Release v3.8.50

.cbmignore

@@ -0,0 +1,201 @@
+# codebase-memory-mcp ignore list
+#
+# Padrão gitignore-style. Linhas começando com `#` são comentários.
+# Barra final (`/`) = só diretório. Sem barra = casa arquivo OU diretório.
+#
+# O CBM também lê `.gitignore` automaticamente — esta lista deixa explícito o que
+# os hooks do CBM vão pular. Se uma regra entrar em conflito entre os dois arquivos,
+# vale a união. Editar este arquivo é mais barato do que confiar na herança implícita.
+#
+# Última reconciliação: 2026-07-31, status `ready` (513k nodes / 689k edges),
+# `auto_index_limit=50000`, total indexável medido ≈11.546 arquivos (folga 4,3×).
+#
+# Fontes cruzadas:
+#   - `codebase-memory-mcp cli index_status --project home-diegosouzapw-dev-proxys-OmniRoute`
+#     → `not_indexed.dirs` (27) + `not_indexed.files` (336), todos `BY DESIGN`.
+#   - `.gitignore` deste repo (5.691 B) — fonte canônica secundária.
+#
+# Como auditar mudanças: depois de editar este arquivo, rodar `index_repository`
+# (ou esperar `auto_watch` re-indexar) e re-checar `cli index_status` → comparar
+# contagens em `not_indexed.dirs_count` e `not_indexed.files_count`.
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 1. Diretorios de runtime / pacote — nao sao codigo-fonte
+# ─────────────────────────────────────────────────────────────────────────────
+node_modules/
+node_modules
+
+# Builds e artefatos reproduziveis (Layer 1 Next.js / Electron)
+.build/
+dist/
+.next/
+out/
+
+# Electron especifico
+electron/dist-electron/
+electron/node_modules/
+icon.iconset/
+
+# Workspaces internos que tem proprio node_modules
+@omniroute/opencode-plugin/dist/
+@omniroute/opencode-plugin/node_modules/
+@omniroute/opencode-provider/dist/
+@omniroute/opencode-provider/node_modules/
+
+# Recursos nativos compilados (C/JNI/wasm)
+src/mitm/tproxy/native/build/
+
+# Artefatos locais do Stryker / Playwright / coverage
+.stryker-tmp/
+reports/mutation/
+stryker-output-*.json
+.playwright-mcp/
+test-results/
+playwright-report/
+blob-report/
+
+# Analise / linters / caches
+.analysis/
+.sisyphus/
+.plans/
+.gitnexus
+.worktrees
+.codegraph/
+
+# Quality artifacts (gerados por npm run lint --cache etc)
+.eslintcache
+.eslintcache-complexity
+
+# Claude Code local state
+.claude/scheduled_tasks.lock
+.claude/scheduled_tasks/
+.claude/sessions/
+.claude/state.json
+.claude/settings.local.json
+
+# Serena / Antigravity / outras tools locais
+.serena/
+.antigravitycli/
+.gemini/
+.config/
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 2. Diretorios com prefixo `_` — locais / privados (regra global do .gitignore)
+# ─────────────────────────────────────────────────────────────────────────────
+_*/
+_artifacts/
+_cache/
+_mono_repo/
+_references/
+_tasks/
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 3. Diretorios de tooling IA (state local, nao codigo)
+# ─────────────────────────────────────────────────────────────────────────────
+.agents/
+.claude/
+.vscode/
+.idea/
+.junie/
+.omc/
+.data/
+.data-dev/
+.local-data/
+.logs/
+.artifacts/
+.source/
+.superpowers/
+.claude-flow/
+.omnivscodeagent/
+omnirouteCloud/
+omnirouteSite/
+.omniroute/
+.stent/
+
+# Subpaths especificos do Claude Code que nao estao em .claude/ (criados sob repo)
+.claude/worktrees/
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 4. Diretorios de dados / runtime locais (storage, env, secrets, scratch)
+# ─────────────────────────────────────────────────────────────────────────────
+data/
+# NOTA: src/lib/env/, src/app/api/{cloud,sync/cloud,system/env,agent-skills/coverage}/
+# foram removidos daqui (2026-08-05). Os nomes sugerem dados/segredos locais, mas os
+# 8 arquivos sao route handlers e modulos rastreados no git — escondia-los do grafo
+# criava pontos cegos em buscas e em analise de impacto.
+tests/golden-set/data/
+
+# Logs e saida de teste
+logs/*
+test_output.log
+home-diegosouzapw-dev-automacoes-*.txt
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 5. Diretorios do monorepo por subprojeto (nao fazem parte do app principal)
+# ─────────────────────────────────────────────────────────────────────────────
+security-analysis/
+vscode-extension/
+obsidian-plugin/node_modules/
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 6. Diretorios de documentacao interna / workflow
+# ─────────────────────────────────────────────────────────────────────────────
+docs/superpowers/
+# Docs traduzidas: 1.215 arquivos / 94 MB (inclui 20+ copias do CHANGELOG).
+# Sao traducoes do tree em ingles, ja indexado — no grafo so geram ruido em
+# search_code e consomem o auto_index_limit.
+docs/i18n/
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 7. Arquivos especificos (nao diretorios inteiros)
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Segredos e env — NUNCA indexar
+.env
+.env.*
+!.env.example
+!.env.homolog.example
+
+# TypeScript build info e next env declaration
+*.tsbuildinfo
+next-env.d.ts
+typescript
+
+# SQLite transient files (WAL/SHM/journal)
+*.sqlite-shm
+*.sqlite-wal
+*.sqlite-journal
+
+# Mapas e source maps
+*.map
+
+# Bun / npm lockfiles ruidosos
+bun.lock
+
+# `cheaper-inference-gateway.svg` e arquivos de midia na raiz/asset ja cobertos
+# pelos `ignored-suffix` do indexador (svg/png/jpg/ico/etc >50kB ou >500linhas);
+# manter a regra explicita aqui ajuda a auditar:
+cheaper-inference-gateway.svg
+cheaper-inference-gateway-*.svg
+
+# Husky internals
+.husky/_/
+
+# CI / quality metric artifacts
+config/quality/quality-metrics.json
+config/quality/test-impact-map.json
+audit-report.json
+.gh-discussions.json
+
+# i18n audit (gerado por npm run scripts)
+scripts/i18n/_audit.json
+scripts/i18n/_pending-keys.json
+
+# NOTA: bin/omniroute.mjs foi removido daqui (2026-08-05). Estava marcado como
+# "scratch", mas e o entrypoint real do CLI publicado (package.json -> bin.omniroute)
+# e consta em PACK_ARTIFACT_REQUIRED_PATHS. Precisa estar no grafo.
+
+# Deploy / docker backups
+deploy.sh
+docker-compose.yml.bak
+docker-compose.minimal.yml

.claude/worktrees/feat-7786/changelog.d/features/7786-management-auth-terminology-docs.md

@@ -0,0 +1 @@
+- **docs:** add management authentication terminology guide ([#7786](https://github.com/diegosouzapw/OmniRoute/issues/7786))

.claude/worktrees/feat-7786/docs/guides/MANAGEMENT-AUTH.md

@@ -0,0 +1,41 @@
+# Management Authentication
+
+OmniRoute uses four distinct credential families for management access. This guide
+distinguishes them by purpose, scope, and locality.
+
+| Credential              | Scope              | Locality      | Use Case                          |
+|-------------------------|--------------------|---------------|-----------------------------------|
+| Dashboard JWT session   | Full management    | Localhost      | Web dashboard login               |
+| CLI machine-id token    | Full management    | Per-machine    | `omniroute` CLI commands          |
+| Scoped `oma_` token     | Configurable scope | External       | Automation / CI / API access      |
+| Manage-scope API key    | `manage` scope     | External       | Management API calls              |
+
+## Dashboard JWT Session
+
+Generated on dashboard login (`/api/auth/login`). Stored in HTTP-only cookie.
+Valid for the session duration. Cannot be used from external hosts.
+
+## CLI Machine-ID Token
+
+Created by `omniroute auth login` on first use. Stored in `~/.omniroute/auth.json`.
+Used by the CLI for all management operations. Tied to the machine identity.
+
+## Scoped `oma_` Access Token
+
+Created via dashboard or CLI with configurable scopes (e.g., `manage`, `read`).
+Format: `oma_<random-hex>`. Used for programmatic access from external systems.
+
+## Manage-Scope API Key
+
+Standard API key with the `manage` scope enabled. Created in dashboard API Keys page.
+Used for management API calls from external hosts.
+
+## Header Examples
+
+```
+Authorization: Bearer oma_abc123def456
+Authorization: Bearer <standard-api-key-with-manage-scope>
+Cookie: omniroute_session=<jwt-token>
+```
+
+See `docs/reference/API_REFERENCE.md` for endpoint-specific auth requirements.

.claude/worktrees/feat-7786/tests/unit/management-auth-docs.test.ts

@@ -0,0 +1,27 @@
+import { describe, it } from "node:test";
+import { ok } from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+describe("Management auth documentation (#7786)", () => {
+  const docPath = "docs/guides/MANAGEMENT-AUTH.md";
+  const content = readFileSync(docPath, "utf-8");
+
+  it("exists and has content", () => {
+    ok(content.length > 500, "should have substantial content");
+    ok(content.includes("Dashboard JWT session"));
+    ok(content.includes("CLI machine-id token"));
+    ok(content.includes("oma_"));
+  });
+
+  it("documents all four credential families", () => {
+    const families = ["Dashboard JWT", "CLI machine-id", "oma_", "Manage-scope"];
+    for (const f of families) {
+      ok(content.includes(f), `should document ${f}`);
+    }
+  });
+
+  it("mentions relevant auth header examples", () => {
+    ok(content.includes("Authorization"));
+    ok(content.includes("Bearer"));
+  });
+});

.claude/worktrees/feat-8635/changelog.d/features/8635-systemd-autostart-linux.md

@@ -0,0 +1 @@
+- **feat(infra):** add systemd autostart unit for Linux ([#8635](https://github.com/diegosouzapw/OmniRoute/issues/8635))

.claude/worktrees/feat-8635/contrib/systemd/omniroute.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=OmniRoute AI Proxy
+After=network.target network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=$(which omniroute) start
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+
+[Install]
+WantedBy=default.target

.claude/worktrees/feat-8635/tests/unit/systemd-autostart.test.ts

@@ -0,0 +1,23 @@
+import { describe, it } from "node:test";
+import { ok } from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+
+describe("Systemd autostart (#8635)", () => {
+  const svcPath = "contrib/systemd/omniroute.service";
+  const content = readFileSync(svcPath, "utf-8");
+
+  it("service file exists", () => {
+    ok(existsSync(svcPath));
+    ok(content.length > 200);
+  });
+
+  it("defines required systemd sections", () => {
+    ok(content.includes("[Unit]"));
+    ok(content.includes("[Service]"));
+    ok(content.includes("[Install]"));
+  });
+
+  it("specifies WantedBy=default.target", () => {
+    ok(content.includes("WantedBy=default.target"));
+  });
+});

.dockerignore

@@ -7,7 +7,13 @@
 **/.vscode
 
 # Dependencies and build output
+# `node_modules` alone matches the ROOT only — Docker's matcher does not cross
+# `/` like .gitignore does. Without the `**/` form, nested installs ship in the
+# build context (e.g. @omniroute/opencode-provider/node_modules, ~79 MB of
+# devDependencies). Both forms are kept: the bare one is the documented root
+# rule, the `**/` one covers every nested package.
 node_modules
+**/node_modules
 .next
 .build
 out
@@ -18,6 +24,7 @@ coverage
 # Runtime data and logs
 data
 logs
+.sandbox
 
 # Local env files (inject at runtime via --env-file or -e)
 .env
@@ -37,6 +44,17 @@ tests
 test-results
 playwright-report
 blob-report
+output
+.playwright-cli
+.playwright-mcp
+.stryker-tmp
+reports/mutation
+
+# Local caches and quality-gate artifacts (all gitignored). `_*` does not match
+# dot-prefixed names, so these need explicit entries.
+.artifacts
+.eslintcache
+.eslintcache-complexity
 
 # Documentation
 # Issue #2348: The Dashboard Docs viewer reads markdown from `/app/docs` at
@@ -49,6 +67,10 @@ blob-report
 # (English) sources at runtime, so translations are not required in the
 # container image.
 docs/i18n/**
+# Internal planning artifacts (gitignored). `*.md` above only matches the root,
+# so without this rule these land in /app/docs and become readable through the
+# dashboard's Docs viewer at runtime.
+docs/superpowers/**
 docs/diagrams/**/*.png
 docs/diagrams/**/*.jpg
 docs/diagrams/**/*.jpeg

.env.devin-bridge.example

@@ -0,0 +1,6 @@
+ENABLE_LIVE_DEVIN_TESTS=0
+DEVIN_BRIDGE_MODEL=devin-cli-agentic/swe-1-7
+DEVIN_BRIDGE_SONNET_MODEL=devin-cli-agentic/swe-1-7
+DEVIN_BRIDGE_OPUS_MODEL=devin-cli-agentic/swe-1-7
+DEVIN_BRIDGE_HAIKU_MODEL=devin-cli-agentic/swe-1-7
+DEVIN_BRIDGE_SUBAGENT_MODEL=devin-cli-agentic/swe-1-7