Diego Rodrigues de Sa e Souza 9cb91dee74 fix(security): close round-3 advisories (v7g9, x7vm, j7j4, jcm5) + exposure warning (wmgv) (#11261) ...

Validated on a 2-PR combined board: routeGuard 36/36 (within the 68/68 focused-file total), a2a-task-owner-idor 7/7, a2a-tasks-auth, search-baseurl-ssrf-guard, cli-serve-hostname, spawn-capable-prefixes-client-safe all green, typecheck:core + dashboard-typecheck clean, gates within baseline. Five real High-severity advisories fixed with TDD (each failing-then-passing): settings export/import-json ALWAYS_PROTECTED completion, MITM route LOCAL_ONLY+SPAWN_CAPABLE gating, search baseUrl SSRF/IMDS guard, A2A REST task auth+ownership (previously none at all), and the loud boot exposure warning. GHSA-cjv9 confirmed already closed on this base (verified). Round 3 of the advisory sweep.

2026-08-23 20:32:42 -03:00

..

a2a.mjs

feat(cli): fase 5.3+5.4 — a2a invoke JSON-RPC e tasks list/get/cancel/watch/stream/logs

2026-05-15 02:08:12 -03:00

audit.mjs

feat(cli): adicionar omniroute audit (Fase 3.4)

2026-05-15 01:30:18 -03:00

auth-export.mjs

fix(cli): real OpenRouter key validation + auth export argument wiring (#11226) (#11264)

2026-08-23 14:26:08 -03:00

autostart.mjs

Release v3.8.21 (#3593)

2026-06-11 04:01:24 -03:00

backup.mjs

fix(cli): backup create/auto enable — remove option-shadowing legacy fallback (#8512) (#8516)

2026-07-26 03:53:25 -03:00

batches.mjs

feat(cli): fase 6.1+6.2 — batches e files API (upload/CRUD/output/errors)

2026-05-15 02:24:45 -03:00

cache.mjs

feat(cli): migrar backup/restore/health/quota/cache/mcp/a2a/tunnel/env/test/completion (Fase 1.4)

2026-05-14 23:24:52 -03:00

chat.mjs

feat(cli): adicionar comando chat one-shot (Fase 2.1)

2026-05-15 00:28:36 -03:00

cloud.mjs

feat(cli): fase 4.2 — comando cloud para agentes codex/devin/jules

2026-05-15 01:51:55 -03:00

combo.mjs

fix: resolve CLI mcp call protocol issues (BUG-001) (#10960)

2026-08-23 18:11:50 -03:00

comboModels.mjs

fix(cli): combo create cannot accept models — add --models option (#10954) (#11011)

2026-08-21 13:57:52 -03:00

completion.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

compression.mjs

fix: resolve CLI mcp call protocol issues (BUG-001) (#10960)

2026-08-23 18:11:50 -03:00

config.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

configure.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

connect.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

context-eng.mjs

feat(cli): fase 7 — context-eng/sessions/tags/openapi/combo-suggest/oneproxy/telemetry

2026-05-15 02:47:49 -03:00

contexts.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

cost.mjs

feat(cli): adicionar comando cost com breakdown de custos (Fase 2.4)

2026-05-15 00:52:15 -03:00

dashboard.mjs

fix(cli): use rundll32 instead of cmd.exe for Windows browser fallback in dashboard command (#7844)

2026-07-20 15:56:08 -03:00

doctor.mjs

fix(cli): restore packaged machine-token authentication (#10468)

2026-08-20 15:07:19 -03:00

env.mjs

feat(cli): migrar backup/restore/health/quota/cache/mcp/a2a/tunnel/env/test/completion (Fase 1.4)

2026-05-14 23:24:52 -03:00

eval.mjs

feat(cli): R7 — OAuthFlow/EvalWatch/ProvidersTestAll TUI + integração (spec 8.10)

2026-05-15 09:13:56 -03:00

files.mjs

feat(cli): fase 6.1+6.2 — batches e files API (upload/CRUD/output/errors)

2026-05-15 02:24:45 -03:00

health.mjs

fix(api): point CLI health command at /api/monitoring/health (#6677) (#6717)

2026-07-10 18:06:00 -03:00

keys.mjs

fix(cli): stop swallowing non-2xx responses into benign-looking results (#10092)

2026-08-13 04:43:18 -03:00

launch-codex.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

launch.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

login.mjs

feat(cli): deliver the Antigravity credential straight to the remote install (#8834)

2026-08-05 22:39:39 -03:00

logs.mjs

Release v3.8.34 (#4614)

2026-06-23 03:08:29 -03:00

mcp.mjs

fix: resolve CLI mcp call protocol issues (BUG-001) (#10960)

2026-08-23 18:11:50 -03:00

memory.mjs

fix(dashboard): use lightweight ping endpoint for MaintenanceBanner (fixes #3040) (#3043)

2026-06-01 14:30:17 -03:00

models.mjs

feat(cli): padronizar saída emit() — cli-table3/csv-stringify/schema (Fase 1.7)

2026-05-14 23:54:49 -03:00

nodes.mjs

feat(cli): fase 6.6 — nodes CRUD/validate/test/metrics

2026-05-15 02:27:20 -03:00

oauth.mjs

fix(cli): complete Windows cliproxy platform handling + pid probe (#11236) (#11263)

2026-08-23 14:25:04 -03:00

oneproxy.mjs

fix: resolve CLI mcp call protocol issues (BUG-001) (#10960)

2026-08-23 18:11:50 -03:00

open.mjs

feat(cli): fase 8.1/8.6/8.14 — spinner, open, clipboard e environment helpers

2026-05-15 03:00:52 -03:00

openapi.mjs

fix(cli): openapi endpoints/paths/validate accept the served catalog shape (#10091)

2026-08-13 04:43:02 -03:00

packs.mjs

perf(electron): ship optional ML/browser deps as installable packs (#10382)

2026-08-16 02:20:59 -03:00

plugin.mjs

feat(cli): add native Bun backend support and Dockerfile.bun (#11039)

2026-08-21 21:28:43 -03:00

policy.mjs

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

pricing.mjs

feat(cli): fase 6.4 — pricing sync/list/get/defaults/diff

2026-05-15 02:25:58 -03:00

provider-cmd.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

provider-crud.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

providers.mjs

fix(cli): route provider tests through connection API (#10572)

2026-08-20 22:41:27 -03:00

quota.mjs

feat(api): add provider quota telemetry, adaptive routing, and status inventory (#10148)

2026-08-18 11:31:53 -03:00

radar.mjs

feat(cli): add Radar status and sync commands

2026-08-14 11:00:13 -03:00

redis.mjs

fix(docker): publish the Redis sidecar on loopback instead of 0.0.0.0 (#9286)

2026-08-05 21:45:56 -03:00

registry.mjs

docs: update omni route video guides ranking layout

2026-08-17 16:16:58 -03:00

repl.mjs

feat(cli): fase 8.11 — REPL interativo multi-turn com Ink (runRepl, session, slash commands)

2026-05-15 04:51:23 -03:00

reset-encrypted-columns.mjs

Release/v3.8.0 (#2430)

2026-05-20 09:12:49 -03:00

resilience.mjs

fix: resolve CLI mcp call protocol issues (BUG-001) (#10960)

2026-08-23 18:11:50 -03:00

restart.mjs

feat(cli): migrar serve/stop/restart/dashboard/keys/models/combo (Fase 1.3)

2026-05-14 23:11:30 -03:00

run.mjs

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

runtime.mjs

fix: prevent false 'Failed to save connection' error when adding providers (#8912)

2026-08-05 21:41:33 -03:00

serve.mjs

fix(security): close round-3 advisories (v7g9, x7vm, j7j4, jcm5) + exposure warning (wmgv) (#11261)

2026-08-23 20:32:42 -03:00

sessions.mjs

feat(cli): fase 7 — context-eng/sessions/tags/openapi/combo-suggest/oneproxy/telemetry

2026-05-15 02:47:49 -03:00

setup-aider.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-claude.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-cline.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-codex.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-continue.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-crush.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-cursor.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-goose.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-kilo.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-open-code.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-opencode.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-qwen.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup-roo.mjs

feat(cli): refuse ephemeral container auto-config writes (#10057)

2026-08-16 00:42:14 -03:00

setup.mjs

fix(cli): resolve dynamic imports to file:// URLs so the DB fallback works on Windows (#11238)

2026-08-23 14:24:50 -03:00

simulate.mjs

feat(cli): adicionar comando simulate para dry-run de routing (Fase 2.3)

2026-05-15 00:45:35 -03:00

skills.mjs

fix: resolve CLI mcp call protocol issues (BUG-001) (#10960)

2026-08-23 18:11:50 -03:00

status.mjs

Release v3.8.4 (#2678)

2026-05-26 23:51:47 -03:00

stop.mjs

fix(cli): stop the supervisor before the child so omniroute stop no longer reports success while the supervisor respawns the server (#9455)

2026-08-05 16:47:23 -03:00

stream.mjs

feat(cli): adicionar comando stream com inspeção SSE (Fase 2.2)

2026-05-15 00:36:41 -03:00

sync.mjs

feat(cli): fase 6.7 — sync push/pull/diff/bundle/import/tokens/initialize/resolve

2026-05-15 02:27:56 -03:00

tags.mjs

feat(cli): fase 7 — context-eng/sessions/tags/openapi/combo-suggest/oneproxy/telemetry

2026-05-15 02:47:49 -03:00

telemetry.mjs

feat(cli): fase 7 — context-eng/sessions/tags/openapi/combo-suggest/oneproxy/telemetry

2026-05-15 02:47:49 -03:00

test-provider.mjs

fix(cli): route provider tests through connection API (#10572)

2026-08-20 22:41:27 -03:00

tokens.mjs

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

translator.mjs

feat(cli): fase 6.3 — translator detect/translate/send/stream/history

2026-05-15 02:25:24 -03:00

tray.mjs

feat(cli): fase 8.8 — system tray + autostart (omniroute serve --tray)

2026-05-15 04:07:20 -03:00

tunnel.mjs

fix(cli): code-review-2 — I1/I2/M1/M2

2026-05-15 10:24:30 -03:00

update.mjs

feat(radar): flag-gated signed free-model catalog overlay (#9515)

2026-08-06 05:58:58 -03:00

usage.mjs

feat(cli): adicionar grupo usage com 7 subcomandos (Fase 2.5)

2026-05-15 00:59:21 -03:00

webhooks.mjs

feat(cli): fase 4.4 — comando webhooks com CRUD, eventos e dispatch de teste

2026-05-15 01:53:09 -03:00