Files
OmniRoute/electron
Diego Rodrigues de Sa e Souza a25d5f1ef6 Release v3.8.13 (#3327)
* chore(release): open v3.8.13 development cycle

Bump 3.8.12 → 3.8.13 across package.json, lockfile, electron/, open-sse/, and
docs/reference/openapi.yaml; add the [3.8.13] cycle placeholder to the root
CHANGELOG and the 41 i18n mirrors. Integration branch for the v3.8.13 cycle —
fixes/features land here via per-issue PRs and it merges to main at release time.

* fix(ci): skip auto-deploy when VPS host is unreachable from the runner (#3299)

Integrated into release/v3.8.13

* fix(dev): auto-rebuild better-sqlite3 on Node ABI mismatch at dev startup (#3301)

Integrated into release/v3.8.13

* feat(api): accept path-scoped API keys on client API routes (#3300)

Integrated into release/v3.8.13

* fix(sse): harden against empty responses causing Copilot Chat failures (#3297)

Integrated into release/v3.8.13

* fix(api): remove Completions.me rickroll provider (discussion #3293) (#3302)

Integrated into release/v3.8.13

* fix(opencode-provider): extract contextLength from live model catalog (#3298)

Integrated into release/v3.8.13

* feat(web-cookie): self-service login infrastructure + auto-refresh daemon (#3292)

Integrated into release/v3.8.13

* docs(changelog): record the v3.8.13 PRs merged this round (#3292/#3300/#3297/#3298/#3301/#3302/#3299)

* fix(auth): harden URL token extraction — drop query-string fallback, gate to client routes (security follow-up to #3300) (#3309)

Security follow-up to #3300 — integrated into release/v3.8.13

* docs: rename resolve-issues → review-issues skill references

* fix(dashboard): keep no-auth providers visible under 'Show configured only' (#3290) (#3312)

no-auth providers (opencode, duckduckgo-web, theoldllm, veoaifree-web) never
create a DB connection row so stats.total stays 0, which the configured-only
filter treated as 'unconfigured' and hid them — even though they are always
usable and appear unconditionally in /v1/models. filterConfiguredProviderEntries
now treats displayAuthType === 'no-auth' as configured.

Co-authored-by: uniQta <uniQta@users.noreply.github.com>

* fix(cli): resolve update paths relative to script + recursive backup (#3295) (#3313)

omniroute update always failed on a global install:
- getCurrentVersion() read package.json from process.cwd(), which on a global
  npm/brew install is the user's working dir, not the package root → null →
  'Could not determine current version'.
- createBackup() resolved bin/ from cwd too, and passed the 'cli' directory to
  copyFileSync → EISDIR, swallowed by the catch → 'Failed to create backup'.

Both now resolve package.json/bin relative to the script via import.meta.url,
and the backup uses cpSync({recursive:true}) so the cli/ directory is copied.

Co-authored-by: uniQta <uniQta@users.noreply.github.com>

* fix(theoldllm): read upstream body once to avoid [502] body-already-read (#3296) (#3314)

On the cached-token path the executor never enters the refresh branch, so the
same upstream Response was read with .text() twice (token-rejection check +
final body). A Response body is single-use, so the second read threw
'Body is unusable: Body has already been read', caught and surfaced as [502].

Read the body once into finalBody and only re-read after a token-rejection
refetch.

Co-authored-by: onizukashonan14-png <onizukashonan14-png@users.noreply.github.com>

* fix(sse): strip leaked internal tool envelopes from streaming output (#3311)

Integrated into release/v3.8.13

* fix(sse): expose Claude + Gemini budget tiers in the antigravity catalog (#3184) (#3303)

Integrated into release/v3.8.13 (#3184)

* fix(catalog): compute combo context_length from known targets only (#3304)

Integrated into release/v3.8.13 — live contextLength + known-targets combo context (#3298 follow-up)

* chore(i18n): add message keys for proxy UI + vscode/ollama endpoint (#3307)

Integrated into release/v3.8.13 — i18n message keys for proxy UI + vscode/ollama

* feat(dashboard): i18n the proxy settings UI (#3310)

Integrated into release/v3.8.13 — i18n the proxy settings UI

* feat(api): model catalog enrichment + MCP model-catalog tools (#3306)

Integrated into release/v3.8.13 — model catalog enrichment + MCP model-catalog tools, reconciled with #3309 URL-token hardening

* test(catalog): align Antigravity preview-alias test with #3303 budget tiers

#3303 added the Gemini `-high`/`-low` budget tiers to ANTIGRAVITY_PUBLIC_MODELS
(user-callable on the Antigravity OAuth backend, verified via #3184), but did
not update the catalog-route test that asserted `antigravity/gemini-3.1-pro-high`
must NOT be exposed. The assertion now reflects the intended behavior — the
client-visible budget alias IS surfaced — while keeping the legacy
`gemini-claude-*` alias keys unexposed. Caught running the full catalog suite
on the merged release HEAD (the #3303 round only ran the antigravity-aliases
and usage-hardening files).

* docs(changelog): record the 6 PRs merged this review round into v3.8.13

#3306/#3307/#3310 (New Features — VS Code split: catalog+MCP, i18n keys, proxy
UI i18n), #3311/#3303/#3304 (Bug Fixes — SSE envelope sanitizer, antigravity
budget tiers, combo known-targets context_length).

* chore(release): finalize v3.8.13 changelog and cleanup

Finalize the v3.8.13 changelog with release date, maintenance notes,
and contributor credits. Update MCP docs to reference the correct tool
inventory diagram, exclude nested .claude worktrees from ESLint scans,
and tighten a response sanitizer type guard.

* fix(dashboard): refresh connections after provider auth import (#3320)

Integrated into release/v3.8.13 — refresh connections after provider auth import

* fix(codex): strip client-only params on native /responses passthrough (#3317) (#3325)

A /v1/responses request against the built-in codex/ provider does an
openai-responses -> openai-responses passthrough (CodexExecutor.transformRequest
returns the body early for _nativeCodexPassthrough). It forwarded client-only
fields verbatim and the Codex upstream rejected them with 400 Unsupported
parameter: prompt_cache_retention / safety_identifier / user — breaking Factory
Droid (which injects all three). The chat-completions path already strips these
(base.ts #1884, openai-responses translator #2770) but the passthrough skips
translation. Strip the three fields in the shared block before the passthrough
return; user is removed unconditionally since Codex /responses always rejects it.

Co-authored-by: tycronk20 <tycronk20@users.noreply.github.com>

* fix(dashboard): normalize agent-bridge /state response to stop page crash (#3318) (#3326)

The Agent Bridge page seeded a well-shaped initialData default then replaced it
wholesale with the raw /api/tools/agent-bridge/state response. The route returns
{ server, agents } but the UI reads { serverState, agentStates, bypassPatterns,
mappings }, so serverState became undefined and AgentBridgeServerCard crashed on
serverState.running — surfaced as the full-page 'Internal Server Error' boundary
(client render error, not a real 5xx).

Add a shared normalizeAgentBridgeState() that maps the route shape into the page
contract (server.running/certExists -> serverState) and always returns safe
defaults (never undefined serverState). Wired into both the SSR loader (page.tsx)
and the polling hook. The legacy 'agents' entry shape differs from AgentStateEntry
so it is not coerced; full route<->page contract reconciliation (port, upstreamCa,
bypassPatterns, mappings, agentStates) is a follow-up.

Co-authored-by: tycronk20 <tycronk20@users.noreply.github.com>

* docs: VS Code/Ollama endpoints + env & i18n tooling (#3319)

Integrated into release/v3.8.13 — VS Code/Ollama docs + env & i18n tooling

* feat(provider): test-all endpoint, rate-limit overrides, visibility f… (#3267)

Integrated into release/v3.8.13 — provider test-all endpoint, rate-limit overrides, model visibility

* feat: auto-combo optimization, playground model dropdown, only-configured toggle (#3322)

Integrated into release/v3.8.13 — auto-combo candidate expansion + playground dropdown + only-configured toggle

* feat(api): VS Code Copilot Ollama-compatible BYOK endpoint (#3316)

Integrated into release/v3.8.13 — VS Code Copilot Ollama-compatible BYOK endpoint (reconciled with #3306/#3309 auth hardening)

* chore(release): document #3320 in the v3.8.13 changelog + contributor credits

---------

Co-authored-by: Felipe Almeman <4226997+zhiru@users.noreply.github.com>
Co-authored-by: Wilson <pedbookmed@gmail.com>
Co-authored-by: Hernan Javier Ardila Sanchez <hjasgr@gmail.com>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: uniQta <uniQta@users.noreply.github.com>
Co-authored-by: onizukashonan14-png <onizukashonan14-png@users.noreply.github.com>
Co-authored-by: tycronk20 <tycronk20@users.noreply.github.com>
Co-authored-by: Vinayrnani <vinayrnani@gmail.com>
2026-06-06 19:13:11 -03:00
..
2026-06-06 19:13:11 -03:00
2026-06-06 19:13:11 -03:00
2026-06-06 19:13:11 -03:00
2026-06-06 19:13:11 -03:00
2026-06-06 19:13:11 -03:00
2026-05-26 23:51:47 -03:00

OmniRoute Electron Desktop App

This directory contains the Electron desktop application wrapper for OmniRoute.

Architecture (v1.6.4)

electron/
├── main.js          # Main process — window, tray, server lifecycle, CSP, IPC
├── preload.js       # Preload script — secure IPC bridge with disposer pattern
├── package.json     # Electron-specific dependencies & electron-builder config
├── types.d.ts       # TypeScript definitions (AppInfo, ServerStatus, ElectronAPI)
└── assets/          # Application icons and resources

src/shared/hooks/
└── useElectron.ts   # React hooks — useSyncExternalStore, zero re-renders

Key Design Decisions

Decision Rationale
waitForServer() polling Prevents blank screen on cold start — polls http://localhost:PORT before loading
stdio: 'pipe' Captures server stdout/stderr for logging + readiness detection (not inherit)
Disposer pattern onServerStatus() returns () => void for precise listener cleanup (no removeAllListeners)
useSyncExternalStore Zero re-renders for useIsElectron() — no useState + useEffect cycle
CSP via session headers Content-Security-Policy restricts script-src, connect-src etc. per Electron best practices
Platform-conditional titlebar titleBarStyle: 'hiddenInset' only on macOS; default on Windows/Linux

Development

Prerequisites

  1. Build the Next.js app first:
npm run build
  1. Install Electron dependencies:
cd electron
npm install

Running in Development

  1. Start the Next.js development server:
npm run dev
  1. In another terminal, start Electron:
cd electron
npm run dev

Running in Production Mode

  1. Build Next.js in standalone mode:
npm run build
  1. Start Electron:
cd electron
npm start

Building

Build for Current Platform

cd electron
npm run build

Build for Specific Platforms

# Windows
npm run build:win

# macOS (x64 + arm64)
npm run build:mac

# Linux
npm run build:linux

Output

Built applications are placed in dist-electron/:

  • Windows: .exe installer (NSIS) + portable .exe
  • macOS: .dmg installer (Intel + Apple Silicon)
  • Linux: .AppImage

Installation

macOS

  1. Download the latest .dmg from the Releases page.
  2. Open the .dmg file.
  3. Drag OmniRoute.app to the Applications folder.
  4. Launch from Applications.

⚠️ Note: The app is not signed with an Apple Developer certificate yet. If macOS blocks the app, run:

xattr -cr /Applications/OmniRoute.app

Or right-click the app → Open → Open (to bypass Gatekeeper on first launch).

Windows

Installer (Recommended):

  1. Download OmniRoute.Setup.*.exe from Releases.
  2. Run the installer.
  3. Launch from Start Menu or Desktop shortcut.

Portable (No Installation):

  1. Download OmniRoute.exe from Releases.
  2. Run directly from any folder.

Linux

  1. Download the .AppImage from Releases.
  2. Make it executable:
    chmod +x OmniRoute-*.AppImage
    
  3. Run:
    ./OmniRoute-*.AppImage
    

Features

  • Server Readiness — Waits for health check before showing window
  • System Tray — Minimize to tray with quick actions (open, port change, quit)
  • Port Management — Change port from tray menu (server restarts automatically)
  • Window Controls — Custom minimize, maximize, close via IPC
  • Content Security Policy — Restrictive CSP via session headers
  • Offline Support — Bundled Next.js standalone server
  • Single Instance — Only one app instance can run at a time

Configuration

Environment Variables

Variable Default Description
OMNIROUTE_PORT 20128 Server port
OMNIROUTE_MEMORY_MB 512 Node.js heap limit (6416384 MB)
NODE_ENV production Set to development for dev mode

Custom Icon

Place your icons in assets/:

  • icon.ico — Windows icon (256×256)
  • icon.icns — macOS icon bundle
  • icon.png — Linux/general use (512×512)
  • tray-icon.png — System tray icon (16×16 or 32×32)

IPC Channels

Invoke (Renderer → Main, async)

Channel Returns Description
get-app-info AppInfo App name, version, platform, isDev, port
open-external void Open URL in default browser (http/https only)
get-data-dir string Get userData directory path
restart-server { success } Stop + restart server (5s timeout + SIGKILL)

Send (Renderer → Main, fire-and-forget)

Channel Description
window-minimize Minimize window
window-maximize Toggle maximize/restore
window-close Close window (minimize to tray)

Receive (Main → Renderer, events)

Channel Payload Emitted When
server-status ServerStatus Server starts, stops, errors, or restarts
port-changed number Port change via tray menu

Note

: Listeners return disposer functions for precise cleanup. See useServerStatus and usePortChanged hooks.

Security

Feature Implementation
Context Isolation contextIsolation: true — renderer cannot access Node.js
Node Integration nodeIntegration: false — no require() in renderer
IPC Whitelist Channel names validated in preload via safeInvoke/safeSend/safeOn
URL Validation shell.openExternal() only allows http: / https: protocols
CSP Content-Security-Policy header set via session.webRequest.onHeadersReceived
Web Security webSecurity: true — same-origin policy enforced

React Hooks

Hook Returns Description
useIsElectron() boolean Zero-render detection via useSyncExternalStore
useElectronAppInfo() { appInfo, loading, error } App info from main process
useDataDir() { dataDir, loading, error } User data directory
useWindowControls() { minimize, maximize, close } Window control actions
useOpenExternal() { openExternal } Open URLs in browser
useServerControls() { restart, restarting } Server restart control
useServerStatus(cb) Disposer Listen for server status events
usePortChanged(cb) Disposer Listen for port change events

Troubleshooting

App Won't Start

  1. Check if port 20128 is available: lsof -i :20128
  2. Check console logs for [Electron] prefix
  3. Verify the build output exists in .build/next/standalone

White Screen

  1. Verify Next.js build exists — server readiness waits 30s max
  2. Check [Server] and [Server:err] log output
  3. Look for CSP violations in developer console

Build Fails

Ensure you have build tools installed:

  • Windows: Visual Studio Build Tools
  • macOS: Xcode Command Line Tools
  • Linux: build-essential, libsecret-1-dev

License

MIT