mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-20 22:22:57 +03:00

Files

Diego Rodrigues de Sa e Souza ff64716c31 feat(dashboard): opt-in CSP relaxation for VS Code Simple Browser embedding (#10273 ) (#10386 )

OmniRoute ships `frame-ancestors 'none'` + `X-Frame-Options: DENY` on every
route, so the VS Code Simple Browser renders a blank tab — which is what the
OmniCopilot extension's `dashboardOpen: "editor"` mode uses.

Add the build-time opt-in `DASHBOARD_ALLOW_EMBED=vscode`. When set, the HTML
pages are served with `frame-ancestors 'self' vscode-webview:` and without
`X-Frame-Options` (XFO cannot express a custom scheme and would veto the
relaxed CSP). Unset — the default — nothing changes.

The API surface stays strictly unframable in both modes. Its exclusion list is
derived from the `rewrites()` table plus `/api`, `/a2a`, `/healthz`, so a future
root-level API alias is excluded automatically instead of silently becoming
framable. The two generated `source` patterns are complementary by construction:
every pathname matches exactly one, so there is no gap (a page with no security
headers) and no order-dependent overlap.

Closes #10273

Co-authored-by: Xiangzhe <bakryun0718@proton.me>

2026-08-14 15:04:59 -03:00

features

feat(dashboard): opt-in CSP relaxation for VS Code Simple Browser embedding (#10273 ) (#10386 )

2026-08-14 15:04:59 -03:00

fixes

fix(cli): remove orphaned resolveOpencodeConfigDir re-export (base-red #9985 ) (#10396 )

2026-08-14 14:23:11 -03:00

maintenance

docs(changelog): reconcile the full v3.8.50 cycle — 467 uncovered commits + 224 contributor credits (#10189 )

2026-08-12 14:23:35 -03:00

README.md

feat(release): changelog.d/ fragments — eliminate the CHANGELOG merge-storm cascade (#6783 )

2026-07-10 07:22:49 -03:00

README.md

changelog.d/ — changelog fragments

A PR never edits CHANGELOG.md directly during the cycle. Instead it adds ONE new file here — its changelog entry as a fragment. Two PRs never touch the same file, so changelog merge conflicts (the "CHANGELOG-eat" cascade that forced a re-sync push + full CI re-run after every sibling merge) are structurally impossible.

Convention

Directory	Aggregates under
`features/`	`### ✨ New Features`
`fixes/`	`### 🐛 Bug Fixes`
`maintenance/`	`### 📝 Maintenance`

Filename: <PR-number>-<short-slug>.md (e.g. fixes/6700-dockerfile-better-sqlite3.md). The PR number prefix keeps aggregation order deterministic.
Content: the exact bullet line(s) that should land in CHANGELOG.md, starting with - . Multi-line (continuation) bullets are fine. Keep the repo's credit format: (#PR — thanks @user).
One fragment per PR (rarely more, e.g. a PR that both fixes and adds).

Example

changelog.d/fixes/6496-cloudflare-relay-worker-syntax.md:

- **fix(providers):** Cloudflare relay Worker deploys use Service Worker syntax with `body_part` metadata ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)) — thanks @SeaXen

Aggregation

The release captain (or /generate-release) folds all fragments into CHANGELOG.md and deletes them:

node scripts/release/aggregate-changelog.mjs            # write + delete fragments
node scripts/release/aggregate-changelog.mjs --dry-run  # preview only

Fragment well-formedness is enforced by npm run check:changelog-integrity (the same gate that guards against CHANGELOG-eat for legacy direct edits).