v0.107.0

Added

• HQ native core. 8sync hq ui now also serves a loopback JSON core (random port + token, handed to the web server as HQ_CORE / HQ_CORE_TOKEN, never passed on to rooms): the claude agents listing behind a fingerprint cache (re-run only when a session/job file changes or a room's pid dies, ≤ 30 s), 8sync ls --all rows from warm transcript digests (only appended lines are read), boards and the awake probe in process, a 5 s machine sampler (GetSystemTimes, GlobalMemoryStatusEx, Toolhelp working sets, NVML, PDH RAPL energy; Linux /proc + powercap) instead of tasklist / nvidia-smi / typeperf per request, the Hạn mức transcript scan, and the project size walk. Without the core (a next dev server) every route keeps its own probe. One client, 60 s: HQ node 5.5 → 4.0 s CPU, RSS 181 → 132 MB (plus ~1.3 s in the core), and no claude agents / tasklist / 8sync ls process per poll; office 349 → 87 ms, board 386 → 108 ms, machine 1405 → 546 ms.
• HQ sidebar: Đóng phòng / Xóa phòng. Each room row has a "⋯" menu (always shown on phones, 44 px). Đóng phòng runs claude stop (conversation kept, "Mở team" resumes it; tmux kill for hq-* rooms); Xóa phòng looks up the registry entry bound to that session first, then runs claude stop, claude rm (drops its own worktree unless it holds unpushed commits) and 8sync ccc . rm <name> from the folder whose registry holds it, which deletes the transcript, and the confirm says so. An entry it cannot remove (none found, its folder went with the worktree, rm failed) comes back as a warning toast, not a success. Both confirm with the room's state (waiting on the owner, working, stuck). POST /api/sessions/[name]/end {action}; omp rooms and terminals the owner opened are refused.
• HQ sidebar: Đóng dự án. The project "⋯" hides a project (HQ state, hidden_projects, carried on /api/office); it comes back by itself when a room waits on the owner, is stuck, or does anything after the close. "Hiện dự án đã đóng (N)" lists them with "Hiện lại", and the toast has an undo.
• HQ sidebar: Xóa worktree. For a project folder that is a git worktree (like card-113-dev under .claude/worktrees): the confirm reads git first and refuses with the reasons when a room still runs inside, it is locked, another worktree sits inside, files are uncommitted, or commits are not merged into the main branch or not pushed; never the main repo. Then git worktree remove <path> from the main worktree, never --force; the branch stays. "Đóng N phòng" in the dialog clears the live-room guard. Roots come from HQ's own project list, never from the request (GET|POST /api/projects/worktree).
• OmniRoute on the VPS at https://vps.8syncdev.com/router-ai, no port in any URL (scripts/vps/omniroute/, .github/workflows/omniroute-image.yml). Owner (2026-10-19): "cài OmniRoute lên ovh vps có trang /router-ai … auto update … auto clean rác", then "url web ovh không được lộ port".
  • Image. The workflow builds each upstream release with OMNIROUTE_BASE_PATH=/router-ai, using upstream's own publish settings (webpack, 12 GB build heap). It pushes ghcr.io/8-sync-dev/omniroute-router-ai:<tag> and :latest, daily at 01:00 VN.
  • Why a custom build. Next.js fixes basePath at build time. The upstream images' start-up patch (v3.8.51) leaves client-side links and lazy chunks at the root, so the dashboard broke under a subpath. Serving the dashboard on its own port was rejected by the owner, and DNS for a subdomain was blocked by Vercel's fair-use limit.
  • install.sh. Runs from the PC with Git Bash: it copies the files, runs setup.sh on the VPS, then runs live checks. These cover the gate on the dashboard, a 401 on the API without a key, the HQ link unchanged, and port 8444 closed.
  • setup.sh. Idempotent:
    • generates the secrets once (.env, 600);
    • starts the container: 2 GB memory, 1 GB heap, no host port;
    • adds import /sites/*.routes to the main site once and installs router-ai.routes, where /router-ai/v1/* is open (OmniRoute API keys are the lock) and the dashboard sits behind the same GitHub gate as HQ plus OmniRoute's own password;
    • validates Caddy with every real site file in a throwaway container, and restores the previous files if the reload fails;
    • retires the first install's :8444 site from the edge compose, the oauth2-proxy allowlist and ufw.
  • omniroute-update.timer (daily 04:00 VN) pulls the compose image. It tags the running image omniroute:rollback before pulling, then recreates the container. It rolls back when creation fails or the container is not healthy within 3 minutes, and it records that image id and skips it afterwards. The compose tag always ends on an image that runs.
  • vps-clean.timer (daily 04:40 VN) removes stopped containers older than 3 days, unused images and build cache older than 7 days, journald beyond 300 MB / 14 days, and the apt cache. It never touches volumes, /srv, /home or the CI caches.
  • Combo for omp. OmniRoute combo omp-manh (GLM-5.3-Flash → DeepSeek-V4-Flash → MiniMax-M2.7 → gpt-oss-20b, priority) is wired into omp as omniroute/omp-manh. All four steps share one LLM7 free key, so its daily token quota stops the whole combo. One omp turn with tools used it up in UAT (429 "Daily token quota exceeded"), so another provider is needed before agents can rely on it.
  • Referer rule. The /router-ai build still sends fetch('/api/…') and <img src="/providers/…"> without the basePath. router-ai.routes redirects page loads and rewrites fetches and images whose Referer is a /router-ai page, and leaves /sw.js alone so the PWA worker never takes scope / over HQ. A fresh login lands on /router-ai/home with 67 requests and none failing.
  • Shared lock. The update and cleanup scripts share /run/lock/8sync-docker.lock.
  • Claude. Claude models resold by others (LLM7 claude-*) are hidden. omp's OmniRoute key is limited to the free LLM7 models and combos; any other model returns 403.
  • Owner guide: Downloads/OmniRoute-huong-dan.pdf.

Changed

• Lead merges stacked PRs in order. The lead's approved-card step (BACKLOG_FIRST) never merges into a base other than main. Once the root PR is on main, it runs gh pr edit <pr> --base main and merges; otherwise it merges the root first. UAT on ai-game-studio found 13 open PRs based on other branches, and PR 103 merged into card-125-ui-palette instead of main. That repo also gets delete_branch_on_merge, so GitHub retargets dependent PRs when a base merges.
• omp team on any non-Claude model: 8sync ccc auto omp on --model <provider/model> (also --omp-model on auto on --omp / auto up --omp) stores the team model in auto.json; the team is blocked only when that model (else omp's default) is anthropic/…, so an omniroute/<combo> team runs while the owner's omp default stays a Claude login. Rooms open with 8sync . omp-<role> --model <m> (new --model on 8sync . <name>); auto status --json adds omp_model. The omp extension sends its live model to auto nudge --model; a room on anthropic/… gets no nudge, and a nudge without --model is still judged by omp's global default.
  • The whole session runs on that model. A session started with --model gets the same model for --smol, --slow and --plan, and no --advisor. Before this, the launch added 8sync's role flags (--plan opus --slow opus) and the advisor, which runs on omp's modelRoles.advisor (anthropic/claude-opus-5-5:max). A room "on" OmniRoute would have sent part of its calls to the Claude login. Checked on the real omp command line.

---

Install or update: curl -fsSL https://get.8syncdev.com/install | sh · 8sync up · then 8sync ccc kit

What's Changed

• v0.107.0: HQ native core, sidebar close/delete, omp team model, OmniRoute /router-ai by @8syncdev in #127

Full Changelog: v0.106.0...v0.107.0