chore(release): v2.5.5 — model list dedup, Electron build hardening, Kiro credit tracking

feat: add Kiro credit tracking in usage fetcher (#337)

.husky/pre-commit

@@ -1,2 +1,3 @@
 npx lint-staged
 node scripts/check-docs-sync.mjs
+npm run test:unit

CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+---
+
+## [2.5.5] - 2026-03-15
+
+> Model list dedup fix, Electron standalone build hardening, and Kiro credit tracking.
+
+### 🐛 Bug Fixes
+
+- **fix(models) #380**: `GET /api/models` now includes provider aliases when building the active-provider filter — models for `claude` (alias `cc`) and `github` (alias `gh`) were always shown regardless of whether a connection was configured, because `PROVIDER_MODELS` keys are aliases but DB connections are stored under provider IDs. Fixed by expanding each active provider ID to also include its alias via `PROVIDER_ID_TO_ALIAS`. Closes #353.
+- **fix(electron) #379**: New `scripts/prepare-electron-standalone.mjs` stages a dedicated `/.next/electron-standalone` bundle before Electron packaging. Aborts with a clear error if `node_modules` is a symlink (electron-builder would ship a runtime dependency on the build machine). Cross-platform path sanitization via `path.basename`. By @kfiramar.
+
+### ✨ New Features
+
+- **feat(kiro) #381**: Kiro credit balance tracking — usage endpoint now returns credit data for Kiro accounts by calling `codewhisperer.us-east-1.amazonaws.com/getUserCredits` (same endpoint Kiro IDE uses internally). Returns remaining credits, total allowance, renewal date, and subscription tier. Closes #337.
+
+## [2.5.4] - 2026-03-15
+
+> Logger startup fix, login bootstrap security fix, and dev HMR reliability improvement. CI infrastructure hardened.
+
+### 🐛 Bug Fixes (PRs #374, #375, #376 by @kfiramar)
+
+- **fix(logger) #376**: Restore pino transport logger path — `formatters.level` combined with `transport.targets` is rejected by pino. Transport-backed configs now strip the level formatter via `getTransportCompatibleConfig()`. Also corrects numeric level mapping in `/api/logs/console`: `30→info, 40→warn, 50→error` (was shifted by one).
+- **fix(login) #375**: Login page now bootstraps from the public `/api/settings/require-login` endpoint instead of the protected `/api/settings`. In password-protected setups, the pre-auth page was receiving a 401 and falling back to safe defaults unnecessarily. The public route now returns all bootstrap metadata (`requireLogin`, `hasPassword`, `setupComplete`) with a conservative 200 fallback on error.
+- **fix(dev) #374**: Add `localhost` and `127.0.0.1` to `allowedDevOrigins` in `next.config.mjs` — HMR websocket was blocked when accessing the app via loopback address, producing repeated cross-origin warnings.
+
+### 🔧 CI & Infrastructure
+
+- **ESLint OOM fix**: `eslint.config.mjs` now ignores `vscode-extension/**`, `electron/**`, `docs/**`, `app/.next/**`, and `clipr/**` — ESLint was crashing with a JS heap OOM by scanning VS Code binary blobs and compiled chunks.
+- **Unit test fix**: Removed stale `ALTER TABLE provider_connections ADD COLUMN "group"` from 2 test files — column is now part of the base schema (added in #373), causing `SQLITE_ERROR: duplicate column name` on every CI run.
+- **Pre-commit hook**: Added `npm run test:unit` to `.husky/pre-commit` — unit tests now block broken commits before they reach CI.
+
 ## [2.5.3] - 2026-03-14
 
 > Critical bugfixes: DB schema migration, startup env loading, provider error state clearing, and i18n tooltip fix. Code quality improvements on top of each PR.

docs/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 2.5.3
+  version: 2.5.5
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,

electron/package.json

@@ -12,13 +12,14 @@
   "scripts": {
     "start": "electron .",
     "dev": "electron . --no-sandbox",
-    "build": "electron-builder",
-    "build:win": "electron-builder --win",
-    "build:mac": "electron-builder --mac",
-    "build:mac-x64": "electron-builder --mac --x64",
-    "build:mac-arm64": "electron-builder --mac --arm64",
-    "build:linux": "electron-builder --linux",
-    "pack": "electron-builder --dir"
+    "prepare:bundle": "node ../scripts/prepare-electron-standalone.mjs",
+    "build": "npm run prepare:bundle && electron-builder",
+    "build:win": "npm run prepare:bundle && electron-builder --win",
+    "build:mac": "npm run prepare:bundle && electron-builder --mac",
+    "build:mac-x64": "npm run prepare:bundle && electron-builder --mac --x64",
+    "build:mac-arm64": "npm run prepare:bundle && electron-builder --mac --arm64",
+    "build:linux": "npm run prepare:bundle && electron-builder --linux",
+    "pack": "npm run prepare:bundle && electron-builder --dir"
   },
   "dependencies": {
     "electron-updater": "^6.8.3"
@@ -47,24 +48,18 @@
     ],
     "extraResources": [
       {
-        "from": "../.next/standalone",
+        "from": "../.next/electron-standalone",
         "to": "app",
         "filter": [
           "**/*"
         ]
       },
       {
-        "from": "../.next/static",
-        "to": "app/.next/static",
+        "from": "assets",
+        "to": "assets",
         "filter": [
-          "**/*"
-        ]
-      },
-      {
-        "from": "../public",
-        "to": "app/public",
-        "filter": [
-          "**/*"
+          "icon.png",
+          "tray-icon.png"
         ]
       }
     ],

eslint.config.mjs

@@ -24,16 +24,34 @@ const eslintConfig = [
       "react-hooks/rules-of-hooks": "off",
     },
   },
-  // Global ignores (open-sse and tests REMOVED — now linted)
+  // Global ignores — keep ESLint scoped to source files only
   {
     ignores: [
+      // Next.js build output
       ".next/**",
       "out/**",
       "build/**",
       "next-env.d.ts",
+      // Scripts and binaries
       "scripts/**",
       "bin/**",
+      // Dependencies
       "node_modules/**",
+      // VS Code extension and its large test fixtures
+      "vscode-extension/**",
+      // Electron app
+      "electron/**",
+      // Docs
+      "docs/**",
+      // Open-SSE compiled/bundled output
+      "open-sse/mcp-server/dist/**",
+      // Playwright test output
+      "playwright-report/**",
+      "test-results/**",
+      // Subdirectory .next build output (app/ subdir)
+      "app/.next/**",
+      // CLI package copy directory
+      "clipr/**",
     ],
   },
 ];

next.config.mjs

@@ -8,7 +8,7 @@ const nextConfig = {
   output: "standalone",
   serverExternalPackages: ["better-sqlite3", "zod"],
   transpilePackages: ["@omniroute/open-sse"],
-  allowedDevOrigins: ["192.168.*"],
+  allowedDevOrigins: ["localhost", "127.0.0.1", "192.168.*"],
   typescript: {
     // TODO: Re-enable after fixing all sub-component useTranslations scope issues
     ignoreBuildErrors: true,

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "2.5.1",
+  "version": "2.5.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "2.5.1",
+      "version": "2.5.5",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [

package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "2.5.3",
+  "version": "2.5.5",
   "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
   "type": "module",
   "bin": {

scripts/prepare-electron-standalone.mjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+
+import {
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const ROOT = join(__dirname, "..");
+
+const STANDALONE_DIR = join(ROOT, ".next", "standalone");
+const ELECTRON_STANDALONE_DIR = join(ROOT, ".next", "electron-standalone");
+const STATIC_SRC = join(ROOT, ".next", "static");
+const STATIC_DEST = join(ELECTRON_STANDALONE_DIR, ".next", "static");
+const PUBLIC_SRC = join(ROOT, "public");
+const PUBLIC_DEST = join(ELECTRON_STANDALONE_DIR, "public");
+
+function resolveStandaloneBundleDir() {
+  const directServer = join(STANDALONE_DIR, "server.js");
+  if (existsSync(directServer)) {
+    return STANDALONE_DIR;
+  }
+
+  const nestedCandidates = [
+    join(STANDALONE_DIR, "projects", "OmniRoute"),
+    join(STANDALONE_DIR, basename(ROOT)),
+  ];
+
+  for (const candidate of nestedCandidates) {
+    if (existsSync(join(candidate, "server.js"))) {
+      return candidate;
+    }
+  }
+
+  throw new Error(
+    `Standalone server bundle not found in ${STANDALONE_DIR}. Run \`npm run build\` first.`
+  );
+}
+
+function createPathPattern(filePath) {
+  return filePath
+    .replace(/\\/g, "/")
+    .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    .replace(/\//g, "[\\\\/]");
+}
+
+function sanitizeBuildPaths(bundleDir) {
+  const buildRoot = ROOT.replace(/\\/g, "/");
+  const bundleRoot = bundleDir.replace(/\\/g, "/");
+  const replacements = [buildRoot, bundleRoot];
+  const targets = [
+    join(ELECTRON_STANDALONE_DIR, "server.js"),
+    join(ELECTRON_STANDALONE_DIR, ".next", "required-server-files.json"),
+  ];
+
+  for (const filePath of targets) {
+    if (!existsSync(filePath)) continue;
+
+    let content = readFileSync(filePath, "utf8");
+    let updated = content;
+
+    for (const original of replacements) {
+      updated = updated.replace(new RegExp(createPathPattern(original), "g"), ".");
+    }
+
+    if (updated !== content) {
+      writeFileSync(filePath, updated, "utf8");
+    }
+  }
+}
+
+function ensurePackage(pkgPath, sourcePath) {
+  if (existsSync(pkgPath) || !existsSync(sourcePath)) return;
+  mkdirSync(dirname(pkgPath), { recursive: true });
+  cpSync(sourcePath, pkgPath, { recursive: true, dereference: true });
+}
+
+function assertBundleIsPackagable(bundleDir) {
+  const nodeModulesPath = join(bundleDir, "node_modules");
+  if (!existsSync(nodeModulesPath)) return;
+
+  if (lstatSync(nodeModulesPath).isSymbolicLink()) {
+    throw new Error(
+      [
+        "Next standalone emitted app/node_modules as a symlink.",
+        "electron-builder preserves extraResources symlinks, which would make the packaged app",
+        "depend on the original build machine path at runtime.",
+        "",
+        `Offending path: ${nodeModulesPath}`,
+        "Use a real node_modules directory in the build worktree before packaging Electron.",
+      ].join("\n")
+    );
+  }
+}
+
+function logContextualError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(`[electron] failed to prepare standalone bundle: ${message}`);
+  process.exitCode = 1;
+}
+
+process.on("uncaughtException", logContextualError);
+
+const bundleDir = resolveStandaloneBundleDir();
+assertBundleIsPackagable(bundleDir);
+
+rmSync(ELECTRON_STANDALONE_DIR, { recursive: true, force: true });
+mkdirSync(ELECTRON_STANDALONE_DIR, { recursive: true });
+
+cpSync(bundleDir, ELECTRON_STANDALONE_DIR, {
+  recursive: true,
+  dereference: true,
+});
+
+sanitizeBuildPaths(bundleDir);
+
+if (existsSync(STATIC_SRC)) {
+  mkdirSync(dirname(STATIC_DEST), { recursive: true });
+  cpSync(STATIC_SRC, STATIC_DEST, { recursive: true, dereference: true });
+}
+
+if (existsSync(PUBLIC_SRC)) {
+  cpSync(PUBLIC_SRC, PUBLIC_DEST, { recursive: true, dereference: true });
+}
+
+ensurePackage(
+  join(ELECTRON_STANDALONE_DIR, "node_modules", "@swc", "helpers"),
+  join(ROOT, "node_modules", "@swc", "helpers")
+);
+
+ensurePackage(
+  join(ELECTRON_STANDALONE_DIR, "node_modules", "better-sqlite3"),
+  join(ROOT, "node_modules", "better-sqlite3")
+);
+
+console.log(
+  `[electron] prepared standalone bundle: ${relative(ROOT, ELECTRON_STANDALONE_DIR) || "."}`
+);

src/app/api/logs/console/route.ts

@@ -26,10 +26,10 @@ const LEVEL_ORDER: Record<string, number> = {
 // Map pino numeric levels to string levels
 const NUMERIC_LEVEL_MAP: Record<number, string> = {
   10: "trace",
-  20: "info",
-  30: "warn",
-  40: "error",
-  50: "fatal",
+  20: "debug",
+  30: "info",
+  40: "warn",
+  50: "error",
   60: "fatal",
 };
 

src/app/api/models/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { getModelAliases, setModelAlias, getProviderConnections } from "@/models";
-import { AI_MODELS } from "@/shared/constants/config";
+import { AI_MODELS, PROVIDER_ID_TO_ALIAS } from "@/shared/constants/models";
 import { updateModelAliasSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
@@ -18,7 +18,17 @@ export async function GET(request: Request) {
       try {
         const connections = await getProviderConnections();
         const active = connections.filter((c: any) => c.isActive !== false);
-        activeProviders = new Set(active.map((c: any) => c.provider));
+        // Include both provider IDs and their aliases in the active set.
+        // PROVIDER_MODELS keys are aliases (e.g. 'cc' for 'claude', 'gh' for 'github').
+        // DB connections are stored under provider IDs ('claude', 'github').
+        // Without this, models for aliased providers always appear unconfigured.
+        activeProviders = new Set<string>();
+        for (const c of active) {
+          const pId = String((c as any).provider);
+          activeProviders.add(pId);
+          const alias = PROVIDER_ID_TO_ALIAS[pId];
+          if (alias) activeProviders.add(alias);
+        }
       } catch {
         // If DB unavailable, show all models
       }

src/app/api/settings/require-login/route.ts

@@ -8,9 +8,15 @@ export async function GET() {
   try {
     const settings = await getSettings();
     const requireLogin = settings.requireLogin !== false;
-    return NextResponse.json({ requireLogin });
+    const hasPassword = !!settings.password || !!process.env.INITIAL_PASSWORD;
+    const setupComplete = !!settings.setupComplete;
+    return NextResponse.json({ requireLogin, hasPassword, setupComplete });
   } catch (error) {
-    return NextResponse.json({ requireLogin: true }, { status: 200 });
+    console.error("[API] Error fetching require-login settings:", error);
+    return NextResponse.json(
+      { requireLogin: true, hasPassword: true, setupComplete: true },
+      { status: 200 }
+    );
   }
 }
 

src/app/login/page.tsx

@@ -24,7 +24,7 @@ export default function LoginPage() {
       const baseUrl = typeof window !== "undefined" ? window.location.origin : "";
 
       try {
-        const res = await fetch(`${baseUrl}/api/settings`, {
+        const res = await fetch(`${baseUrl}/api/settings/require-login`, {
           signal: controller.signal,
         });
         clearTimeout(timeoutId);

src/lib/usage/fetcher.ts

@@ -27,6 +27,8 @@ export async function getUsageForProvider(connection) {
       return await getQwenUsage(accessToken, providerSpecificData);
     case "iflow":
       return await getIflowUsage(accessToken);
+    case "kiro":
+      return await getKiroUsage(accessToken);
     default:
       return { message: `Usage API not implemented for ${provider}` };
   }
@@ -215,3 +217,56 @@ async function getIflowUsage(accessToken) {
     return { message: "Unable to fetch iFlow usage." };
   }
 }
+
+/**
+ * Kiro Credits
+ * Fetches credit balance from Kiro's AWS CodeWhisperer backend.
+ * The endpoint mirrors what Kiro IDE uses internally for the credit badge.
+ */
+async function getKiroUsage(accessToken: string) {
+  try {
+    const response = await fetch("https://codewhisperer.us-east-1.amazonaws.com/getUserCredits", {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+        "User-Agent": "AWS-SDK-JS/3.0.0 kiro-ide/1.0.0",
+        "X-Amz-User-Agent": "aws-sdk-js/3.0.0 kiro-ide/1.0.0",
+      },
+    });
+
+    if (!response.ok) {
+      const errText = await response.text();
+      // 401/403 = expired token, show user-friendly message
+      if (response.status === 401 || response.status === 403) {
+        return { message: "Kiro token expired. Please reconnect in Dashboard → Providers → Kiro." };
+      }
+      throw new Error(`Kiro credits API error (${response.status}): ${errText}`);
+    }
+
+    const data = await response.json();
+
+    // Response shape: { remainingCredits, totalCredits, resetDate, subscriptionType }
+    const remaining = data.remainingCredits ?? data.remaining_credits ?? null;
+    const total = data.totalCredits ?? data.total_credits ?? null;
+    const resetDate = data.resetDate ?? data.reset_date ?? null;
+    const plan = data.subscriptionType ?? data.subscription_type ?? "unknown";
+
+    if (remaining === null) {
+      return { message: "Kiro connected. Credit data unavailable — check Kiro IDE for balance." };
+    }
+
+    return {
+      plan,
+      credits: {
+        remaining,
+        total: total ?? remaining,
+        used: total != null ? total - remaining : 0,
+        unlimited: total === null || total === 0,
+        resetDate,
+      },
+    };
+  } catch (error: any) {
+    return { message: `Unable to fetch Kiro credits: ${error.message}` };
+  }
+}

src/shared/utils/logger.ts

@@ -30,6 +30,14 @@ const baseConfig: pino.LoggerOptions = {
   },
 };
 
+function getTransportCompatibleConfig(): pino.LoggerOptions {
+  const { formatters, ...rest } = baseConfig;
+  if (!formatters) return rest;
+
+  const { level: _levelFormatter, ...safeFormatters } = formatters;
+  return Object.keys(safeFormatters).length > 0 ? { ...rest, formatters: safeFormatters } : rest;
+}
+
 /**
  * Build the logger with optional file transport.
  * Uses pino transport targets for all destinations.
@@ -37,6 +45,7 @@ const baseConfig: pino.LoggerOptions = {
 function buildLogger(): pino.Logger {
   const logConfig = getLogConfig();
   const logLevel = (baseConfig.level as string) || "info";
+  const transportConfig = getTransportCompatibleConfig();
 
   // If file logging is enabled, set up dual transport (stdout + file)
   if (logConfig.logToFile) {
@@ -50,7 +59,7 @@ function buildLogger(): pino.Logger {
       if (isDev) {
         // Dev: pino-pretty → stdout, JSON → file
         return pino({
-          ...baseConfig,
+          ...transportConfig,
           transport: {
             targets: [
               {
@@ -76,7 +85,7 @@ function buildLogger(): pino.Logger {
 
       // Production: JSON → stdout + JSON → file
       return pino({
-        ...baseConfig,
+        ...transportConfig,
         transport: {
           targets: [
             {

tests/unit/auth-clear-account-error.test.mjs

@@ -24,7 +24,6 @@ test.after(() => {
 
 test("clearAccountError clears stale provider error metadata after recovery", async () => {
   await resetStorage();
-  core.getDbInstance().exec('ALTER TABLE provider_connections ADD COLUMN "group" TEXT');
 
   const created = await providersDb.createProviderConnection({
     provider: "codex",

tests/unit/auth-clear-provider-routes.test.mjs

@@ -16,7 +16,6 @@ async function resetStorage() {
   core.resetDbInstance();
   fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
   fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
-  core.getDbInstance().exec('ALTER TABLE provider_connections ADD COLUMN "group" TEXT');
 }
 
 async function seedOpenAIConnection(email) {

tests/unit/console-log-levels.test.mjs

@@ -0,0 +1,54 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_LOG_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-console-log-levels-"));
+const TEST_LOG_PATH = path.join(TEST_LOG_DIR, "app.log");
+
+const originalLogFilePath = process.env.LOG_FILE_PATH;
+process.env.LOG_FILE_PATH = TEST_LOG_PATH;
+
+const route = await import("../../src/app/api/logs/console/route.ts");
+
+test.after(() => {
+  if (originalLogFilePath === undefined) {
+    delete process.env.LOG_FILE_PATH;
+  } else {
+    process.env.LOG_FILE_PATH = originalLogFilePath;
+  }
+  fs.rmSync(TEST_LOG_DIR, { recursive: true, force: true });
+});
+
+test("console log API normalizes numeric pino levels correctly", async () => {
+  fs.writeFileSync(
+    TEST_LOG_PATH,
+    [
+      JSON.stringify({
+        timestamp: new Date().toISOString(),
+        level: 30,
+        module: "probe",
+        msg: "info entry",
+      }),
+      JSON.stringify({
+        timestamp: new Date().toISOString(),
+        level: 40,
+        module: "probe",
+        msg: "warn entry",
+      }),
+    ].join("\n") + "\n",
+    "utf8"
+  );
+
+  const response = await route.GET(
+    new Request("http://localhost/api/logs/console?level=info&limit=10")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.deepEqual(
+    body.map((entry) => entry.level),
+    ["info", "warn"]
+  );
+});

tests/unit/dev-origins-config.test.mjs

@@ -0,0 +1,8 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+test("next config allows loopback dev origins alongside LAN access", async () => {
+  const { default: nextConfig } = await import("../../next.config.mjs");
+
+  assert.deepEqual(nextConfig.allowedDevOrigins, ["localhost", "127.0.0.1", "192.168.*"]);
+});

tests/unit/login-bootstrap-route.test.mjs

@@ -0,0 +1,83 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-login-bootstrap-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const settingsDb = await import("../../src/lib/db/settings.ts");
+const route = await import("../../src/app/api/settings/require-login/route.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  delete process.env.INITIAL_PASSWORD;
+  await resetStorage();
+});
+
+test.after(() => {
+  delete process.env.INITIAL_PASSWORD;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("public login bootstrap route exposes the metadata the login page consumes", async () => {
+  await settingsDb.updateSettings({
+    requireLogin: true,
+    setupComplete: true,
+  });
+
+  const response = await route.GET();
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.deepEqual(body, {
+    requireLogin: true,
+    hasPassword: false,
+    setupComplete: true,
+  });
+});
+
+test("public login bootstrap route reports env-provided bootstrap password metadata", async () => {
+  process.env.INITIAL_PASSWORD = "bootstrap-secret";
+
+  await settingsDb.updateSettings({
+    requireLogin: true,
+    setupComplete: true,
+  });
+
+  const response = await route.GET();
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.deepEqual(body, {
+    requireLogin: true,
+    hasPassword: true,
+    setupComplete: true,
+  });
+});
+
+test("public login bootstrap route reports stored password metadata and disabled auth state", async () => {
+  await settingsDb.updateSettings({
+    requireLogin: false,
+    password: "hashed-password",
+    setupComplete: true,
+  });
+
+  const response = await route.GET();
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.deepEqual(body, {
+    requireLogin: false,
+    hasPassword: true,
+    setupComplete: true,
+  });
+});