* fix(gemini): preserve structured tool calls for antigravity * fix(gemini): parse prefixed textual tool calls * fix(antigravity): preserve textual SSE tool calls * fix(stream): normalize textual passthrough tool calls * fix(stream): normalize split textual tool calls * fix(stream): suppress malformed textual tool calls * fix(stream): suppress compact malformed tool calls * fix(stream): emit structured textual tool calls * fix(stream): suppress unknown textual tool calls * fix(stream): normalize responses textual tool calls * chore: ignore .claude/settings.local.json (per-user Claude Code permissions) * fix(opencode-go): route qwen3.x via claude messages + repair fixMissingToolResponses for Claude-shape upstreams (#2791) Integrated into release/v3.8.6 * fix: resolve npm install warnings — remove dead deps, relax engine constraint (#2792) Integrated into release/v3.8.6 * fix: register missing web-cookie validators (claude-web, gemini-web, copilot-web, t3-web) (#2793) Integrated into release/v3.8.6 * fix: Error: Unable to inspect existing database #2771 (#2795) Integrated into release/v3.8.6 * fix(oauth): repair Google loopback callback flow (#2796) Integrated into release/v3.8.6 * feat(logs): add clean history button (#2799) Integrated into release/v3.8.6 * [codex] home: restore settings-driven home layout and quota auto-refresh (#2800) Integrated into release/v3.8.6 * fix(gemini): emit signaturelessToolCallMode:text for GEMINI format models (#2801) Integrated into release/v3.8.6 * feat(modelSpecs): align opencode-go family with upstream provider limits (#2802) Integrated into release/v3.8.6 * chore: apply unit test fixes, polyfills, and environment precedence fixes * docs(agents): atualiza fluxos de release e triagem Expande os workflows de release para incluir auditoria de segurança, CHANGELOG completo por commits, quality gate obrigatório, homologação em VPS local, publicação oficial, deploy em Akamai e validação de artefatos. Reorganiza a triagem de features com arquivos permanentes por bucket, suporte a itens em andamento, regra de reclaim após 15 dias e novo tratamento para ideias viáveis catalogadas. Corrige a orientação de revisão de discussões para usar a ordem cronológica real dos comentários e respostas ao identificar a última atividade. * fix(lockout): classify Gemini Antigravity resource exhaustion as quota_exhausted * fix(reasoning): gate replay by interleaved field * docs(rule-16): permit human Co-authored-by, restrict only AI/bot trailers Rule #16 previously banned all `Co-Authored-By` trailers absolutely. That blocked the upstream-port workflows (`/port-upstream-features` and `/port-upstream-issues`), which must credit human upstream PR authors and issue reporters in OmniRoute commits. Refine the rule to ban only AI/bot-attributed trailers (Claude, GPT, Copilot, Bot; anthropic.com / openai.com / bot-owned noreply.github.com emails) while allowing standard human `Co-authored-by: Name <email>` attribution. Sync the rule across the source CLAUDE.md, the E2E shakedown doc note, and 41 i18n translations. * fix(gitlawb): add specialty validators for connection test — bypass /models probe GitLawB OpenGateway API (xiaomi-mimo compatible) does not expose a /models endpoint, causing validateOpenAILikeProvider to 404 on the initial probe and report 'Provider validation endpoint not supported'. Add specialty validators for both gitlawb and gitlawb-gmi that follow the same pattern as the existing xiaomi-mimo validator: skip GET /models, validate directly via POST /chat/completions with a minimal test message. Any 401/403 response means an invalid key; all other responses mean auth is OK. Fixes test-connection returning 404 for GitLawB providers. * test(gitlawb): add 12 unit tests for gitlawb and gitlawb-gmi specialty validators Covers success, auth failure (401/403), non-auth acceptance (400/422/429), network errors, and custom baseUrl overrides for both providers. * feat(gitlawb): serve models from static registry without API-unavailable warning GitLawB's OpenGateway API does not expose a /models endpoint per provider-path. Previously the models route fell through to the generic fallback which returned static catalog models with the misleading 'API unavailable — using local catalog' warning. Now gitlawb and gitlawb-gmi are handled as static model providers (same pattern as reka and qwen OAuth) — models are served from the provider registry without any warning, since all registered models are functional via POST /chat/completions. * refactor(gitlawb): extract shared opengateway validator factory, fix docs path in test - Extract gitlawb/gitlawb-gmi validators into buildOpengatewayValidator factory - Fix dockerignore-docs-coverage test: update stale docs/AUTO-COMBO.md -> docs/routing/AUTO-COMBO.md * fix(reasoning): guard interleaved capability lookup * feat(gitlawb): dynamic model fetch with gmi-cloud fallback Hybrid approach: - gitlawb (xiaomi-mimo): dynamic /models endpoint → 356 models - gitlawb-gmi (gmi-cloud): 404 fallback → local catalog gracefully Mimics Gitlawb/openclaude's model-routing pattern * i18n(pt-BR): complete missing translations and sync with en.json * feat(build): nix multi-OS package manager install (#2806) Integrated into release/v3.8.6 * fix(i18n): translate 144 new __MISSING__ pt-BR strings (#2816) Integrated into release/v3.8.6 * chore(docs): set coverage gate to 40/40/40/40 in CLAUDE.md Aligns the documented coverage gate with the v3.8.6 release decision (lowered from 75/75/75/70). Matches the threshold already set in package.json by the large feature PRs (planos 11-22). * fix(cli): respect PORT env var in serve command (#2845) Integrated into release/v3.8.6. * fix(deepseek-web): return 400 when client sends tools[] - chat.deepseek.com has no tool support (#2854) Integrated into release/v3.8.6. * fix(qoder): reject invalid/expired PATs returning Cosy 500 error (#2860) Integrated into release/v3.8.6. * fix(cli): register openclaw in tool-detector (#2833) (#2850) Integrated into release/v3.8.6. * fix(api): include noAuth providers in /v1/models catalog (#2798) (#2814) Integrated into release/v3.8.6. * fix(combo): resolve custom provider targets via combo name (#2778) (#2812) Integrated into release/v3.8.6. * fix(translator): strip safety_identifier in openai-responses cleanup (#2770) (#2809) Integrated into release/v3.8.6. * fix(quota): honor explicit per-connection preflight opt-out (#2831) (#2844) Integrated into release/v3.8.6. * fix(usage): un-invert GitHub Copilot Free/limited quota — limited_user_quotas is remaining (#2876) (#2881) Integrated into release/v3.8.6. * fix(nous-research): correct baseUrl to include /chat/completions (#2826) (#2835) Integrated into release/v3.8.6. * fix(opencode): qwen3.x max/plus models lack vision support (#2822) (#2836) Integrated into release/v3.8.6. * fix(translator): pass-through tool_search built-in tool type (#2766) (#2811) Integrated into release/v3.8.6. * fix(github): route claude-opus-4.6 via chat completions (#2821) Integrated into release/v3.8.6. * docs(oauth): add Windsurf login fix design (Phase 1 hotfix + Phase 2 Firebase OAuth) Two-phase plan to fix the broken Windsurf OAuth flow: - Phase 1: drop the dead app.devin.ai/editor/signin PKCE path, promote import-token from windsurf.com/show-auth-token as the primary path - Phase 2: port Firebase OAuth + RegisterUser flow from fendoushaonian/WindSurf-gRPC-API for full browser-based automation Spec only - no code changes yet. * docs(plan): Phase 1 windsurf login hotfix implementation plan 10 tasks covering: - TDD assertions for flowType + 410 Gone responses - Provider switch to import_token - Route handler retiring authorize/start-callback-server/poll-callback - OAuthModal UI override - i18n sync - Verification + PR steps * fix(cli): replace cli-table3 with hand-rolled formatter (#2752) (#2813) Integrated into release/v3.8.6. * fix(skills): skip interception for unregistered client-native tools (#2815) (#2817) Integrated into release/v3.8.6. * feat(sse): add RTK filters for kubectl, docker-build, composer, gh (#2824) Integrated into release/v3.8.6. * fix(geminiHelper): support rec.image content shape + warn on dropped remote URLs (refs #2807) (#2855) Integrated into release/v3.8.6. * fix(cli): allow nullable/optional apiKey in cliMitmStartSchema (#2857) Integrated into release/v3.8.6. * fix(combo): preserve system messages during context handoff summary generation (#2865) Integrated into release/v3.8.6. * fix: wire CLIProxyAPI fallback settings into chatCore routing engine (#2866) Integrated into release/v3.8.6. * fix(usage): add opencode quota fetcher (#2852) (#2867) Integrated into release/v3.8.6. * feat(claude): default xhigh support for newer Opus models (#2874) Integrated into release/v3.8.6. * fix(cli): restore omniroute logs command stream (#2756) (#2810) Integrated into release/v3.8.6. * fix(combo): normalize upstream Headers for Node 24 undici interop (#2751) (#2823) Integrated into release/v3.8.6. * Rename proxy log Public IP to Client IP (#2880) Integrated into release/v3.8.6. * fix(claude): preserve max effort for supported models (#2875) Integrated into release/v3.8.6. * fix(oauth): switch windsurf provider to import_token flow The PKCE auth URL targeting app.devin.ai/editor/signin returns 404 post-rebrand. Until Phase 2 ports Firebase OAuth + RegisterUser, the only supported path is import-token via windsurf.com/show-auth-token. - windsurf.ts: drop buildAuthUrl, set flowType=import_token - generateAuthData returns supported:false + helpful error for windsurf/devin-cli - tests: assert flowType + disabled stub * fix(oauth): return 410 Gone for retired windsurf/devin-cli PKCE actions start-callback-server, authorize, and poll-callback (GET + POST) now return 410 Gone with a pointer to /import-token. The 410 short-circuit runs before auth so the response is honest about the action being permanently gone, not gated. Codex PKCE flow unchanged. Tests: 5 new assertions cover GET + POST 410 paths and a Codex regression check. * refactor(oauth): annotate retired PKCE fields in WINDSURF_CONFIG No behaviour change - comment-only update documenting that authorizeUrl, codeChallengeMethod, callbackPort, callbackPath, apiServerUrl, and exchangePath are no longer consumed. Active fields (inferenceUrl, showAuthTokenUrl, firebaseApiKey, ideName) called out separately. * fix(cli,docs): use requireCliToolsAuth in logs route + document OPENCODE quota env Post-merge contract fixes for v3.8.6: - src/app/api/cli-tools/logs/route.ts (#2810) now uses the shared requireCliToolsAuth guard (param renamed req->request) to satisfy the cli-tools-auth-hardening contract test. - Document OMNIROUTE_OPENCODE_QUOTA_URL (#2867) in docs/reference/ENVIRONMENT.md to satisfy the env/docs sync contract. * fix(dashboard): force import-token panel for windsurf/devin-cli Phase 1 hotfix: hide the 'Browser Login' tab and start in Paste API Key mode. Removes windsurf/devin-cli from PKCE_CALLBACK_SERVER_PROVIDERS so no callback server is started for them. Codex still uses the PKCE flow. The 'Get token' link continues to point at windsurf.com/show-auth-token via the existing supportsTokenPaste form copy. * fix(oauth): windsurf import-token mapTokens signature mismatch The route at `src/app/api/oauth/[provider]/[action]/route.ts` invokes `providerData.mapTokens({ accessToken: token })` (object), matching the cursor/kiro signature. The windsurf provider was declared with `mapTokens(token: string)` instead, so the entire object was stored as `accessToken`. When the connection record reached the SQLite layer it crashed with: SQLite3 can only bind numbers, strings, bigints, buffers, and null Fix by aligning windsurf's `mapTokens` signature with the route caller and the cursor/kiro convention. Also dedupe a copy-pasted second `if (action === "import-token")` block in the route handler — the second block was unreachable but identical to the first. Adds two regression tests asserting that `provider.mapTokens({ accessToken })` returns a string `accessToken` for both windsurf and devin-cli, so a future signature drift trips the gate instead of the SQLite bind error in production. * feat(compression): expand pt-BR pack with troglodita rules (15 → 49) (#2818) Integrated into release/v3.8.6 * fix(sse): repair RTK engine defaults so dedup and direct calls work (#2825) Integrated into release/v3.8.6 * fix(mcp): redirect console.log/warn to stderr in --mcp stdio mode (#2840) Integrated into release/v3.8.6 * fix(gemini-cli): prefer real project IDs over default-project (#2841) Integrated into release/v3.8.6 * fix(opencode-go): add provider limits quota fetcher (#2861) Integrated into release/v3.8.6 * Audit & add web cookie providers: fix 4 missing registry entries + DuckDuckGo (#2862) Integrated into release/v3.8.6 * fix(antigravity): harden signatureless tool history (#2878) Integrated into release/v3.8.6 * fix: provider model sync pruning and dynamic antigravity MITM proxy mappings (#2886) Integrated into release/v3.8.6 * feat(usage): per-API-key token limits scoped to model/provider/global (#2888) Integrated into release/v3.8.6 * fix(audio): build multipart body manually to preserve Content-Type (#2842) Integrated into release/v3.8.6 * refactor: remove agent skill documentation files and streamline maintenance workflows * test(stabilization): resolve unit test failures in blackbox-web, schema-coercion, translator-helper-branches, usage-service-hardening, and audio-transcription * fix(security): mitigate Socket.dev supply-chain findings + secrets opt-in + minimal build profile (#2863) (#2871) Two real security gaps closed and four cosmetic Socket.dev fingerprints removed. See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer attestation. Real bugs fixed: - cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in `OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` / `refreshToken` / `providerSpecificData` from a remote response. Closes the silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could previously replace local tokens unverified). - Zed import: split into 2-step `/discover` + `/import` flow. `/import` now requires `confirmedAccounts: [{ service, account, fingerprint }]` and re-reads the keychain server-side to filter by fingerprint, so a tampered discover response cannot trick the endpoint into saving an unrelated token. Cosmetic Socket.dev mitigations: - runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1` file (mode 0o600) and references it via `-File`. Removes the textbook `-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI classifier. - Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`. Build-time hardening: - `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically removes the four sensitive modules from the standalone bundle via webpack `NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at runtime. Intended for the `omniroute-secure` artifact. Tests: - 24 new unit tests in `tests/unit/security/` covering the wrapper builder, HMAC verification (4 cases), credential fingerprint determinism (5 cases), confirmedAccounts validation + fingerprint filtering (6 cases), and the minimal-build stubs (5 cases). Docs: - New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation. - New `socket.yml` — Socket.dev v2 config pointing at the attestation. - Updated `SECURITY.md` — supply-chain scanner section. - Updated `.env.example` — three new env vars documented. Backwards compatibility: - Cloud sync token overwrite is OFF by default. Users who relied on it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented in CHANGELOG. - Zed import 2-step is the new default; legacy 1-step preserved behind `OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9. Closes #2863 * fix(security): redact public Firebase Web key from windsurf spec; doc SHA-256 cache-key rationale (#2894) Two security-scanning findings on release/v3.8.6: - Secret-scanning alert 7 (google_api_key): the windsurf login-fix design spec embedded the literal public Firebase Web API key on two lines. Firebase Web API keys are non-sensitive by design (they identify the project; access is gated by Firebase Security Rules + key restrictions), but the literal trips secret scanning. Redacted to a placeholder; the embedded default still goes through resolvePublicCred per rule #11. - Code-scanning alert 261 (js/insufficient-password-hash): tokenCacheKey() uses SHA-256 to derive an in-memory cache key from the session token, not for password-at-rest storage. Added a comment documenting why CWE-916 KDFs do not apply (false positive). * fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) (#2895) * fix(ci): resolve release/v3.8.6 gate failures (docs-sync, any-budget, pack-artifact) Three CI gates failed on release/v3.8.6 (run 26630300877): - docs-sync: CHANGELOG had a spurious "## [3.8.6-patch]" section above "## [3.8.6]", so the latest release no longer matched package.json (3.8.6) and the 41 i18n CHANGELOG mirrors were flagged as missing that section. Fold the lone #2752 entry into [3.8.6] and drop the patch heading. - any-budget:t11: open-sse/handlers/chatCore.ts regressed to 1 explicit `any` (budget 0). Type the persist callback arg as Record<string, unknown>, which matches runWithOnPersist's RefreshPersistFn contract exactly. - pack-artifact: open-sse/utils/setupPolyfill.ts ships via package.json "files" (bin/omniroute.mjs imports it at startup) but was missing from the pack policy allowlist. Allow it and add a regression test. * fix(security): redact public Firebase Web key from windsurf spec Redact the literal public Firebase Web API key (secret-scanning #7) to a placeholder, mirroring the redaction on release/v3.8.6 (PR #2894) and the windsurf fix branch. Non-sensitive public Web key; trips secret scanning. * feat(combo): Zero-Latency Combos (Hedging, Proactive Compression, Predictive TTFT) (#2868) * feat(combo): implement zero-latency combo optimizations (hedging, proactive compression, predictive TTFT) * fix(combo): fix predictive TTFT skip logic and unhandled promise rejections --------- Co-authored-by: Automation <automation@omniroute> * feat: implement automated skill workflows and update system configuration and validation schemas * test: eliminate dynamic cast warnings in cloud-sync unit test * test: isolate services-branch-hardening database directory to avoid concurrency issues * feat(providers): add 7 new web-cookie providers + research catalog + discovery tool New providers: - huggingchat: free LLM chat via huggingface.co/chat (no subscription) - phind: free dev-focused AI chat via phind.com/api/agent - poe-web: multi-model chat via poe.com GraphQL (p-b cookie) - venice-web: privacy-focused AI chat via venice.ai (session cookie) - v0-vercel-web: Vercel v0 code gen via v0.dev (session cookie) - kimi-web: Moonshot Kimi chat via kimi.moonshot.cn (session cookie) - doubao-web: ByteDance Doubao chat via doubao.com (session cookie) Additional: - Research catalog: docs/research/UNLIMITED_LLM_ACCESS.md - Discovery tool design + stub: src/lib/discovery/ + migration 073 - Unit tests: 33 tests for all 7 providers - Shared helpers consolidated in error.ts (slop cleanup) - All registered in WEB_COOKIE_PROVIDERS + providerRegistry + webSessionCredentials Closes #2885 * fix(typecheck): resolve typecheck errors in combo spec and compression modules * feat(api,oauth): add `agy` (Antigravity CLI) standalone provider with CLI token import (#2899) Add a standalone OAuth provider `agy` (Antigravity CLI) next to gemini-cli/antigravity. It reuses the antigravity inference backend (identical Google client_id + daily-cloudcode-pa.googleapis.com endpoint, executor and token-refresh) but ships its own model catalog — including the Claude models the backend exposes (claude-opus-4-6-thinking, claude-sonnet-4-6) — its own account pool, and four ways to connect: - token-file import (paste/upload the agy oauth token JSON) - auto-detect a local CLI login (~/.gemini/antigravity-cli/antigravity-oauth-token) - browser OAuth (via the shared OAuthModal Google loopback flow) - bulk / ZIP import New routes: POST /api/providers/agy-auth/{import,import-bulk,zip-extract,apply-local}. Catalog pinned from the live :fetchAvailableModels endpoint. Docs (openapi.yaml, ENVIRONMENT.md, .env.example, CHANGELOG) updated; new unit tests for registration, the token parser, and route auth-hardening. * fix(security): redact public Firebase Web key from windsurf spec (#2896) Redact the literal public Firebase Web API key (secret-scanning #7) to a placeholder. Firebase Web API keys are non-sensitive by design but the literal trips GitHub secret scanning. Mirrors the redaction landed on release/v3.8.6 (PR #2894). Embedded default still flows through resolvePublicCred (rule #11). * Pr 2871 (#2897) * fix(security): mitigate Socket.dev supply-chain findings + secrets opt-in + minimal build profile (#2863) Two real security gaps closed and four cosmetic Socket.dev fingerprints removed. See docs/security/SOCKET_DEV_FINDINGS.md for the per-finding maintainer attestation. Real bugs fixed: - cloudSync: HMAC verification of `X-Cloud-Sig` + opt-in `OMNIROUTE_CLOUD_SYNC_SECRETS=true` before overwriting `accessToken` / `refreshToken` / `providerSpecificData` from a remote response. Closes the silent-credential-swap surface (a misconfigured or hostile CLOUD_URL could previously replace local tokens unverified). - Zed import: split into 2-step `/discover` + `/import` flow. `/import` now requires `confirmedAccounts: [{ service, account, fingerprint }]` and re-reads the keychain server-side to filter by fingerprint, so a tampered discover response cannot trick the endpoint into saving an unrelated token. Cosmetic Socket.dev mitigations: - runElevatedPowerShell writes the elevated payload to a per-call temp `.ps1` file (mode 0o600) and references it via `-File`. Removes the textbook `-EncodedCommand <base64utf16le>` pattern flagged as malware by Socket's AI classifier. - Maintainer attestation `SECURITY-AUDITOR-NOTE:` blocks added at every flagged call site pointing to `docs/security/SOCKET_DEV_FINDINGS.md`. Build-time hardening: - `OMNIROUTE_BUILD_PROFILE=minimal` (`npm run build:secure`) physically removes the four sensitive modules from the standalone bundle via webpack `NormalModuleReplacementPlugin`. Stubs throw `FeatureDisabledError` at runtime. Intended for the `omniroute-secure` artifact. Tests: - 24 new unit tests in `tests/unit/security/` covering the wrapper builder, HMAC verification (4 cases), credential fingerprint determinism (5 cases), confirmedAccounts validation + fingerprint filtering (6 cases), and the minimal-build stubs (5 cases). Docs: - New `docs/security/SOCKET_DEV_FINDINGS.md` — per-finding attestation. - New `socket.yml` — Socket.dev v2 config pointing at the attestation. - Updated `SECURITY.md` — supply-chain scanner section. - Updated `.env.example` — three new env vars documented. Backwards compatibility: - Cloud sync token overwrite is OFF by default. Users who relied on it must set `OMNIROUTE_CLOUD_SYNC_SECRETS=true`. Breaking change documented in CHANGELOG. - Zed import 2-step is the new default; legacy 1-step preserved behind `OMNIROUTE_ZED_IMPORT_LEGACY_ONE_STEP=true` and will be removed in v3.9. Closes #2863 * feat: implement automated skill workflows and update system configuration and validation schemas * test: eliminate dynamic cast warnings in cloud-sync unit test * test: isolate services-branch-hardening database directory to avoid concurrency issues * chore(docs): refresh generated docs collection index Update the generated Fumadocs browser collection mapping to keep documentation imports in sync with the current docs structure. * docs: update generated browser docs collection manifest Refresh the generated Fumadocs browser collection mapping so the docs site can resolve the current documentation files correctly. --------- Co-authored-by: OpenClaw <openclaw@kuzhomesrv.local> Co-authored-by: Dmitry Kuznetsov <139351986+dmitry@users.noreply.local> Co-authored-by: KuzyaBot <kuzya@local> Co-authored-by: JeferssonLemes <jeferssondev@gmail.com> Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com> Co-authored-by: Markus Hartung <mail@hartmark.se> Co-authored-by: akarray <akarray@users.noreply.github.com> Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com> Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com> Co-authored-by: Dmitry Kuznetsov <dmitry@kuznetsov.me> Co-authored-by: Nikolay Alafuzov <alafuzov_nn@rusklimat.ru> Co-authored-by: oyi77 <oyi77@users.noreply.github.com> Co-authored-by: Ronaldo Davi <alltomatos@users.noreply.github.com> Co-authored-by: levonk <277861+levonk@users.noreply.github.com> Co-authored-by: Lenine Júnior <lenine@engrene.com.br> Co-authored-by: Annas Alghoffar <aag.annas@gmail.com> Co-authored-by: Tushar Agarwal <76201310+Tushar49@users.noreply.github.com> Co-authored-by: GreatLiu <eurasiaxz@qq.com> Co-authored-by: yuna amelia <230527278+yunaamelia@users.noreply.github.com> Co-authored-by: Randi <55005611+rdself@users.noreply.github.com> Co-authored-by: Container <78986709+disonjer@users.noreply.github.com> Co-authored-by: nickwizard <35692452+nickwizard@users.noreply.github.com> Co-authored-by: Rajvardhan Patil <rajvardhanpatil7890@gmail.com> Co-authored-by: Raxxoor <manker_lol@hotmail.com> Co-authored-by: Muhammad Mugni Hadi <mugnimaestra3@gmail.com> Co-authored-by: mi <123757457+soyelmismo@users.noreply.github.com> Co-authored-by: Automation <automation@omniroute>
26 KiB
CLAUDE.md (Dansk)
🌐 Languages: 🇺🇸 English · 🇸🇦 ar · 🇦🇿 az · 🇧🇬 bg · 🇧🇩 bn · 🇨🇿 cs · 🇩🇪 de · 🇪🇸 es · 🇮🇷 fa · 🇫🇮 fi · 🇫🇷 fr · 🇮🇳 gu · 🇮🇱 he · 🇮🇳 hi · 🇭🇺 hu · 🇮🇩 id · 🇮🇩 in · 🇮🇹 it · 🇯🇵 ja · 🇰🇷 ko · 🇮🇳 mr · 🇲🇾 ms · 🇳🇱 nl · 🇳🇴 no · 🇵🇭 phi · 🇵🇱 pl · 🇵🇹 pt · 🇧🇷 pt-BR · 🇷🇴 ro · 🇷🇺 ru · 🇸🇰 sk · 🇸🇪 sv · 🇰🇪 sw · 🇮🇳 ta · 🇮🇳 te · 🇹🇭 th · 🇹🇷 tr · 🇺🇦 uk-UA · 🇵🇰 ur · 🇻🇳 vi · 🇨🇳 zh-CN
Denne fil giver vejledning til Claude Code (claude.ai/code) når der arbejdes med kode i dette repository.
Hurtig Start
npm install # Installer afhængigheder (auto-genererer .env fra .env.example)
npm run dev # Dev server på http://localhost:20128
npm run build # Produktionsbygning (Next.js 16 standalone)
npm run lint # ESLint (0 fejl forventet; advarsler er forudgående)
npm run typecheck:core # TypeScript tjek (skal være rent)
npm run typecheck:noimplicit:core # Streng tjek (ingen implicit any)
npm run test:coverage # Enhedstest + dækning gate (75/75/75/70 — udsagn/linjer/funktioner/grene)
npm run check # lint + test kombineret
npm run check:cycles # Registrer cirkulære afhængigheder
Kørsel af Tests
# Enkelt testfil (Node.js native test runner — de fleste tests)
node --import tsx/esm --test tests/unit/your-file.test.ts
# Vitest (MCP server, autoCombo, cache)
npm run test:vitest
# Alle sæt
npm run test:all
For fuld testmatrix, se CONTRIBUTING.md → "Kørsel af Tests". For dyb arkitektur, se AGENTS.md.
Projektet i Et Overblik
OmniRoute — samlet AI proxy/router. Én endpoint, 160+ LLM udbydere, auto-fallback.
| Lag | Placering | Formål |
|---|---|---|
| API Ruter | src/app/api/v1/ |
Next.js App Router — indgangspunkt |
| Handlere | open-sse/handlers/ |
Anmodningsbehandling (chat, indlejring, osv.) |
| Udførere | open-sse/executors/ |
Udbyder-specifik HTTP dispatch |
| Oversættere | open-sse/translator/ |
Format konvertering (OpenAI↔Claude↔Gemini) |
| Transformer | open-sse/transformer/ |
Svar API ↔ Chat Fuldførelser |
| Tjenester | open-sse/services/ |
Combo routing, hastighedsbegrænsninger, caching, osv. |
| Database | src/lib/db/ |
SQLite domænemoduler (45+ filer, 55 migrationer) |
| Domæne/Politik | src/domain/ |
Politisk motor, omkostningsregler, fallback logik |
| MCP Server | open-sse/mcp-server/ |
37 værktøjer (30 base + 3 hukommelse + 4 færdigheder), 3 transportformer, ~13 scopes |
| A2A Server | src/lib/a2a/ |
JSON-RPC 2.0 agentprotokol |
| Færdigheder | src/lib/skills/ |
Udvidelig færdighedsramme |
| Hukommelse | src/lib/memory/ |
Vedholdende samtalehukommelse |
Monorepo: src/ (Next.js 16 app), open-sse/ (streaming engine arbejdsområde), electron/ (desktop app), tests/, bin/ (CLI indgangspunkt).
Anmodningspipeline
Klient → /v1/chat/completions (Next.js rute)
→ CORS → Zod validering → auth? → politik kontrol → prompt injektionsbeskyttelse
→ handleChatCore() [open-sse/handlers/chatCore.ts]
→ cache kontrol → rate limit → combo routing?
→ resolveComboTargets() → handleSingleModel() pr. mål
→ translateRequest() → getExecutor() → executor.execute()
→ fetch() upstream → retry w/ backoff
→ respons oversættelse → SSE stream eller JSON
→ Hvis Responses API: responsesTransformer.ts TransformStream
API-ruter følger et konsistent mønster: Rute → CORS preflight → Zod body validering → Valgfri auth (extractApiKey/isValidApiKey) → API-nøgle politik håndhævelse → Handler delegation (open-sse). Ingen global Next.js middleware — interception er rute-specifik.
Combo routing (open-sse/services/combo.ts): 14 strategier (prioritet, vægtet, fyld-først, round-robin, P2C, tilfældig, mindst-brugt, omkostningsoptimeret, reset-bevidst, strengt-tilfældig, auto, lkgp, kontekst-optimeret, kontekst-relais). Hvert mål kalder handleSingleModel(), som indkapsler handleChatCore() med mål-specifik fejlbehandling og circuit breaker tjek. Se docs/routing/AUTO-COMBO.md for de 9-faktor Auto-Combo scoring og docs/architecture/RESILIENCE_GUIDE.md for de 3 modstandsdygtighedslag.
Modstandsdygtighed Runtime Tilstand
OmniRoute har tre relaterede, men distinkte mekanismer til midlertidige fejl. Hold deres omfang adskilt, når du fejlfinder routing adfærd. Se 3-lags modstandsdygtighed diagram (kilde: docs/diagrams/resilience-3layers.mmd) for et hurtigt overblik.
Udbyder Circuit Breaker
Omfang: hele udbyderen, f.eks. glm, openai, anthropic.
Formål: stop med at sende trafik til en udbyder, der gentagne gange fejler på upstream/service niveau, så en usund udbyder ikke bremser hver anmodning.
Implementering:
- Kerneklasse:
src/shared/utils/circuitBreaker.ts - Chat gate/udførelses wiring:
src/sse/handlers/chatHelpers.ts,src/sse/handlers/chat.ts - Runtime status API:
src/app/api/monitoring/health/route.ts - Delte wrappers:
open-sse/services/accountFallback.ts - Vedholdt tilstandstabel:
domain_circuit_breakers
Tilstande:
CLOSED: normal trafik er tilladt.OPEN: udbyderen er midlertidigt blokeret; kaldere får et provider-circuit-open svar eller combo routing springer til et andet mål.HALF_OPEN: reset timeout er udløbet; tillad en probe-anmodning. Succes lukker breaker'en, fejl åbner den igen.
Standarder (open-sse/config/constants.ts):
- OAuth udbydere: tærskel
3, reset timeout60s. - API-nøgle udbydere: tærskel
5, reset timeout30s. - Lokale udbydere: tærskel
2, reset timeout15s.
Kun udbyder-niveau fejlstatusser bør udløse udbyder breaker:
(408, 500, 502, 503, 504);
Udløs ikke hele-udbyder breaker for normale konto/nøgle/model fejl som de fleste
401, 403, eller 429 tilfælde. Disse tilhører normalt forbindelseskøling eller model
lockout. En generisk API-nøgle udbyder 403 bør være genoprettelig, medmindre den klassificeres
som en terminal udbyder/konto fejl.
Breaker'en bruger lazy recovery, ikke en baggrundstimer. Når OPEN udløber, læser som
getStatus(), canExecute(), og getRetryAfterMs() opdaterer tilstanden til
HALF_OPEN, så dashboards og combo kandidatbyggere ikke fortsætter med at udelukke en
udløbet udbyder for evigt.
Forbindelseskøling
Omfang: én udbyder forbindelse/konto/nøgle.
Formål: midlertidigt springe en dårlig nøgle/konto over, mens andre forbindelser for den samme udbyder fortsætter med at betjene anmodninger.
Implementering:
- Skriv/opdateringsvej:
src/sse/services/auth.ts::markAccountUnavailable() - Kontoselektion/filtrering:
src/sse/services/auth.ts::getProviderCredentials... - Køling beregning:
open-sse/services/accountFallback.ts::checkFallbackError() - Indstillinger:
src/lib/resilience/settings.ts
Vigtige felter på udbyder forbindelser:
rateLimitedUntil;
testStatus: "unavailable";
lastError;
lastErrorType;
errorCode;
backoffLevel;
Under kontoselektion springes en forbindelse over, mens:
new Date(rateLimitedUntil).getTime() > Date.now();
Kølinger er også lazy: når rateLimitedUntil er i fortiden, bliver forbindelsen
berettiget igen. Ved succesfuld brug, clearAccountError() rydder testStatus,
rateLimitedUntil, fejl felter, og backoffLevel.
Standard forbindelse køling adfærd:
- OAuth basis køling:
5s. - API-nøgle basis køling:
3s. - API-nøgle
429bør foretrække upstream retry hints (Retry-After, reset headers, eller parseable reset text) når tilgængelig. - Gentagne genoprettelige fejl bruger eksponentiel backoff:
baseCooldownMs * 2 ** failureIndex;
Anti-thundering-herd beskyttelsen forhindrer samtidige fejl på den samme forbindelse i
gentagne gange at forlænge kølingen eller dobbelt-øge backoffLevel.
Terminal tilstande er ikke kølinger. banned, expired, og credits_exhausted er
beregnet til at forblive utilgængelige, indtil legitimationsoplysninger/indstillinger ændres eller en operatør nulstiller dem. Overskriv ikke terminal tilstande med midlertidig køling tilstand.
Model Lockout
Omfang: udbyder + forbindelse + model.
Formål: undgå at deaktivere en hel forbindelse, når kun én model er utilgængelig eller kvote-begrænset for den forbindelse.
Eksempler:
- Per-model kvote udbydere, der returnerer
429. - Lokale udbydere, der returnerer
404for én manglende model. - Udbyder-specifikke mode/model tilladelsesfejl som valgte Grok modes.
Model lockout lever i open-sse/services/accountFallback.ts og lader den samme
forbindelse fortsætte med at betjene andre modeller.
Fejlfinding Vejledning
- Hvis alle nøgler for en udbyder springes over, inspicer både udbyder breaker tilstand og hver
forbindelses
rateLimitedUntil/testStatus. - Hvis en udbyder ser permanent udelukket ud efter resetvinduet, skal du kontrollere, om koden
læser rå
statei stedet for at brugegetStatus()/canExecute(). - Hvis én udbyder nøgle fejler, men andre bør fungere, foretræk forbindelseskøling over udbyder breaker.
- Hvis kun én model fejler, foretræk model lockout over forbindelseskøling.
- Hvis en tilstand skal selv-genoprette, skal den have et fremtidigt tidsstempel/reset timeout og en læsevej, der opdaterer udløbet tilstand. Permanente statusser kræver manuelle legitimationsoplysninger eller konfigurationsændringer.
Nøglekonventioner
Kode Stil
- 2 mellemrum, semikolon, dobbelte citationstegn, 100 tegn bredde, es5 trailing commas (håndhævet af lint-staged via Prettier)
- Imports: ekstern → intern (
@/,@omniroute/open-sse) → relativ - Navngivning: filer=camelCase/kebab, komponenter=PascalCase, konstanter=UPPER_SNAKE
- ESLint:
no-eval,no-implied-eval,no-new-func= fejl overalt;no-explicit-any= advarsel iopen-sse/ogtests/ - TypeScript:
strict: false, mål ES2022, modul esnext, opløsning bundler. Foretræk eksplicitte typer.
Database
- Gå altid gennem
src/lib/db/domænemoduler — skriv aldrig rå SQL i ruter eller håndterere - Tilføj aldrig logik til
src/lib/localDb.ts(kun re-export lag) - Barrel-import aldrig fra
localDb.ts— importer specifikkedb/moduler i stedet - DB singleton:
getDbInstance()frasrc/lib/db/core.ts(WAL journaling) - Migrationer:
src/lib/db/migrations/— versionerede SQL-filer, idempotente, kørsel i transaktioner
Fejlhåndtering
- try/catch med specifikke fejlkategorier, log med pino kontekst
- Svæl aldrig fejl i SSE streams — brug abort signaler til oprydning
- Returner korrekte HTTP statuskoder (4xx/5xx)
Sikkerhed
- Brug aldrig
eval(),new Function(), eller implicit eval - Valider alle input med Zod skemaer
- Krypter legitimationsoplysninger i hvile (AES-256-GCM)
- Upstream header denylist:
src/shared/constants/upstreamHeaders.ts— hold sanitere, Zod skemaer, og enhedstest i overensstemmelse når du redigerer - Offentlige upstream legitimationsoplysninger (Gemini/Antigravity/Windsurf-stil OAuth client_id/secret + Firebase Web nøgler udtrukket fra offentlige CLIs): SKAL indlejres via
resolvePublicCred()fraopen-sse/utils/publicCreds.ts— aldeles ikke som strenglitteraler. Sedocs/security/PUBLIC_CREDS.mdfor den obligatoriske skabelon. - Fejlrespons (HTTP / SSE / executor / MCP håndterer): SKAL rutes gennem
buildErrorBody()ellersanitizeErrorMessage()fraopen-sse/utils/error.ts— aldeles ikke putte råerr.stackellererr.messagei en responskrop. Sedocs/security/ERROR_SANITIZATION.md. - Shell-kommandoer bygget fra variabler: når du kalder
exec()/spawn()med et script, der har brug for runtime værdier, send dem viaenvoptionen (shell-escaped automatisk) — aldeles ikke string-interpolere ikke-betroede/eksterne stier ind i scriptkroppen. Reference:src/mitm/cert/install.ts::updateNssDatabases. - Sikre-bygge-biblioteker (tldrsec/awesome-secure-defaults): foretræk Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink over brugerdefinerede implementeringer, når du tilføjer nye sikkerhedsfølsomme overflader.
Almindelige Modifikationsscenarier
Tilføjelse af en Ny Udbyder
- Registrer i
src/shared/constants/providers.ts(Zod-valideret ved indlæsning) - Tilføj executor i
open-sse/executors/hvis brugerdefineret logik er nødvendig (udvidBaseExecutor) - Tilføj oversætter i
open-sse/translator/hvis ikke-OpenAI format - Tilføj OAuth konfiguration i
src/lib/oauth/constants/oauth.tshvis OAuth-baseret — hvis den upstream CLI leverer en offentlig client_id/secret, indlejres viaresolvePublicCred()(sedocs/security/PUBLIC_CREDS.md), aldeles ikke som en literal - Registrer modeller i
open-sse/config/providerRegistry.ts - Skriv tests i
tests/unit/(inkluder publicCreds form assertion hvis du har tilføjet en ny indlejret standard)
Tilføjelse af en Ny API Rute
- Opret mappe under
src/app/api/v1/your-route/ - Opret
route.tsmedGET/POSThåndterere - Følg mønster: CORS → Zod body validering → valgfri auth → håndterer delegation
- Håndterer går i
open-sse/handlers/(importer derfra, ikke inline) - Fejlrespons bruger
buildErrorBody()/errorResponse()fraopen-sse/utils/error.ts(auto-sanitized — sæt aldrigerr.stackellererr.messagerå i kroppen). Sedocs/security/ERROR_SANITIZATION.md. - Tilføj tests — inklusive mindst én assertion om, at fejlrespons ikke lækker stakspor (
!body.error.message.includes("at /"))
Tilføjelse af et Nyt DB Modul
- Opret
src/lib/db/yourModule.ts— importergetDbInstancefra./core.ts - Eksporter CRUD funktioner for dine domænetabeller
- Tilføj migration i
src/lib/db/migrations/hvis nye tabeller er nødvendige - Re-export fra
src/lib/localDb.ts(tilføj kun til re-export listen) - Skriv tests
Tilføjelse af et Nyt MCP Værktøj
- Tilføj værktøjsdefinition i
open-sse/mcp-server/tools/med Zod input skema + asynkron håndterer - Registrer i værktøjssættet (forbundet af
createMcpServer()) - Tildel til passende omfang(e)
- Skriv tests (værktøjsinvokation logget til
mcp_audittabellen)
Tilføjelse af en Ny A2A Færdighed
- Opret færdighed i
src/lib/a2a/skills/(5 eksisterer allerede: smart-routing, quota-management, provider-discovery, cost-analysis, health-report) - Færdigheden modtager opgavekontekst (beskeder, metadata) → returnerer struktureret resultat
- Registrer i
A2A_SKILL_HANDLERSisrc/lib/a2a/taskExecution.ts - Eksponer i
src/app/.well-known/agent.json/route.ts(Agent Card) - Skriv tests i
tests/unit/ - Dokumenter i
docs/frameworks/A2A-SERVER.mdfærdighedstabel
Tilføjelse af en Ny Cloud Agent
- Opret agentklasse i
src/lib/cloudAgent/agents/der udviderCloudAgentBase(3 eksisterer allerede: codex-cloud, devin, jules) - Implementer
createTask,getStatus,approvePlan,sendMessage,listSources - Registrer i
src/lib/cloudAgent/registry.ts - Tilføj OAuth/legitimationshåndtering hvis nødvendigt (
src/lib/oauth/providers/) - Tests + dokumenter i
docs/frameworks/CLOUD_AGENT.md
Tilføjelse af en Ny Guardrail / Eval / Færdighed / Webhook begivenhed
- Guardrail:
src/lib/guardrails/→ docs:docs/security/GUARDRAILS.md - Eval suite:
src/lib/evals/→ docs:docs/frameworks/EVALS.md - Færdighed (sandbox):
src/lib/skills/→ docs:docs/frameworks/SKILLS.md - Webhook begivenhed:
src/lib/webhookDispatcher.ts→ docs:docs/frameworks/WEBHOOKS.md
Reference Dokumentation
For enhver ikke-trivial ændring, læs den matchende dybdegående først:
| Område | Dokument |
|---|---|
| Repo navigation | docs/architecture/REPOSITORY_MAP.md |
| Arkitektur | docs/architecture/ARCHITECTURE.md |
| Ingeniør reference | docs/architecture/CODEBASE_DOCUMENTATION.md |
| Auto-Combo (9-faktor scoring, 14 strategier) | docs/routing/AUTO-COMBO.md |
| Resiliens (3 mekanismer) | docs/architecture/RESILIENCE_GUIDE.md |
| Reasoning replay | docs/routing/REASONING_REPLAY.md |
| Færdigheder rammeværk | docs/frameworks/SKILLS.md |
| Hukommelsessystem (FTS5 + Qdrant) | docs/frameworks/MEMORY.md |
| Cloud agenter | docs/frameworks/CLOUD_AGENT.md |
| Guardrails (PII / injektion / vision) | docs/security/GUARDRAILS.md |
| Offentlige upstream legitimationsoplysninger (Gemini/etc.) | docs/security/PUBLIC_CREDS.md |
| Fejlmeddelelse sanitering | docs/security/ERROR_SANITIZATION.md |
| Evals | docs/frameworks/EVALS.md |
| Overholdelse / revision | docs/security/COMPLIANCE.md |
| Webhooks | docs/frameworks/WEBHOOKS.md |
| Autorisationspipeline | docs/architecture/AUTHZ_GUIDE.md |
| Stealth (TLS / fingeraftryk) | docs/security/STEALTH_GUIDE.md |
| Agentprotokoller (A2A / ACP / Cloud) | docs/frameworks/AGENT_PROTOCOLS_GUIDE.md |
| MCP server | docs/frameworks/MCP-SERVER.md |
| A2A server | docs/frameworks/A2A-SERVER.md |
| API reference + OpenAPI | docs/reference/API_REFERENCE.md + docs/reference/openapi.yaml |
| Udbyderkatalog (auto-genereret) | docs/reference/PROVIDER_REFERENCE.md |
| Udgivelsesflow | docs/ops/RELEASE_CHECKLIST.md |
Testning
| Hvad | Kommando |
|---|---|
| Enhedstest | npm run test:unit |
| Enkeltfil | node --import tsx/esm --test tests/unit/file.test.ts |
| Vitest (MCP, autoCombo) | npm run test:vitest |
| E2E (Playwright) | npm run test:e2e |
| Protokol E2E (MCP+A2A) | npm run test:protocols:e2e |
| Økosystem | npm run test:ecosystem |
| Dækningsgrænse | npm run test:coverage (75/75/75/70 — udsagn/linjer/funktioner/grene) |
| Dækningsrapport | npm run coverage:report |
PR-regel: Hvis du ændrer produktionskode i src/, open-sse/, electron/ eller bin/, skal du inkludere eller opdatere tests i den samme PR.
Testlag præference: enhed først → integration (multi-modul eller DB-tilstand) → e2e (UI/arbejdsgang kun). Kod bug-reproduktioner som automatiserede tests før eller sammen med rettelsen.
Copilot dækningspolitik: Når en PR ændrer produktionskode, og dækningen er under 75% (udsagn/linjer/funktioner) eller 70% (grene), rapporter ikke bare — tilføj eller opdater tests, kør dækningsgrænsen igen, og bed om bekræftelse. Inkluder kørte kommandoer, ændrede testfiler og det endelige dækningsresultat i PR-rapporten.
Git Workflow
# Forpligt dig aldrig direkte til main
git checkout -b feat/your-feature
git commit -m "feat: beskriv din ændring"
git push -u origin feat/your-feature
Branch præfikser: feat/, fix/, refactor/, docs/, test/, chore/
Commit format (Conventional Commits): feat(db): tilføj circuit breaker — scopes: db, sse, oauth, dashboard, api, cli, docker, ci, mcp, a2a, memory, skills
Husky hooks:
- pre-commit: lint-staged +
check-docs-sync+check:any-budget:t11 - pre-push:
npm run test:unit
Miljø
- Runtime: Node.js ≥20.20.2 <21 || ≥22.22.2 <23 || ≥24 <25, ES-moduler
- TypeScript: 5.9+, mål ES2022, modul esnext, opløsning bundler
- Sti aliaser:
@/*→src/,@omniroute/open-sse→open-sse/,@omniroute/open-sse/*→open-sse/* - Standardport: 20128 (API + dashboard på samme port)
- Data katalog:
DATA_DIRmiljøvariabel, standard til~/.omniroute/ - Nøgle miljøvariabler:
PORT,JWT_SECRET,API_KEY_SECRET,INITIAL_PASSWORD,REQUIRE_API_KEY,APP_LOG_LEVEL - Opsætning:
cp .env.example .envog generer derefterJWT_SECRET(openssl rand -base64 48) ogAPI_KEY_SECRET(openssl rand -hex 32)
Hårde regler
- Forpligt dig aldrig til hemmeligheder eller legitimationsoplysninger
- Tilføj aldrig logik til
localDb.ts - Brug aldrig
eval()/new Function()/ implicit eval - Forpligt dig aldrig direkte til
main - Skriv aldrig rå SQL i ruter — brug
src/lib/db/moduler - Sluk aldrig stille fejl i SSE-strømme
- Valider altid input med Zod-skemaer
- Inkluder altid tests, når du ændrer produktionskode
- Dækningen skal forblive ≥75% (udsagn, linjer, funktioner) / ≥70% (grene). Nuværende målt: ~82%.
- Omgå aldrig Husky hooks (
--no-verify,--no-gpg-sign) uden eksplicit godkendelse fra operatøren. - Indsæt aldrig offentlige upstream OAuth client_id/secret eller Firebase Web-nøgler som strenglitteraler — gå altid gennem
resolvePublicCred()(open-sse/utils/publicCreds.ts). Sedocs/security/PUBLIC_CREDS.md. - Returner aldrig rå
err.stack/err.messagei HTTP / SSE / executor svar — rute altid gennembuildErrorBody()ellersanitizeErrorMessage()(open-sse/utils/error.ts). Sedocs/security/ERROR_SANITIZATION.md. - Indsæt aldrig string-interpolerede eksterne stier eller runtime-værdier i shell-scripts, der sendes til
exec()/spawn()— send i stedet viaenv-muligheden. Reference:src/mitm/cert/install.ts::updateNssDatabases. - Afvis aldrig en CodeQL / Secret-Scanning advarsel uden (a) først at tjekke mønsterdokumentationen ovenfor for at se, om hjælperen gælder, og (b) optage den tekniske begrundelse i afvisningskommentaren. Præcedens:
js/stack-trace-exposurerejst på callsites, der allerede ruter gennemsanitizeErrorMessage()er en kendt CodeQL begrænsning (tilpassede saniteringsmetoder ikke genkendt) — afvis somfalse positivemed reference tildocs/security/ERROR_SANITIZATION.md. - Udsæt aldrig ruter, der starter børneprocesser (
/api/mcp/,/api/cli-tools/runtime/) udenisLocalOnlyPath()klassifikation isrc/server/authz/routeGuard.ts. Loopback håndhævelse sker ubetinget før enhver godkendelseskontrol — lækket JWT via tunnel kan ikke udløse processtart. Sedocs/security/ROUTE_GUARD_TIERS.md. - Inkluder aldrig
Co-Authored-Bytrailers, der krediterer en AI-assistent, LLM eller automatiseringskonto (f.eks. navne, der indeholder "Claude", "GPT", "Copilot", "Bot"; e-mails påanthropic.com/openai.com/ bot-ejedenoreply.github.comadresser). Sådanne trailers dirigerer commit-attribution til bot-kontoen på GitHub, hvilket skjuler den rigtige forfatter (diegosouzapw) i PR-historikken. Menneskelige bidragydere — herunder upstream PR-forfattere og issue-rapportører, der bliver porteret til OmniRoute — KAN og BØR krediteres med standardCo-authored-by: Name <email>trailers; upstream-port workflows (/port-upstream-features,/port-upstream-issues) afhænger af dette.