mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-13 18:32:12 +03:00

Files

Diego Rodrigues de Sa e Souza db6feb6fad fix(auth): dashboard session requires the authenticated claim — Cursor CLI tokens are not sessions (#13375 )

Merged as part of the owner batch of 2026-09-11.

This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`.

- ESLint over every changed file: no errors
- `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK
- complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437
- 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied.
- `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch.

⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.

2026-09-11 22:29:12 -03:00

architecture

fix(auth): dashboard session requires the authenticated claim — Cursor CLI tokens are not sessions (#13375 )

2026-09-11 22:29:12 -03:00

assets

feat(i18n): 9 new locales — all 24 official EU languages (51 locales) (#13044 )

2026-09-10 10:13:09 -03:00

changelog/fragments

feat(resilience): add hierarchical concurrency admission (#11493 )

2026-08-25 07:19:09 -03:00

comparison

feat(i18n): locale-expansion tooling — add-locale orchestrator, aliases, translation-ratio gate; retire duplicate 'in' locale (#12496 )

2026-09-02 17:45:50 -03:00

compression

feat(dashboard): adaptive context-budget dial on compression panel (#12488 )

2026-09-03 12:40:02 -03:00

diagrams

docs(checks): keep doc counts honest — headings, rankings, catalog, weights, quality gate and scoring diagram now covered (#12507 )

2026-09-10 10:54:38 -03:00

frameworks

fix(docs): keep operator-internal security writeups out of public /docs (#13136 )

2026-09-11 19:28:02 -03:00

getting-started

feat(catalog): eligibility-gated free-tier bucket (#12669 )

2026-09-04 00:45:38 -03:00

guides

fix(docker): bind app/sidecar compose ports to loopback by default (#12568 , #12578 ) (#13240 )

2026-09-11 22:05:14 -03:00

i18n

fix(gamification): durable action-count badges that survive xp_audit_log pruning (#12651 )

2026-09-11 17:41:25 -03:00

ops

fix(docs): keep operator-internal security writeups out of public /docs (#13136 )

2026-09-11 19:28:02 -03:00

plans

feat(search): add fallback-only AnySearch provider (webSearch + webFetch) (#11690 )

2026-08-26 17:54:57 -03:00

providers

chore(providers): bump Claude Code wire identity + Devin bridge pin to 2.1.258 (#12604 )

2026-09-03 13:49:46 -03:00

reference

fix(docker): require a per-session token on the VNC browser CDP bridge (#12571 ) (#13241 )

2026-09-11 22:29:05 -03:00

routing

fix(auto-combo): give every mode pack quality and reliability weights (#12731 )

2026-09-10 09:13:04 -03:00

screenshots

feat(catalog): eligibility-gated free-tier bucket (#12669 )

2026-09-04 00:45:38 -03:00

security

fix(sse): add first-byte watchdog to the TLS-fingerprint transport (#12656 ) (#13272 )

2026-09-11 22:06:09 -03:00

DEVELOPER-ENVIRONMENT.md

fix(ollama): route models by advertised capability (#11088 )

2026-08-23 11:45:01 -03:00

DEVIN_CLAUDE_BRIDGE.md

chore(providers): bump Claude Code wire identity + Devin bridge pin to 2.1.258 (#12604 )

2026-09-03 13:49:46 -03:00

meta.json

Release v3.8.40

2026-06-29 08:40:06 -03:00

OMNIROUTE_ALLOCATION_HANDOFF.md

fix(ollama): route models by advertised capability (#11088 )

2026-08-23 11:45:01 -03:00

OMNIROUTE_PROVIDER_FAILOVER.md

fix(ollama): route models by advertised capability (#11088 )

2026-08-23 11:45:01 -03:00

OMNIROUTE_QUOTA_TELEMETRY.md

fix(ollama): route models by advertised capability (#11088 )

2026-08-23 11:45:01 -03:00

OMNIROUTE_ROUTING_POLICY.md

fix(ollama): route models by advertised capability (#11088 )

2026-08-23 11:45:01 -03:00

openapi.yaml

fix(authz): hard-gate every credential export and CLI-config write (GHSA-5926-2w35-7h4q) (#12600 )

2026-09-03 09:19:44 -03:00

README.md

feat(i18n): 9 new locales — all 24 official EU languages (51 locales) (#13044 )

2026-09-10 10:13:09 -03:00

README.md

title, version, lastUpdated

title	version	lastUpdated
OmniRoute Documentation	3.8.40	2026-06-28

OmniRoute Documentation

Navigable index of the OmniRoute documentation set. Topics are grouped by intent so you can find what you need quickly.

Looking for the project overview, install steps, or release notes? See the root README.md, ROADMAP.md, CHANGELOG.md, and CONTRIBUTING.md.

For Non-Tech Users

Simple guides for using OmniRoute — no technical background needed.

getting-started/

QUICK-START.md — install and run OmniRoute in 3 minutes.
AUTO-COMBO-GUIDE.md — let OmniRoute pick the best AI for you.
PROVIDERS-GUIDE.md — how to connect AI providers.
FREE-TIERS-GUIDE.md — get free AI with no credit card.
WEB-COOKIE-GUIDE.md — web cookie providers (session-credential setup).

guides/

SETUP_GUIDE.md — first-time setup of OmniRoute.
USER_GUIDE.md — daily usage of the dashboard and API.
THINKING_BUDGET.md — thinking/reasoning budget modes (passthrough vs auto-strip).
FEATURES.md — dashboard feature gallery.
CHAOS-MODE.md — multi-model parallel/collaborative execution (setup, permissions, API).
TIERS.md — OmniRoute tiers explained (user guide).
USAGE_QUOTA_GUIDE.md — usage, quota & spend tracking.
COST_TRACKING.md — cost and spend tracking.
FREE_PROVIDER_RANKINGS.md — free provider rankings (Arena ELO).
DOCKER_GUIDE.md — running OmniRoute under Docker, including runtime RAM for coding agents.
ELECTRON_GUIDE.md — desktop (Electron) builds.
TERMUX_GUIDE.md — running on Android via Termux.
PWA_GUIDE.md — installing the dashboard as a PWA.
REMOTE-MODE.md — exposing OmniRoute remotely + scoped tokens.
CLI-INTEGRATIONS.md — master table of setup-* CLI integrations.
OPENCODE-V2-PLUGIN.md — installing and configuring the OpenCode v2 plugin.
CLAUDE-CODE-CONFIGURATION.md — Claude Code CLI with OmniRoute.
CODEX-CLI-CONFIGURATION.md — Codex CLI with OmniRoute.
KIRO_SETUP.md — Kiro setup.
ANTIGRAVITY-ONBOARDING.md — Antigravity (Google One AI) onboarding.
MANAGEMENT-AUTH.md — management authentication.
I18N.md — translation and locale workflow.
TROUBLESHOOTING.md — detailed troubleshooting reference.
UNINSTALL.md — clean removal steps.

For Tech Users

Technical documentation for developers and contributors.

architecture/

How the system is put together — read these to understand the runtime, code layout, and resilience model.

ARCHITECTURE.md — high-level system architecture (request pipeline, layers, modules).
CODEBASE_DOCUMENTATION.md — engineering reference for the codebase.
REPOSITORY_MAP.md — directory-by-directory navigation guide.
AUTHZ_GUIDE.md — authorization pipeline (route classifier + policy engine).
RESILIENCE_GUIDE.md — provider circuit breaker, connection cooldown, and model lockout.
QUALITY_GATES.md — quality-gate scripts and CI jobs inventory.
MONITORING_SECTIONS.md — monitoring/costs dashboard navigation.
cluster-decisions.md — optional sidecar/cluster profile decisions.
DESIGN_SYSTEM.md — design system & visual identity.
ROUTER_BACKENDS.md — router backends & embedded services architecture contract (ADR).
admission-lanes.md — the two admission-lane systems and what gates each.
persistence-backend-boundary.md — pluggable persistence boundary (ADR).

reference/

Lookup material — API surface, environment variables, CLI flags, provider catalog.

API_REFERENCE.md — REST API endpoints and shapes.
PROVIDER_REFERENCE.md — auto-generated provider catalog (do not edit by hand).
REMOVED_PROVIDERS.md — providers removed at their operator's request; never reintroduce without written permission.
PROVIDER_PLUGIN_MANIFEST.md — sidecar-safe provider plugin contract for Bifrost and CLIProxyAPI migration.
openapi.yaml — OpenAPI spec for the public API.
ENVIRONMENT.md — environment variables reference.
FEATURE_FLAGS.md — feature flags and their defaults.
CLI-TOOLS.md — bundled CLI commands.
FREE_TIERS.md — free-tier LLM provider directory.
FREE_PROXIES_API.md — free proxies API.
RELAY_BACKEND_STRATEGY.md — relay backend strategy.
RELAY_TROUBLESHOOTING.md — relay troubleshooting.

frameworks/

Pluggable subsystems exposed to clients, agents, and operators.

MCP-SERVER.md — Model Context Protocol server.
A2A-SERVER.md — Agent-to-Agent (A2A) JSON-RPC server.
ACP.md — Agent Client Protocol.
AGENT_PROTOCOLS_GUIDE.md — A2A / ACP / Cloud agent overview.
AGENTBRIDGE.md — IDE agent bridge.
AGENT-SKILLS.md — agent skills catalog.
CLOUD_AGENT.md — cloud agent runtime and providers.
SKILLS.md — Skills framework (sandboxed extension).
MEMORY.md — persistent memory (FTS5 + Qdrant).
WEBHOOKS.md — webhook events and dispatch.
EVALS.md — eval suites.
GAMIFICATION.md — gamification & leaderboard system.
EMBEDDED-SERVICES.md — embedded sidecar services (9Router, CLIProxyAPI).
NOTION_CONTEXT.md — Notion context source.
OBSIDIAN_CONTEXT.md — Obsidian context source.
LOCAL_CORPUS_CONTEXT.md — local corpus context source (approved directory exposed to MCP).
OPENCODE.md — OpenCode integration.
OPEN_SSE_ARCHITECTURE.md — open-sse streaming engine internals.
PLAYGROUND_STUDIO.md — Playground Studio UI.
SEARCH_TOOLS_STUDIO.md — Search Tools Studio UI.
TRAFFIC_INSPECTOR.md — traffic inspector (MITM).
PLUGINS.md — CLI plugin system overview.
PLUGIN_SDK.md — plugin SDK reference.
PLUGIN_MARKETPLACE.md — plugin marketplace.
RADAR.md — Radar free-model catalog overlay (optional, off by default).

routing/

Combo routing, scoring, and replay.

AUTO-COMBO.md — Auto-Combo (multi-factor scoring, 19 strategies).
QUOTA_SHARE.md — quota sharing engine.
REASONING_REPLAY.md — reasoning replay cache.
REASONING_ROUTING.md — reasoning routing rules (effort/budget rule engine).

security/

Guardrails, compliance, stealth, and the mandatory patterns for handling public credentials and error messages.

GUARDRAILS.md — PII, prompt injection, vision guardrails.
COMPLIANCE.md — audit trails and compliance.
STEALTH_GUIDE.md — TLS / fingerprint stealth.
PUBLIC_CREDS.md — mandatory pattern for embedding public upstream OAuth client_id/secret + Firebase Web keys without tripping secret scanners.
ERROR_SANITIZATION.md — mandatory pattern for routing every error response through sanitizeErrorMessage to prevent stack-trace exposure.
ROUTE_GUARD_TIERS.md — route-guard classification tiers.
CLI_TOKEN.md — CLI machine-ID token (HMAC + legacy SHA-256) auth.
EGRESS_POLICY.md — egress IP family (IPv4/IPv6) policy.
BAN_DETECTION.md — account-ban / banned-keyword detection.
AGENTROUTER_WAF.md — agentrouter.org WAF.
CORS.md — CORS configuration & security.
MITM-TPROXY-DECRYPT.md — transparent MITM decrypt.
SUPPLY_CHAIN.md — supply-chain gates (SLSA, SBOM, Trivy, osv-scanner, Scorecard).
SOCKET_DEV_FINDINGS.md — supply-chain finding attestations.

compression/

Prompt compression engines, rules, and language packs.

COMPRESSION_GUIDE.md — top-level compression overview.
COMPRESSION_ENGINES.md — available compression engines.
COMPRESSION_RULES_FORMAT.md — rule file format.
COMPRESSION_LANGUAGE_PACKS.md — language packs.
RTK_COMPRESSION.md — RTK engine deep dive.
CONTEXT_EDITING.md — delegated context editing (Anthropic).
EXTENDING_COMPRESSION.md — adding a custom compression engine.

providers/

Provider-specific integration guides.

CLAUDE_WEB.md — Claude Web (cookie-auth) provider.
CHATGPT_WEB.md — ChatGPT Web (Codex) provider and common-provider retirement note.
ALIBABA-QWEN-PROVIDER-FAMILIES.md — Alibaba and Qwen provider families.
AGENTROUTER.md — AgentRouter setup.
ZED-DOCKER.md — Zed IDE integration under Docker.
CURSOR-DOCKER.md — Cursor model listing under Docker.

comparison/

OMNIROUTE_VS_ALTERNATIVES.md — how OmniRoute compares to alternatives.

ops/

Release, deployment, proxies, tunnels, coverage, database, monitoring.

RELEASE_CHECKLIST.md — release flow checklist.
RELEASE_GREEN.md — keeping the PR queue and release branch green.
BRANCHING_MODEL.md — branching & release model.
MERGE_TRAIN.md — merge queue & manual merge-train runbook.
HOMOLOGATION.md — homologation suite (npm run homolog).
QUALITY_GATE_PLAYBOOK.md — quality-gate playbook.
RUNNER_BOX.md — self-hosted runner box operations.
BRANCH_PROTECTION_MAIN.md — main branch protection.
CONTRIBUTION_GOLDEN_PATH.md — contribution golden path (focused checks per change type).
COVERAGE_PLAN.md — test coverage plan.
DATABASE_GUIDE.md — DB schema and operations.
SQLITE_RUNTIME.md — SQLite driver resolution chain.
REDIS_PRODUCTION_CONFIG.md — Redis production configuration.
MONITORING_GUIDE.md — monitoring & observability.
FLY_IO_DEPLOYMENT_GUIDE.md — Fly.io deployment.
VM_DEPLOYMENT_GUIDE.md — generic VM deployment.
PROXY_GUIDE.md — upstream proxy configuration.
TUNNELS_GUIDE.md — Cloudflare tunnel and friends.

diagrams/

Mermaid sources and exported SVG/PNG diagrams referenced from the docs above. See diagrams/README.md.

i18n/

Translated mirrors of the documentation in 50 locales (plus the English originals — 51 languages in total). See i18n/README.md for the supported language list.

screenshots/

Static screenshots used by the dashboard and the README. Not part of the doc body.

Auto-generated artifacts

reference/PROVIDER_REFERENCE.md is generated by scripts/docs/gen-provider-reference.ts from src/shared/constants/providers.ts. Do not edit by hand.
The /docs UI is backed by Fumadocs MDX source generation from the subfolders above.