confirmFooter": "如需确认，请运行：\n  omniroute auth export --force",
-    "missingKey": "导出凭据需要 STORAGE_ENCRYPTION_KEY。",
-    "notFound": "未找到连接：{id}",
-    "invalidFormat": "无效格式：{format}。请使用 json 或 env。"
-  },
-  "radar": {
-    "description": "检查并同步本地 Radar 目录订阅源",
-    "status": "显示本地 Radar 设置和订阅源缓存状态",
-    "sync": "通过本地服务器同步目录、推荐、优惠和 Intel"
-  },
   "launch": {
     "description": "启动指向 OmniRoute 的 Claude Code（本地或远程，使用 --profile）",
     "token": "Claude 客户端应发送的令牌（ANTHROPIC_AUTH_TOKEN）",

bin/cli/locales/zh-TW.json

@@ -14,18 +14,6 @@
     "jsonOpt": "以 JSON 格式輸出",
     "yesOpt": "跳過確認"
   },
-  "program": {
-    "description": "OmniRoute — 具有自動故障轉移的智慧 AI 路由器",
-    "version": "列印版本並退出",
-    "output": "輸出格式（table, json, jsonl, csv）",
-    "quiet": "禁止非必要輸出",
-    "no_color": "停用彩色輸出",
-    "timeout": "HTTP 請求超時（毫秒）",
-    "api_key": "OmniRoute 伺服器的 API 金鑰",
-    "base_url": "OmniRoute 伺服器的基礎 URL",
-    "context": "此命令使用的伺服器上下文/配置檔案",
-    "lang": "設定 CLI 顯示語言（覆蓋 OMNIROUTE_LANG）"
-  },
   "setup": {
     "title": "OmniRoute 設定",
     "passwordPrompt": "管理員密碼",
@@ -145,6 +133,20 @@
       "listTitle": "{days} 天內過期的金鑰："
     }
   },
+  "authExport": {
+    "description": "匯出已解密的提供者憑據（僅限本機，明文輸出）",
+    "idOpt": "僅匯出與此 id/名稱/提供者相符的連線",
+    "formatOpt": "輸出格式：json 或 env",
+    "outOpt": "將輸出寫入檔案而非標準輸出（以 0600 權限寫入）",
+    "forceOpt": "確認你了解此操作會列印/寫入明文密鑰",
+    "warning": "⚠ 此操作會列印/寫入已解密的明文 API 金鑰和 OAuth 令牌。請確保你的螢幕、shell 歷史記錄以及任何輸出檔案保持私密。",
+    "confirmHeading": "⚠ 警告：此操作會以明文匯出已解密的提供者憑據",
+    "confirmBody": "此命令會為所選連線解密並列印/寫入 apiKey、accessToken、refreshToken 和\nidToken。請將輸出視為機密。",
+    "confirmFooter": "如需確認，請執行：\n  omniroute auth export --force",
+    "missingKey": "匯出憑據需要 STORAGE_ENCRYPTION_KEY。",
+    "notFound": "找不到連線：{id}",
+    "invalidFormat": "無效格式：{format}。請使用 json 或 env。"
+  },
   "stream": {
     "description": "使用 SSE 檢查模式流式傳輸聊天響應",
     "file": "從檔案讀取提示",
@@ -302,7 +304,7 @@
     "status": "狀態：{status}",
     "uptime": "執行時間：{uptime}",
     "requests": "請求數（24h）：{count}",
-    "cost": "成本（24h）："
+    "cost": "成本（24h）：${cost}"
   },
   "quota": {
     "description": "顯示提供者配額使用情況",
@@ -818,6 +820,18 @@
       "event": "要模擬的事件型別（預設：request.completed）"
     }
   },
+  "program": {
+    "description": "OmniRoute — 具有自動故障轉移的智慧 AI 路由器",
+    "version": "列印版本並退出",
+    "output": "輸出格式（table, json, jsonl, csv）",
+    "quiet": "禁止非必要輸出",
+    "no_color": "停用彩色輸出",
+    "timeout": "HTTP 請求超時（毫秒）",
+    "api_key": "OmniRoute 伺服器的 API 金鑰",
+    "base_url": "OmniRoute 伺服器的基礎 URL",
+    "context": "此命令使用的伺服器上下文/配置檔案",
+    "lang": "設定 CLI 顯示語言（覆蓋 OMNIROUTE_LANG）"
+  },
   "files": {
     "description": "管理檔案（上傳、列出、獲取、下載、刪除）",
     "list": {
@@ -918,6 +932,11 @@
       "model": "按模型篩選"
     }
   },
+  "radar": {
+    "description": "檢查並同步本機 Radar 目錄訂閱來源",
+    "status": "顯示本機 Radar 設定和訂閱來源快取狀態",
+    "sync": "透過本機伺服器同步目錄、推薦、優惠和 Intel"
+  },
   "resilience": {
     "description": "檢查和管理彈性機制",
     "status": {
@@ -1245,8 +1264,8 @@
     "description": "管理 OmniRoute 開機自啟（Linux：systemd 使用者服務）",
     "enable": "啟用開機自啟",
     "disable": "停用開機自啟",
-    "status": "顯示自啟狀態",
-    "toggle": "切換開機自啟"
+    "toggle": "切換開機自啟",
+    "status": "顯示自啟狀態"
   },
   "runtime": {
     "description": "管理本地執行時依賴",
@@ -1273,25 +1292,6 @@
     "update": "更新已安裝的外掛",
     "scaffold": "搭建新的外掛模板"
   },
-  "authExport": {
-    "description": "匯出已解密的提供者憑據（僅限本機，明文輸出）",
-    "idOpt": "僅匯出與此 id/名稱/提供者相符的連線",
-    "formatOpt": "輸出格式：json 或 env",
-    "outOpt": "將輸出寫入檔案而非標準輸出（以 0600 權限寫入）",
-    "forceOpt": "確認你了解此操作會列印/寫入明文密鑰",
-    "warning": "⚠ 此操作會列印/寫入已解密的明文 API 金鑰和 OAuth 令牌。請確保你的螢幕、shell 歷史記錄以及任何輸出檔案保持私密。",
-    "confirmHeading": "⚠ 警告：此操作會以明文匯出已解密的提供者憑據",
-    "confirmBody": "此命令會為所選連線解密並列印/寫入 apiKey、accessToken、refreshToken 和\nidToken。請將輸出視為機密。",
-    "confirmFooter": "如需確認，請執行：\n  omniroute auth export --force",
-    "missingKey": "匯出憑據需要 STORAGE_ENCRYPTION_KEY。",
-    "notFound": "找不到連線：{id}",
-    "invalidFormat": "無效格式：{format}。請使用 json 或 env。"
-  },
-  "radar": {
-    "description": "檢查並同步本機 Radar 目錄訂閱來源",
-    "status": "顯示本機 Radar 設定和訂閱來源快取狀態",
-    "sync": "透過本機伺服器同步目錄、推薦、優惠和 Intel"
-  },
   "launch": {
     "description": "啟動指向 OmniRoute 的 Claude Code（本機或遠端，使用 --profile）",
     "token": "Claude 用戶端應傳送的令牌（ANTHROPIC_AUTH_TOKEN）",

changelog.d/features/13717-db-healthcheck-startup-deferred-flag.md

@@ -0,0 +1 @@
+- **feat(flags):** add `DB_HEALTHCHECK_STARTUP_DEFERRED_ENABLED` (default off) — opt-in deferral of the startup DB health/integrity check past process boot via `setImmediate`; off keeps the pre-#13717 behavior of blocking `getDbInstance()` until the check has already run (#13717).

changelog.d/features/13827-i18n-key-completeness-gate.md

@@ -1 +0,0 @@
-- **feat(i18n):** new blocking gate `i18n:check-keys` (`scripts/i18n/check-key-completeness.mjs`) — every locale catalog must carry exactly the key set of `en.json`, whatever the age of the key; the percentage and new-key gates let batch 1 (#13044) ship 43 keys short and batch 2 (#13660) 10 keys short. The i18n guide now documents the post-merge re-sync and the retranslation flow. (#13827)

changelog.d/features/13886-site-retranslate.md

@@ -0,0 +1 @@
+- **feat(i18n):** `retranslate-site` rewrites the site catalogs' verbatim-English leaves (2,059 across 63 catalogs; mean English residue 10.3 % → 6.3 %, the rest being brand names kept on purpose). (#13886)

changelog.d/fixes/12861-direct-fetch-timeout-unhandled-rejection.md

@@ -1 +0,0 @@
-- **fix(resilience):** a recoverable direct-fetch response-start timeout (`DIRECT_RESPONSE_START_TIMEOUT`) could, in a narrow timer/promise-settlement race, escape as an `unhandledRejection` → `uncaughtException` and kill the server process — even though `proxyFetch` already retries this exact condition on a fresh socket. Guarded the timer callback so it can no longer fire against an already-settled attempt, and extended the process-level crash guard (already used by the WS/API-bridge servers) to recognize and swallow this code if it ever escapes anyway. Also installs that same guard in the production server entrypoint (`dist/server-ws.mjs`), which never had it even though the dev server already did ([#12861](https://github.com/diegosouzapw/OmniRoute/issues/12861)) — thanks @insoln

changelog.d/fixes/13234-embed-lan-keyed-auth.md

@@ -1 +0,0 @@
-- **fix(embeddings):** LAN/CGNAT OpenAI-compatible embeddings nodes with a stored API key now send `Authorization: Bearer` on the outbound request, matching dashboard Check. Keyless LAN nodes stay no-auth ([#6925](https://github.com/diegosouzapw/OmniRoute/issues/6925)) ([#13234](https://github.com/diegosouzapw/OmniRoute/issues/13234))

changelog.d/fixes/13326-memory-fts-skip-access-updates.md

@@ -1 +0,0 @@
-- **fix(memory):** stop FTS5 rewrite on access-count updates; rebuild the index on cleanup so leftover tombstones shrink (#13326).

changelog.d/fixes/13445-groq-tls-fingerprint.md

@@ -1 +0,0 @@
-- **fix(network):** skip Chrome TLS impersonation for Groq (`api.groq.com`); Cloudflare 1010s that JA3 while native undici reaches the API ([#13445](https://github.com/diegosouzapw/OmniRoute/pull/13445)) (#13225)

changelog.d/fixes/13679-container-posture-cors.md

@@ -0,0 +1 @@
+- **fix(security):** default the published Docker image and `fly.toml` deployment to `REQUIRE_API_KEY=true` (npm/CLI local-dev default unchanged), and stop `/api/free-tier/summary`'s wildcard CORS from leaking the operator's local token usage to unauthenticated callers (#13679)

changelog.d/fixes/13717-db-health-resource-bounds.md

@@ -0,0 +1 @@
+- fix(db): bound health scans and isolate native diagnostics so large quota histories no longer exhaust memory or block request handling; diagnostics now run in a cancellable child and are awaited at HTTP and MCP callers (#13717)

changelog.d/fixes/13795-opencode-429-proxy-dedup.md

@@ -1 +0,0 @@
-- **fix(sse):** stop re-sending a request to an already-refused route after a 429 — each refused route is tried once per request ([#13795](https://github.com/diegosouzapw/OmniRoute/pull/13795)) — thanks @maxmad64bis

changelog.d/fixes/13828-zylo-key-validation.md

@@ -0,0 +1 @@
+- **fix(providers):** the Zylo API key check now probes the authenticated chat route instead of the open catalog — Zylo serves `GET /v1/models` without authentication, so the account-setup dialog accepted any string as valid and the key was only rejected later, when a model test returned Zylo's own `401 "Key not found: zk-…"` ([#13828](https://github.com/diegosouzapw/OmniRoute/issues/13828))

changelog.d/fixes/13832-credential-allowlist-diagnostic.md

@@ -0,0 +1 @@
+- **fix(sse):** when a gateway API key's `allowed_connections` / quota scope hides every connection of a provider, chat now answers `403` naming that scope instead of the generic `No active credentials for provider: X` — which was indistinguishable from "never configured" even though `/test` and `/sync-models` kept working on the same connection ([#13832](https://github.com/diegosouzapw/OmniRoute/issues/13832))

changelog.d/fixes/13885-pt-br-review.md

@@ -0,0 +1 @@
+- **fix(i18n):** reviewer pass over the 1,865 pt-BR leaves retranslated in #13782 (172 corrections) via the new `review-locale` script. (#13885)

changelog.d/fixes/13892-cli-catalogs-all-locales.md

@@ -0,0 +1 @@
+- **fix(cli):** translate the CLI for every locale — 38 catalogs carried 1–24 of 830 keys and fell back to English; `sync-ui-keys --catalog=cli` fills them (52,000 strings) and a completeness gate keeps them full. (#13892)

changelog.d/fixes/agnes-thinking-effort-tiers.md

@@ -1 +0,0 @@
-- fix(providers): **declare Agnes chat models' live `reasoning_effort` vocabulary so catalog/builder/sanitizer stop inventing aliases the API 400s.** 2.0/2.5 accept `none/low/medium/high/max`; 3.0 also accepts `minimal` and `xhigh`. `off`/`ultra` still clamp off the wire.

changelog.d/fixes/basereds-forgotten-sibling-report-bounds.md

@@ -0,0 +1 @@
+- **fix(ci):** the advisory `forgotten-sibling-tests` step no longer fails "Fast Quality Gates" when a PR touches a hub module — the cross-product of consumers × candidate tests reached millions of rows and rendering them exceeded V8's maximum string length, so the throw hit `main()`'s catch and exited 1. The report now lists at most 200 rows per section (and 5 000 per array in the JSON artifact) while the header keeps the exact totals

changelog.d/fixes/claude-assistant-prefill.md

@@ -1 +0,0 @@
-- Strip a trailing text-only assistant turn before official Claude OAuth dispatch. Claude returns 400 `This model does not support assistant message prefill` for that shape; the shared strip only covered Mistral.

changelog.d/fixes/codex-reasoning-object-whitelist.md

@@ -1 +0,0 @@
-- Fixed Codex executor forwarding client `reasoning` sub-fields (`enabled`, `max_tokens`, `exclude`) that the Codex Responses API rejects with HTTP 400, taking down every combo target with a deterministic client error. The reasoning object is now whitelisted to `effort`/`summary`, and `enabled: false` maps to effort `none` when no more specific effort was requested.

changelog.d/fixes/combo-probe-no-thinking.md

@@ -1 +0,0 @@
-- **fix(combos):** Gemini combo probes send `reasoning_effort: none` so thinking does not eat the health-check budget; truncated `finish_reason: length` responses are no longer rewritten as empty-content 502s

changelog.d/fixes/gemini-38-think-level.md

@@ -1 +0,0 @@
-- **fix(gemini):** send Gemini 3.8 `thinkingLevel` instead of a numeric `thinkingBudget`, and omit `includeThoughts` unless the client asked, so hidden thoughts stop eating `maxOutputTokens`

changelog.d/fixes/release-acceptance-shadow.md

@@ -1 +0,0 @@
-- Add a shadow release-acceptance report next to release-green.json. It does not close #12732 and is not a Mergify required check.

changelog.d/fixes/sensenova-deepseek-v4-effort-clamp.md

@@ -1 +0,0 @@
-- **fix(providers):** clamp SenseNova DeepSeek V4 Flash `reasoning_effort` `xhigh`/`max` to `high` (upstream lists `xhigh` then 400s it)

config/quality/eslint-suppressions.json

@@ -3593,7 +3593,7 @@
   },
   "tests/unit/db-health-check.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 29
+      "count": 25
     }
   },
   "tests/unit/db-health-route.test.ts": {

config/quality/file-size-baseline.json

@@ -3,6 +3,7 @@
   "_rebaseline_2026_09_15_13445_combined_growth": "Combined growth of the 2026-09-15 maxmad64bis uplift batch (each PR rebaselined its own growth; the merged sum is larger): open-sse/utils/proxyFetch.ts->1296. Every hunk is flag-gated or a verified fix covered by that PR's tests; see the batch report.",
   "_rebaseline_2026_09_15_13643_combined_growth": "Combined growth of the 2026-09-15 maxmad64bis uplift batch (each PR rebaselined its own growth; the merged sum is larger): open-sse/executors/codex.ts->1528. Every hunk is flag-gated or a verified fix covered by that PR's tests; see the batch report.",
   "_rebaseline_2026_09_15_13344_conversation_turn_nodes_retention_field": "PR #13344 rework: src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx 1596->1597 (+1 checker count on the pure tip, matching the existing frozen 1597; this rework's own edit only changes the literal default shown in the retentionFields row from 1 to 30, no line added/removed). The one added line is the PR's own retentionFields row (conversationTurnNodes) exposing the new independent retention.conversationTurnNodes knob (src/types/databaseSettings.ts) added by the same PR. Irreducible: one row per existing retention setting in this table. Covered by tests/unit/db-cleanup-conversation-nodes-12453.test.ts.",
+  "_rebaseline_2026_09_15_13717_db_health_startup_deferred_flag": "PR #13717 rework: src/lib/db/core.ts growth from the DB_HEALTHCHECK_STARTUP_DEFERRED_ENABLED feature-flag gate (default off) around the startup health-check call site — the flag-off branch is a verbatim reproduction of the pre-#13717 synchronous call, now wrapped in try/catch (a genuine crash-fix: ensureBackupBeforeRepair in healthCheck.ts can throw 'backup creation failed', and this call site was previously unwrapped — see the PR's rework notes) plus a comment on why setDb(db) had to move earlier (a second real bug this rework found and fixed: the flag read itself is a DB-backed feature-flag override, i.e. it calls getDbInstance(), and reading it before the singleton was registered caused unbounded recursive re-opening of the database). Covered by tests/unit/db-health-check.test.ts (default synchronous branch) and the new tests/unit/db-health-startup-deferred-flag-13717.test.ts (both flag states, subprocess-isolated).",
   "_rebaseline_2026_09_15_13609_combined_growth": "Combined growth of the 2026-09-15 maxmad64bis uplift batch (each PR rebaselined its own growth; the merged sum is larger): open-sse/services/accountFallback.ts->2507. Every hunk is flag-gated or a verified fix covered by that PR's tests; see the batch report.",
   "_rebaseline_2026_09_15_13602_combined_growth": "Combined growth of the 2026-09-15 maxmad64bis uplift batch (each PR rebaselined its own growth; the merged sum is larger): src/sse/handlers/chatHelpers.ts->1214. Every hunk is flag-gated or a verified fix covered by that PR's tests; see the batch report.",
   "_rebaseline_2026_09_15_13580_combined_growth": "Combined growth of the 2026-09-15 maxmad64bis uplift batch (each PR rebaselined its own growth; the merged sum is larger): src/sse/handlers/chatHelpers.ts->1202. Every hunk is flag-gated or a verified fix covered by that PR's tests; see the batch report.",
@@ -452,9 +453,9 @@
     "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 (+96). Adds MiniMax T2A v2 TTS dispatch (handleMinimaxSpeech + hexToBytes helper) — provider entry was already in audioRegistry (format: minimax-tts) but no handler existed, falling through to the OpenAI-compatible default that fails (T2A has custom shape + hex-encoded audio + base_resp envelope). New branch sits next to the other inline provider branches (xiaomi-mimo, coqui, tortoise, aws-polly) — extracting would just create indirection. Covered by tests/unit/minimax-tts-1043.test.ts (3 tests, GREEN: success, base_resp error, invalid-hex).",
     "_rebaseline_pr4592_exclude_exhausted_auto": "Reconcile #4592 already-merged growth: combo.ts 2991->3036 (+45, terminal-status quota-cutoff exclusion in buildAutoCandidates + opt-in gate). Fast-gate PR->release does not run check:file-size.",
     "open-sse/executors/antigravity.ts": 1665,
-    "open-sse/executors/base.ts": 1754,
+    "open-sse/executors/base.ts": 1753,
     "open-sse/executors/chatgpt-web.ts": 5056,
-    "open-sse/executors/codex.ts": 1528,
+    "open-sse/executors/codex.ts": 1505,
     "open-sse/executors/cursor.ts": 1759,
     "open-sse/executors/muse-spark-web.ts": 1405,
     "open-sse/handlers/chatCore.ts": 6146,
@@ -468,7 +469,7 @@
     "open-sse/services/combo/executeTargetAttempt.ts": 1228,
     "open-sse/translator/response/openai-responses.ts": 1466,
     "open-sse/utils/cursorAgentProtobuf.ts": 1547,
-    "open-sse/utils/proxyFetch.ts": 1296,
+    "open-sse/utils/proxyFetch.ts": 1275,
     "open-sse/utils/stream.ts": 3098,
     "open-sse/vendor/codex-chatgpt-web/adapters/chatgpt-web/browser-worker.ts": 4398,
     "open-sse/vendor/codex-chatgpt-web/bridge.ts": 1335,
@@ -490,7 +491,7 @@
     "src/app/api/v1/models/catalog.ts": 2075,
     "src/app/docs/lib/openapi.generated.ts": 1347,
     "src/lib/db/apiKeys.ts": 1625,
-    "src/lib/db/core.ts": 1770,
+    "src/lib/db/core.ts": 1788,
     "src/lib/db/migrationRunner.ts": 1206,
     "src/lib/tailscaleTunnel.ts": 1208,
     "src/lib/tokenHealthCheck.ts": 1218,

config/quality/release-acceptance.schema.json

@@ -1,183 +0,0 @@
-{
-  "$id": "https://omniroute.local/quality/release-acceptance.schema.json",
-  "title": "Release acceptance report",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schema_version",
-    "identity",
-    "required_gates",
-    "gates",
-    "evidence_errors",
-    "verdict",
-    "artifact"
-  ],
-  "properties": {
-    "schema_version": { "type": "integer", "const": 1 },
-    "identity": { "$ref": "#/$defs/identity" },
-    "required_gates": {
-      "type": "array",
-      "uniqueItems": true,
-      "items": { "$ref": "#/$defs/gateInstanceKey" }
-    },
-    "gates": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/gateResult" }
-    },
-    "evidence_errors": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/evidenceError" }
-    },
-    "verdict": { "enum": ["VERIFIED", "FAILED", "UNVERIFIED"] },
-    "artifact": {
-      "anyOf": [
-        { "type": "null" },
-        { "$ref": "#/$defs/artifact" }
-      ]
-    }
-  },
-  "allOf": [
-    {
-      "if": { "properties": { "verdict": { "const": "VERIFIED" } }, "required": ["verdict"] },
-      "then": { "properties": { "required_gates": { "minItems": 1 } } }
-    }
-  ],
-  "$defs": {
-    "sha": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{40}$"
-    },
-    "digest": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{64}$"
-    },
-    "gateInstanceKey": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["gate_id", "suite_id", "shard_index", "shard_total"],
-      "properties": {
-        "gate_id": { "type": "string", "minLength": 1 },
-        "suite_id": { "type": ["string", "null"] },
-        "shard_index": { "type": ["integer", "null"], "minimum": 0 },
-        "shard_total": { "type": ["integer", "null"], "minimum": 1 }
-      }
-    },
-    "identity": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "repository",
-        "run_id",
-        "run_attempt",
-        "workflow",
-        "trigger",
-        "scope",
-        "requested_ref",
-        "base_sha",
-        "candidate_sha",
-        "tested_sha"
-      ],
-      "properties": {
-        "repository": { "type": "string", "minLength": 1 },
-        "run_id": { "type": "string", "minLength": 1 },
-        "run_attempt": { "type": "integer", "minimum": 1 },
-        "workflow": { "type": "string", "minLength": 1 },
-        "trigger": { "type": "string", "minLength": 1 },
-        "scope": { "enum": ["pr", "release", "scheduled"] },
-        "requested_ref": { "type": "string", "minLength": 1 },
-        "base_sha": { "$ref": "#/$defs/sha" },
-        "candidate_sha": { "$ref": "#/$defs/sha" },
-        "tested_sha": { "$ref": "#/$defs/sha" }
-      }
-    },
-    "evidenceRef": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["artifact_id", "member", "algorithm", "digest"],
-      "properties": {
-        "artifact_id": { "type": "string", "minLength": 1 },
-        "member": {
-          "type": "string",
-          "minLength": 1,
-          "pattern": "^(?!/)(?!.*(?:^|[/\\\\])\\.\\.(?:[/\\\\]|$))[^\\s]+$"
-        },
-        "algorithm": { "const": "sha256" },
-        "digest": { "$ref": "#/$defs/digest" }
-      }
-    },
-    "artifact": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["algorithm", "digest", "identity"],
-      "properties": {
-        "algorithm": { "const": "sha256" },
-        "digest": { "$ref": "#/$defs/digest" },
-        "identity": { "type": "string", "minLength": 1 }
-      }
-    },
-    "evidenceError": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["code", "gate", "detail"],
-      "properties": {
-        "code": { "type": "string", "minLength": 1 },
-        "gate": { "$ref": "#/$defs/gateInstanceKey" },
-        "detail": { "type": "string" }
-      }
-    },
-    "gateResult": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "gate_id",
-        "suite_id",
-        "shard_index",
-        "shard_total",
-        "tested_sha",
-        "run_id",
-        "run_attempt",
-        "command_id",
-        "gate_type",
-        "status",
-        "cause",
-        "exit_code",
-        "duration_ms",
-        "evidence"
-      ],
-      "properties": {
-        "gate_id": { "type": "string", "minLength": 1 },
-        "suite_id": { "type": ["string", "null"] },
-        "shard_index": { "type": ["integer", "null"], "minimum": 0 },
-        "shard_total": { "type": ["integer", "null"], "minimum": 1 },
-        "tested_sha": { "$ref": "#/$defs/sha" },
-        "run_id": { "type": "string", "minLength": 1 },
-        "run_attempt": { "type": "integer", "minimum": 1 },
-        "command_id": { "type": "string", "minLength": 1 },
-        "gate_type": { "enum": ["static", "test", "artifact"] },
-        "status": { "enum": ["PASS", "FAIL", "INFRA_ERROR", "SKIPPED"] },
-        "reason": { "type": "string", "minLength": 1 },
-        "cause": {
-          "anyOf": [
-            { "type": "null" },
-            { "$ref": "#/$defs/gateInstanceKey" }
-          ]
-        },
-        "exit_code": { "type": ["integer", "null"] },
-        "duration_ms": { "type": "integer", "minimum": 0 },
-        "evidence": {
-          "type": "array",
-          "items": { "$ref": "#/$defs/evidenceRef" }
-        }
-      },
-      "allOf": [
-        {
-          "if": {
-            "properties": { "status": { "const": "SKIPPED" } },
-            "required": ["status"]
-          },
-          "then": { "required": ["reason"] }
-        }
-      ]
-    }
-  }
-}

docs/architecture/QUALITY_GATES.md

@@ -145,7 +145,6 @@ Runs on every PR to `main`. Blocks merge on failure.
 | `check-ui-keys-coverage` (inline) | UI i18n key coverage is ≥ 65%                                                                                                                                                         | Yes          |
 | `check-ui-value-drift` (inline)   | A rewritten English **value** leaves no stale translation behind                                                                                                                      | Yes          |
 | `check-new-key-coverage` (inline) | A **new** English key reaches every locale                                                                                                                                            | Yes          |
-| `check-key-completeness` (inline) | Every locale carries exactly the key set of `en.json` (absent key = defect, whatever its age; `__MISSING__` counts as present)                                                        | Yes          |
 | `check-translation-ratio`         | Real-translation ratio per locale (identical-to-English / placeholder / missing leaves outside the allowlist) must not exceed `config/quality/i18n-translation-baseline.json` + slack | **Advisory** |
 
 Needs `fetch-depth: 0` — the value-drift gate diffs `en.json` against the merge base.
@@ -551,6 +550,8 @@ key itself, so both siblings stayed silent when batch 1 (#13044) landed 43 keys
 locales and batch 2 (#13660) 10 keys short in eight (2026-09-15). Fix a red with
 `node scripts/i18n/sync-ui-keys.mjs --locale=<codes> --translate-markers`; an `extra` leaf
 means the source dropped it — delete it from the locale. `--warn` reports without failing.
+`--catalog=cli` runs the same comparison over `bin/cli/locales` (`npm run i18n:check-keys:cli`);
+both steps live in job `i18n-ui-coverage`.
 
 #### `check-new-key-coverage` — new-key i18n gate
 

docs/guides/I18N.md

@@ -220,6 +220,7 @@ Three gates guard the catalogs, and they see different things:
 | `npm run i18n:check-ui-coverage` | ≥ 80 % of leaves translated per locale                                  |
 | `npm run i18n:check-new-keys`    | a key the PR adds to `en.json` reached every locale                     |
 | `npm run i18n:check-keys`        | every locale carries exactly the key set of `en.json`, whatever the age |
+| `npm run i18n:check-keys:cli`    | the CLI catalogs carry exactly the key set of `bin/cli/locales/en.json` |
 | `npm run i18n:check-ratio`       | share of leaves still identical to English may only fall (ratchet)      |
 
 **After every merge of the base into a locale branch**, re-sync the locales the branch owns —

docs/i18n/am/llm.txt

@@ -7,6 +7,7 @@
 
 
 
+
 > OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 359 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (110 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex, cursor, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
@@ -21,7 +22,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 177 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 176 migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -131,7 +132,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 177 versioned SQL migration files
+│   │   │   └── migrations/       # 176 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -396,7 +397,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 122 `src/lib/db/` modules with 177 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 122 `src/lib/db/` modules with 176 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -440,7 +441,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (122 domain-specific files, 177 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (122 domain-specific files, 176 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 

docs/i18n/ar/llm.txt

@@ -6,6 +6,7 @@
 
 
 
+
 > OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 359 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (110 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex, cursor, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
@@ -20,7 +21,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 6
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 177 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 176 migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -130,7 +131,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 177 versioned SQL migration files
+│   │   │   └── migrations/       # 176 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -395,7 +396,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 122 `src/lib/db/` modules with 177 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 122 `src/lib/db/` modules with 176 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,7 +440,7 @@ diagnostics) plus **memory**, **skill**, **agentSkill**, **githubSkill**, **pool
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (122 domain-specific files, 177 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (122 domain-specific files, 176 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.