blackriver-gateway 3.8.46

package/src/shared/constants/sidebarVisibility/types.ts

@@ -0,0 +1,161 @@
+export const HIDEABLE_SIDEBAR_ITEM_IDS = [
+  // Home
+  "home",
+  // OmniProxy — flat
+  "api-manager",
+  "endpoints",
+  "providers",
+  "embedded-services",
+  "combos",
+  "combos-live",
+  "quota",
+  // OmniProxy > Compression Context (Settings → Combos → engines → Studio)
+  "context-settings",
+  "context-combos",
+  "context-caveman",
+  "context-rtk",
+  "context-headroom",
+  "context-session-dedup",
+  "context-ccr",
+  "context-llmlingua",
+  "context-lite",
+  "context-aggressive",
+  "context-ultra",
+  "compression-studio",
+  // OmniProxy > Tools
+  "cli-code",
+  "cli-agents",
+  "acp-agents",
+  "cloud-agents",
+  "agent-bridge",
+  "traffic-inspector",
+  "discovery",
+  // OmniProxy > Integrations
+  "api-endpoints",
+  "webhooks",
+  // OmniProxy — proxy
+  "proxy",
+  "mitm-proxy",
+  "1proxy",
+  // Analytics
+  "analytics",
+  "analytics-combo-health",
+  "analytics-utilization",
+  "costs",
+  "cache",
+  "analytics-compression",
+  "analytics-search",
+  "analytics-evals",
+  "provider-stats",
+  // Monitoring — flat
+  "activity",
+  "logs",
+  "logs-proxy",
+  "logs-console",
+  "logs-activity",
+  "health",
+  "runtime",
+  // Costs section
+  "costs-pricing",
+  "costs-budget",
+  "costs-free-tiers",
+  "costs-quota-share",
+  "free-provider-rankings",
+  // Monitoring > Audit
+  "audit",
+  "audit-mcp",
+  "audit-a2a",
+  // Dev Tools
+  "translator",
+  "playground",
+  "search-tools",
+  // Agentic Features
+  "memory",
+  "skills",
+  "agent-skills",
+  "mcp",
+  "a2a",
+  "plugins",
+  // Gamification
+  "leaderboard",
+  "profile",
+  "tokens",
+  // Other Features — flat
+  "media",
+  // Other Features > Batch
+  "batch",
+  "batch-files",
+  // Configuration
+  "settings-general",
+  "settings-appearance",
+  "settings-ai",
+  "settings-routing",
+  "settings-resilience",
+  "settings-advanced",
+  "settings-security",
+  "settings-access-tokens",
+  "settings-feature-flags",
+  "settings-sidebar",
+  // Help
+  "docs",
+  "issues",
+  "changelog",
+] as const;
+
+export type HideableSidebarItemId = (typeof HIDEABLE_SIDEBAR_ITEM_IDS)[number];
+
+export type SidebarSectionId =
+  | "home"
+  | "omni-proxy"
+  | "analytics"
+  | "costs"
+  | "monitoring"
+  | "devtools"
+  | "agentic-features"
+  | "other-features"
+  | "configuration"
+  | "help";
+
+export interface SidebarItemDefinition {
+  id: HideableSidebarItemId;
+  href: string;
+  i18nKey: string;
+  subtitleKey?: string;
+  /** Literal label shown when `i18nKey` has no translation (avoids per-locale edits). */
+  labelFallback?: string;
+  /** Literal subtitle shown when `subtitleKey` is absent/untranslated. */
+  subtitleFallback?: string;
+  icon: string;
+  exact?: boolean;
+  external?: boolean;
+}
+
+export interface SidebarItemGroup {
+  type: "group";
+  id: string;
+  titleKey: string;
+  titleFallback: string;
+  items: readonly SidebarItemDefinition[];
+}
+
+export type SidebarSectionChild = SidebarItemDefinition | SidebarItemGroup;
+
+export interface SidebarSectionDefinition {
+  id: SidebarSectionId;
+  titleKey: string;
+  titleFallback: string;
+  children: readonly SidebarSectionChild[];
+  showTitle?: boolean;
+  visibility?: "always" | "debug";
+  defaultPinned?: boolean;
+}
+
+export type SidebarPresetId = "all" | "minimal" | "developer" | "admin";
+
+export interface SidebarPresetDefinition {
+  id: SidebarPresetId;
+  icon: string;
+  hiddenItems: HideableSidebarItemId[];
+}
+
+export type SidebarItemOrder = Partial<Record<SidebarSectionId, string[]>>;

package/src/shared/constants/sidebarVisibility.ts

@@ -0,0 +1,291 @@
+export * from "./sidebarVisibility/types";
+export { COMPRESSION_CONTEXT_GROUP, SIDEBAR_SECTIONS } from "./sidebarVisibility/sections";
+
+import { HIDEABLE_SIDEBAR_ITEM_IDS } from "./sidebarVisibility/types";
+import type {
+  HideableSidebarItemId,
+  SidebarSectionId,
+  SidebarItemDefinition,
+  SidebarSectionChild,
+  SidebarSectionDefinition,
+  SidebarPresetDefinition,
+} from "./sidebarVisibility/types";
+
+export const SIDEBAR_ICON_ACCENTS: Partial<Record<HideableSidebarItemId, string>> = {
+  home: "#60A5FA",
+  "api-manager": "#F59E0B",
+  endpoints: "#38BDF8",
+  providers: "#818CF8",
+  combos: "#A855F7",
+  quota: "#F472B6",
+  "context-caveman": "#F97316",
+  "context-rtk": "#2DD4BF",
+  "context-combos": "#C084FC",
+  "cli-code": "#FACC15",
+  "cli-agents": "#93C5FD",
+  "cloud-agents": "#7DD3FC",
+  "api-endpoints": "#14B8A6",
+  webhooks: "#EC4899",
+  proxy: "#A3E635",
+  "mitm-proxy": "#FB7185",
+  "1proxy": "#22D3EE",
+  analytics: "#06B6D4",
+  "analytics-combo-health": "#34D399",
+  "analytics-utilization": "#FBBF24",
+  costs: "#FB923C",
+  cache: "#84CC16",
+  "analytics-compression": "#F97316",
+  "analytics-search": "#38BDF8",
+  "analytics-evals": "#A78BFA",
+  logs: "#CBD5E1",
+  "logs-proxy": "#A3E635",
+  "logs-console": "#FACC15",
+  "logs-activity": "#60A5FA",
+  health: "#EF4444",
+  runtime: "#F59E0B",
+  "costs-pricing": "#FB923C",
+  "costs-budget": "#22C55E",
+  "costs-quota-share": "#06B6D4",
+  audit: "#F43F5E",
+  "audit-mcp": "#818CF8",
+  "audit-a2a": "#A855F7",
+  translator: "#3B82F6",
+  playground: "#EAB308",
+  "search-tools": "#0891B2",
+  memory: "#10B981",
+  skills: "#F43F5E",
+  "agent-skills": "#D946EF",
+  mcp: "#8B5CF6",
+  a2a: "#06B6D4",
+  leaderboard: "#FACC15",
+  profile: "#60A5FA",
+  tokens: "#A3E635",
+  media: "#D946EF",
+  batch: "#14B8A6",
+  "batch-files": "#38BDF8",
+  "settings-general": "#64748B",
+  "settings-appearance": "#D946EF",
+  "settings-ai": "#A78BFA",
+  "settings-routing": "#06B6D4",
+  "settings-resilience": "#22C55E",
+  "settings-advanced": "#F97316",
+  "settings-security": "#EF4444",
+  "settings-feature-flags": "#FACC15",
+  "settings-sidebar": "#38BDF8",
+  docs: "#2563EB",
+  issues: "#DC2626",
+  changelog: "#F59E0B",
+};
+
+export const SIDEBAR_SUBITEM_ICON_ACCENTS: Record<string, string> = {};
+
+function getDeterministicIconAccent(id: string): string {
+  let hash = 0;
+  for (let index = 0; index < id.length; index += 1) {
+    hash = (hash * 31 + id.charCodeAt(index)) >>> 0;
+  }
+  const hue = hash % 360;
+  const saturation = 72;
+  const lightness = 56;
+  const chroma = (1 - Math.abs((2 * lightness) / 100 - 1)) * (saturation / 100);
+  const huePrime = hue / 60;
+  const x = chroma * (1 - Math.abs((huePrime % 2) - 1));
+  const match = lightness / 100 - chroma / 2;
+  const [red, green, blue] =
+    huePrime < 1
+      ? [chroma, x, 0]
+      : huePrime < 2
+        ? [x, chroma, 0]
+        : huePrime < 3
+          ? [0, chroma, x]
+          : huePrime < 4
+            ? [0, x, chroma]
+            : huePrime < 5
+              ? [x, 0, chroma]
+              : [chroma, 0, x];
+
+  return [red, green, blue]
+    .map((channel) =>
+      Math.round((channel + match) * 255)
+        .toString(16)
+        .padStart(2, "0")
+        .toUpperCase()
+    )
+    .join("")
+    .replace(/^/, "#");
+}
+
+export function getSidebarIconAccent(id: string): string {
+  return (
+    SIDEBAR_ICON_ACCENTS[id as HideableSidebarItemId] ||
+    SIDEBAR_SUBITEM_ICON_ACCENTS[id] ||
+    getDeterministicIconAccent(id)
+  );
+}
+
+export function getSectionItems(
+  section: SidebarSectionDefinition | { children: readonly SidebarSectionChild[] }
+): readonly SidebarItemDefinition[] {
+  return section.children.flatMap((child) =>
+    "type" in child && child.type === "group" ? child.items : [child as SidebarItemDefinition]
+  );
+}
+
+// ─── Ordering & preset setting keys ──────────────────────────────────────────
+
+export const HIDDEN_SIDEBAR_ITEMS_SETTING_KEY = "hiddenSidebarItems";
+export const SIDEBAR_SECTION_ORDER_KEY = "sidebarSectionOrder";
+export const SIDEBAR_ITEM_ORDER_KEY = "sidebarItemOrder";
+export const SIDEBAR_PRESET_KEY = "sidebarActivePreset";
+export const SIDEBAR_SETTINGS_UPDATED_EVENT = "omniroute:settings-updated";
+
+const MINIMAL_SHOWN: ReadonlySet<HideableSidebarItemId> = new Set([
+  "home",
+  "endpoints",
+  "api-manager",
+  "providers",
+  "combos",
+  "analytics",
+  "costs",
+  "logs",
+  "health",
+  "settings-general",
+  "settings-sidebar",
+  "docs",
+  "changelog",
+]);
+
+const DEVELOPER_SHOWN: ReadonlySet<HideableSidebarItemId> = new Set([
+  "home",
+  "endpoints",
+  "api-manager",
+  "providers",
+  "combos",
+  "quota",
+  "context-caveman",
+  "context-rtk",
+  "context-combos",
+  "cli-code",
+  "cli-agents",
+  "acp-agents",
+  "api-endpoints",
+  "analytics",
+  "analytics-combo-health",
+  "costs",
+  "cache",
+  "logs",
+  "health",
+  "runtime",
+  "translator",
+  "playground",
+  "memory",
+  "skills",
+  "mcp",
+  "a2a",
+  "settings-general",
+  "settings-routing",
+  "settings-resilience",
+  "settings-sidebar",
+  "docs",
+  "issues",
+  "changelog",
+]);
+
+const ADMIN_SHOWN: ReadonlySet<HideableSidebarItemId> = new Set([
+  "home",
+  "endpoints",
+  "api-manager",
+  "providers",
+  "combos",
+  "quota",
+  "analytics",
+  "analytics-combo-health",
+  "analytics-utilization",
+  "costs",
+  "costs-pricing",
+  "costs-budget",
+  "costs-quota-share",
+  "cache",
+  "logs",
+  "activity",
+  "health",
+  "runtime",
+  "audit",
+  "audit-mcp",
+  "audit-a2a",
+  "settings-general",
+  "settings-routing",
+  "settings-resilience",
+  "settings-security",
+  "settings-access-tokens",
+  "settings-feature-flags",
+  "settings-sidebar",
+  "docs",
+  "changelog",
+]);
+
+function buildHiddenList(shown: ReadonlySet<HideableSidebarItemId>): HideableSidebarItemId[] {
+  return HIDEABLE_SIDEBAR_ITEM_IDS.filter((id) => !shown.has(id));
+}
+
+export const SIDEBAR_PRESETS: readonly SidebarPresetDefinition[] = [
+  { id: "all", icon: "select_all", hiddenItems: [] },
+  { id: "minimal", icon: "minimize", hiddenItems: buildHiddenList(MINIMAL_SHOWN) },
+  { id: "developer", icon: "code", hiddenItems: buildHiddenList(DEVELOPER_SHOWN) },
+  { id: "admin", icon: "admin_panel_settings", hiddenItems: buildHiddenList(ADMIN_SHOWN) },
+];
+
+// ─── Ordering utilities ───────────────────────────────────────────────────────
+
+export function applySectionOrder(
+  sections: readonly SidebarSectionDefinition[],
+  order: SidebarSectionId[]
+): SidebarSectionDefinition[] {
+  if (order.length === 0) return [...sections];
+  const knownIds = new Set(sections.map((s) => s.id));
+  const validOrder = order.filter((id) => knownIds.has(id));
+  const orderMap = new Map(validOrder.map((id, i) => [id, i]));
+  return [...sections].sort((a, b) => {
+    const ai = orderMap.get(a.id) ?? validOrder.length + sections.indexOf(a);
+    const bi = orderMap.get(b.id) ?? validOrder.length + sections.indexOf(b);
+    return ai - bi;
+  });
+}
+
+export function applyItemOrder(
+  children: readonly SidebarSectionChild[],
+  order: string[]
+): SidebarSectionChild[] {
+  if (order.length === 0) return [...children];
+  const getChildId = (c: SidebarSectionChild): string =>
+    "type" in c && c.type === "group" ? c.id : (c as SidebarItemDefinition).id;
+  const knownIds = new Set(children.map(getChildId));
+  const validOrder = order.filter((id) => knownIds.has(id));
+  const orderMap = new Map(validOrder.map((id, i) => [id, i]));
+  return [...children].sort((a, b) => {
+    const aId = getChildId(a);
+    const bId = getChildId(b);
+    const ai = orderMap.get(aId) ?? validOrder.length + children.indexOf(a);
+    const bi = orderMap.get(bId) ?? validOrder.length + children.indexOf(b);
+    return ai - bi;
+  });
+}
+
+// ─── Settings helpers ─────────────────────────────────────────────────────────
+
+export function normalizeHiddenSidebarItems(value: unknown): HideableSidebarItemId[] {
+  if (!Array.isArray(value)) return [];
+
+  const hiddenItems = new Set<HideableSidebarItemId>();
+
+  for (const item of value) {
+    if (
+      typeof item === "string" &&
+      HIDEABLE_SIDEBAR_ITEM_IDS.includes(item as HideableSidebarItemId)
+    ) {
+      hiddenItems.add(item as HideableSidebarItemId);
+    }
+  }
+
+  return HIDEABLE_SIDEBAR_ITEM_IDS.filter((item) => hiddenItems.has(item));
+}

package/src/shared/constants/spawnCapablePrefixes.ts

@@ -0,0 +1,35 @@
+/**
+ * Compile-time deny-list: route prefixes whose handlers can spawn arbitrary local
+ * subprocesses (npm install, node, MITM server, python CLIs) on behalf of the
+ * caller. These MUST NEVER appear in the manage-scope bypass list — regardless of
+ * DB state — because reaching them from non-loopback would re-introduce the
+ * GHSA-fhh6-4qxv-rpqj surface that the LOCAL_ONLY tier exists to close.
+ *
+ * Enforced at two layers:
+ *   1. zod schema (`settingsSchemas.ts`): rejects `PATCH /api/settings` with error
+ *      code `BYPASS_PREFIX_NOT_ALLOWED` if any entry in
+ *      `localOnlyManageScopeBypassPrefixes` falls inside this set.
+ *   2. runtime (`isLocalOnlyBypassableByManageScope` in `routeGuard.ts`): even if a
+ *      malformed DB row claims a spawn-capable path is bypassable, the policy refuses.
+ *
+ * 🔒 This constant lives in `@/shared/constants` — a server-free leaf module — and
+ * NOT in `@/server/authz/routeGuard`, on purpose. `settingsSchemas.ts` is reachable
+ * from client components (dashboard onboarding wizard → validation barrel), and
+ * importing it from `routeGuard.ts` dragged routeGuard's server runtime
+ * (runtimeSettings → localDb → apiKeys → rateLimiter → ioredis) into the browser
+ * bundle, breaking the Next CLI/client webpack build with
+ * `Module not found: Can't resolve 'dns'/'net'`. Keeping the value here lets both the
+ * client-safe schema and the server routeGuard import it with no server coupling.
+ * Regression guard: `tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts`.
+ * Hard Rules #15 + #17.
+ */
+export const SPAWN_CAPABLE_PREFIXES: ReadonlyArray<string> = [
+  "/api/cli-tools/runtime/",
+  "/api/services/", // T-10: can run npm install + spawn node processes
+  "/api/tools/agent-bridge/", // start/stop MITM server + DNS edits (Hard Rules #15 + #17)
+  "/api/tools/traffic-inspector/", // http-proxy listener + system proxy (Hard Rules #15 + #17)
+  "/api/plugins/", // plugins: load/execute via worker_threads + child_process (Hard Rules #15 + #17)
+  "/api/local/", // T-12: 1-click local service launchers (Redis today) — must never be whitelistable via manage-scope bypass (Hard Rules #15 + #17)
+  "/api/headroom/start", // spawns headroom-ai python CLI — must never be bypassable (Hard Rules #15 + #17)
+  "/api/headroom/stop", // kills tracked PID — must never be bypassable (Hard Rules #15 + #17)
+];

package/src/shared/constants/statusColors.ts

@@ -0,0 +1,17 @@
+/**
+ * Canonical status colors — single source of truth for status HEX, mirroring the
+ * semantic tokens in `src/app/globals.css` (--color-success / --color-warning /
+ * --color-error). Previously these same hex values were copy-pasted across several
+ * components (flow edge styles, token-health badge, cascade nodes…); this module
+ * collapses them to one place.
+ *
+ * Use these HEX values ONLY where a CSS class can't reach — canvas, ReactFlow SVG
+ * strokes, or inline styles on third-party nodes. For normal DOM, prefer the Tailwind
+ * utilities (`text-success`, `bg-error/10`, …) which already read the same tokens.
+ */
+export const STATUS_HEX = {
+  success: "#22c55e",
+  warning: "#f59e0b",
+  error: "#ef4444",
+  muted: "#6b7280",
+} as const;

package/src/shared/constants/upstreamHeaders.ts

@@ -0,0 +1,42 @@
+/**
+ * User-supplied upstream extra headers: names we never forward (Host / hop-by-hop / framing).
+ * Changing this list requires syncing: `sanitizeUpstreamHeadersMap` (models.ts), Zod
+ * `upstreamHeaderNameSchema` / record refine (schemas.ts), and `upstream-headers-sanitize` tests.
+ */
+const FORBIDDEN = new Set(
+  [
+    "host",
+    "connection",
+    "content-length",
+    "keep-alive",
+    "proxy-connection",
+    "transfer-encoding",
+    "te",
+    "trailer",
+    "upgrade",
+  ].map((s) => s.toLowerCase())
+);
+
+export function isForbiddenUpstreamHeaderName(name: string): boolean {
+  return FORBIDDEN.has(String(name).trim().toLowerCase());
+}
+
+/**
+ * Auth headers that must come from the connection's credentials, never from
+ * operator-set per-provider custom headers. Kept here as the single source of
+ * truth so the Zod `customHeadersSchema` (schemas.ts) and the executor's
+ * apply-loop (open-sse/executors/default.ts) cannot drift apart.
+ */
+const FORBIDDEN_AUTH = new Set(
+  ["authorization", "x-api-key", "x-goog-api-key", "api-key", "cookie"].map((s) => s.toLowerCase())
+);
+
+/**
+ * Forbidden for operator-supplied custom headers: the hop-by-hop/framing set
+ * PLUS auth headers (owned by the credential layer). Use this in both the
+ * validation schema and the executor so there is one canonical denylist.
+ */
+export function isForbiddenCustomHeaderName(name: string): boolean {
+  const n = String(name).trim().toLowerCase();
+  return isForbiddenUpstreamHeaderName(n) || FORBIDDEN_AUTH.has(n);
+}

package/src/shared/constants/visionBridgeDefaults.ts

@@ -0,0 +1,88 @@
+/**
+ * Vision Bridge default configuration values.
+ */
+
+const FORCED_VISION_BRIDGE_MODELS = new Set<string>([
+  // opencode-go/opencode-zen providers: synced capabilities overstate vision support
+  // (modalities_input includes "image" from provider catalog), but the actual backend
+  // models used by these providers do not have native vision. Force Vision Bridge to
+  // convert images to text descriptions for these models.
+  "opencode-go/deepseek-v4-flash",
+  "opencode-go/deepseek-v4-pro",
+  "opencode-go/kimi-k2.6",
+  "opencode-go/kimi-k2.5",
+  "opencode-go/glm-5.1",
+  "opencode-go/glm-5",
+  "opencode-go/qwen3.6-plus",
+  "opencode-go/qwen3.5-plus",
+  "opencode-zen/deepseek-v4-flash",
+  "opencode-zen/deepseek-v4-pro",
+  // tokenrouter provider: upstream models overstate vision support.
+  // Force Vision Bridge so images are routed through the configured
+  // vision model instead of being passed through to text-only backends.
+  "tokenrouter/deepseek-v4-pro",
+  "tokenrouter/deepseek-v4-flash",
+]);
+
+export function isVisionBridgeForcedModel(model: string | null | undefined): boolean {
+  if (!model) return false;
+  const lowerModel = model.trim().toLowerCase();
+  if (FORCED_VISION_BRIDGE_MODELS.has(lowerModel)) return true;
+  // Also check just the model name (after /) for backward compatibility
+  const normalizedModel = lowerModel.includes("/")
+    ? lowerModel.split("/").pop() || lowerModel
+    : lowerModel;
+  return FORCED_VISION_BRIDGE_MODELS.has(normalizedModel);
+}
+
+export const VISION_BRIDGE_DEFAULTS = {
+  enabled: true,
+  model: "openai/gpt-4o-mini",
+  prompt:
+    "Describe this image concisely in 2-3 sentences. Focus on the most relevant visual details.",
+  timeoutMs: 30000,
+  maxImagesPerRequest: 10,
+} as const;
+
+/**
+ * Settings keys for Vision Bridge (to be stored in key_value table).
+ */
+export const VISION_BRIDGE_SETTINGS_KEYS = [
+  "visionBridgeEnabled",
+  "visionBridgeModel",
+  "visionBridgePrompt",
+  "visionBridgeTimeout",
+  "visionBridgeMaxImages",
+] as const;
+
+export type VisionBridgeSettings = {
+  visionBridgeEnabled?: boolean;
+  visionBridgeModel?: string;
+  visionBridgePrompt?: string;
+  visionBridgeTimeout?: number;
+  visionBridgeMaxImages?: number;
+};
+
+export type VisionBridgeConfig = {
+  enabled: boolean;
+  model: string;
+  prompt: string;
+  timeoutMs: number;
+  maxImages: number;
+};
+
+/**
+ * Merge settings with defaults to produce a complete config.
+ */
+export function getVisionBridgeConfig(
+  settings: VisionBridgeSettings | undefined | null = {}
+): VisionBridgeConfig {
+  const s = settings ?? {};
+  return {
+    enabled: s.visionBridgeEnabled ?? VISION_BRIDGE_DEFAULTS.enabled,
+    model: s.visionBridgeModel ?? VISION_BRIDGE_DEFAULTS.model,
+    prompt: s.visionBridgePrompt ?? VISION_BRIDGE_DEFAULTS.prompt,
+    timeoutMs: s.visionBridgeTimeout ?? VISION_BRIDGE_DEFAULTS.timeoutMs,
+    maxImages: s.visionBridgeMaxImages ?? VISION_BRIDGE_DEFAULTS.maxImagesPerRequest,
+  };
+}