SRouter v0.1.2

SRouter v0.1.2

SRouter v0.1.2 introduces built-in Cloudflare Tunnel management directly from the web dashboard, hardened API security for public/remote deployments, centralized version constants across the monorepo, zero-cost rate evaluation for free model tiers, and critical SQLite concurrency stability fixes.

---

🚀 Key Highlights & New Features

🌐 Built-in Cloudflare Tunnel Management

• One-Click Zero Trust Expose: Manage Cloudflare Tunnels directly from the control plane dashboard without manual CLI setup.
• Automated Daemon Lifecycle: Automated installation for the cloudflared binary, real-time connection status via Server-Sent Events (SSE), and automatic background tunnel restart on server boot.
• Security Guardrails: Tunnel installation and status modification endpoints are guarded by adminAuth.

🛡️ Security Hardening & Public API Protection

• Mandatory Virtual API Key for Remote Traffic: Requests originating outside loopback (127.0.0.1 / ::1) strictly require a valid virtual key (sr-live-*), closing unauthorized access vectors when SRouter is exposed publicly.
• SSRF Attack Guard: Provider endpoint verification rejects internal cloud metadata endpoints (169.254.169.254, metadata.google.internal, instance-data) and local loopback/private subnets.
• Security Headers & Sanitized CORS: Implemented default HTTP security headers (X-Powered-By: Seaavey, X-Version, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, X-XSS-Protection, Referrer-Policy) and tightened CORS origin reflection when credentials: true.
• Loopback OAuth Server: OAuth callback server on port 1455 binds to 127.0.0.1 by default.

💰 Zero-Cost Pricing for Free Model Tiers

• Models with names or tags including :free, /free, or -free (e.g. OpenCode Zen free tier, OpenRouter free models, DeepSeek R1 free) are automatically calculated at $0.00 / token across all token types in quota and cost logs.

🧩 Centralized Version Constants

• Replaced fragmented version literals with single-source-of-truth constants in @srouter/constants (GLOBAL_VERSION, APP_VERSION, API_VERSION, CLI_VERSION).

⚡ Optimized CI/CD Workflow

• Docker multi-arch GHCR publishing pipeline now evaluates release tags and automatically skips costly image builds for pre-release / Release Candidate (-rc) versions.

---

🛠️ Bug Fixes & Improvements

• SQLite Concurrency Resilience: Handled table schema migration race conditions to tolerate duplicate column additions during concurrent multi-process initialization.
• Loopback Spoofing Elimination: Removed untrusted Host header fallbacks in client IP discovery.
• Topbar UI Polish: Streamlined top navigation bar by removing redundant logout trigger.
• Modular In-Repo Agent Skills: Divided legacy monolithic guide into targeted skills: SRouter-API, SRouter-APP, and SRouter-CLI.

---

🔗 Pull Requests & Related Changes

• #36 — feat(tunnel): built-in Cloudflare Tunnel management with token auth and custom domain by @seaavey
• #35 — feat(security): harden public API access and add security headers by @seaavey
• Commit 6e6e19c — feat(pricing): resolve free models to 0 cost rate by @seaavey
• Commit 19c423c — refactor(constants): provide GLOBAL_VERSION, APP_VERSION, API_VERSION, and CLI_VERSION by @seaavey
• Commit 8f693cc — ci(ghcr): separate check-version job to cleanly skip build on rc releases by @seaavey

---

👥 Contributors & Special Thanks

Special thanks to all contributors who helped build and test this release:

• @seaavey (Muhammad Adriansyah)

---

🐳 Docker Container & Assets

Production container images for amd64 and arm64 are available via GitHub Container Registry (GHCR):

# Pull latest stable v0.1.2 release
docker pull ghcr.io/seaavey/srouter:0.1.2
docker pull ghcr.io/seaavey/srouter:latest

# Run with persistent volume
docker run -d \
  --name srouter \
  -p 3000:3000 \
  -p 1455:1455 \
  -v srouter_data:/app/data \
  ghcr.io/seaavey/srouter:0.1.2

---

Full Changelog: v0.1.1...v0.1.2