Files
OmniRoute/docs
diegosouzapw 55659d92be fix(security): address code-review findings — timing-safe token, OMNIROUTE_CLI_SALT, tray PNG, preservePatterns defaults, missing docs
- management.ts: replace === with timingSafeEqual for CLI token comparison
- machineToken.ts: salt upgraded to omniroute-cli-auth-v1; OMNIROUTE_CLI_SALT env
  var honoured for rotation; full 64-char SHA-256 hex token
- tray.ps1: accept .png via GDI+ Bitmap->Icon handle; Windows tray works without .ico
- tray.ts: getIconPath() tries icon.ico then icon.png on Windows
- compression/types.ts: DEFAULT_CAVEMAN_CONFIG.preservePatterns filled with
  six defaults (fenced code, inline code, URLs, paths, error lines, stack traces)
- CLAUDE.md: Hard Rule #15 — spawn-capable routes must use isLocalOnlyPath()
- .env.example + docs/reference/ENVIRONMENT.md: document OMNIROUTE_CLI_SALT
- docs/security/CLI_TOKEN.md: new (was referenced in changelog but missing)
- docs/security/ROUTE_GUARD_TIERS.md: new (was referenced in changelog but missing)
- tests/unit/lib/machineToken.test.ts: updated for 64-char token; added
  OMNIROUTE_CLI_SALT env-var rotation test
2026-05-15 01:54:09 -03:00
..

title, version, lastUpdated
title version lastUpdated
OmniRoute Documentation 3.8.0 2026-05-13

OmniRoute Documentation

Navigable index of the OmniRoute documentation set. Topics are grouped by intent so you can find what you need quickly.

Looking for the project overview, install steps, or release notes? See the root README.md, CHANGELOG.md, and CONTRIBUTING.md.


architecture/

How the system is put together — read these to understand the runtime, code layout, and resilience model.

guides/

Task-focused walkthroughs for operators and end users.

reference/

Lookup material — API surface, environment variables, CLI flags, provider catalog.

frameworks/

Pluggable subsystems exposed to clients, agents, and operators.

routing/

Combo routing, scoring, and replay.

security/

Guardrails, compliance, stealth, and the mandatory patterns for handling public credentials and error messages.

  • GUARDRAILS.md — PII, prompt injection, vision guardrails.
  • COMPLIANCE.md — audit trails and compliance.
  • STEALTH_GUIDE.md — TLS / fingerprint stealth.
  • PUBLIC_CREDS.mdmandatory pattern for embedding public upstream OAuth client_id/secret + Firebase Web keys without tripping secret scanners.
  • ERROR_SANITIZATION.mdmandatory pattern for routing every error response through sanitizeErrorMessage to prevent stack-trace exposure.

compression/

Prompt compression engines, rules, and language packs.

ops/

Release, deployment, proxies, tunnels, coverage.

diagrams/

Mermaid sources and exported SVG/PNG diagrams referenced from the docs above. Populated incrementally — see diagrams/README.md.

i18n/

Translated mirrors of the documentation in 40 locales. See i18n/README.md for the supported language list.

screenshots/

Static screenshots used by the dashboard and the README. Not part of the doc body.


Auto-generated artifacts

  • reference/PROVIDER_REFERENCE.md is generated by scripts/gen-provider-reference.ts from src/shared/constants/providers.ts. Do not edit by hand.
  • The dashboard sidebar (/docs UI) is generated by scripts/generate-docs-index.mjs, which walks the subfolders above.