Diego Rodrigues de Sa e Souza 6a5960676b fix(security): v3.8.15 hardening follow-ups (cookie maxAge, CHANGEME warn, token-in-URL warn, real rebuild path) ...

- Seg3: bound the auth_token cookie with maxAge=30d (matches the JWT 30d expiry)
- Seg2: warn loudly at boot when bootstrapping with INITIAL_PASSWORD=CHANGEME
- Seg4: warn once per process when a path-token VS Code/Ollama endpoint is used (API key in URL)
- Bug3: resolve the real global omniroute package dir for npm rebuild (was hardcoded /omniroute/app)

Bug1 (auto-update mode detection) deferred pending a concrete repro — high blast radius (controls prod self-update).

Regression guards: auth-login-route (maxAge), management-password-insecure-default,
vscode-token-in-url-warning, global-package-path.

2026-06-30 03:05:09 -03:00

..

_setup

Release v3.8.28 (#4053)

2026-06-17 19:26:32 -03:00

benchmarks

Release v3.8.2 (#2503)

2026-05-23 01:46:59 -03:00

e2e

Release v3.8.30 (#4267)

2026-06-20 07:09:43 -03:00

fixtures

Release v3.8.29 (#4126)

2026-06-19 06:49:01 -03:00

golden-set

feat(compression): expand caveman parity and MCP metadata compression

2026-05-03 09:14:20 -03:00

helpers

Fase 8 · Bloco B — suíte de correção (property + golden + SSE-correctness) (#3808)

2026-06-14 18:02:51 -03:00

integration

Release v3.8.40

2026-06-29 08:40:06 -03:00

live

fix(security): resolve CodeQL ReDoS + URL sanitization alerts

2026-05-17 07:43:32 -03:00

llm-security

Fase 8 · Bloco D — injection-guard em todas as rotas LLM + red-team (#3857)

2026-06-14 18:02:18 -03:00

load

Fase 8 · Bloco C — resiliência runtime (chaos + heap-growth + k6 soak) (#3854)

2026-06-14 18:02:08 -03:00

manual

Release v3.8.20 (#3547)

2026-06-10 13:49:08 -03:00

security

feat: OmniRoute v1.0.0 — Intelligent AI Gateway & Universal LLM Proxy

2026-02-18 00:02:15 -03:00

snapshots

fix(providers): remove dead Phind provider + dedupe HuggingChat catalog listing (#5530)

2026-06-30 02:01:32 -03:00

translator

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

unit

fix(security): v3.8.15 hardening follow-ups (cookie maxAge, CHANGEME warn, token-in-URL warn, real rebuild path)

2026-06-30 03:05:09 -03:00

e2e-tool-calls.sh

Release v3.8.24 (#3747)

2026-06-13 17:27:40 -03:00

scratch_test.mjs

refactor: implement path utilities, add custom date formatting, improve type safety, and unify database imports

2026-04-21 21:10:48 -03:00

theoldllm-stress.test.ts

feat(provider): add The Old LLM (theoldllm) — free Playwright-backed provider (#3217)

2026-06-05 11:45:24 -03:00