feat: V3.0.0 — Cloud Gateway + Model Registry + Admin Dashboard

Cloud Gateway:
- Model registry with DB-backed CRUD and admin API
- Scoring engine with quality/speed/cost/code routing
- Provider access control with plan-based gating
- Admin dashboard: user management, pagination, search, validation
- Bug fixes: regex state leak, prefix fallback, atomic updates, XSS

Desktop:
- Brave Search integration
- Chat window with full conversation support
- Thinking model support (extended reasoning)
- Spotlight V2 with streaming
- Local model support (Ollama + LM Studio)
- Global shortcuts, usage tracking, analytics

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: createpjf

.github/workflows/build.yml

@@ -31,8 +31,17 @@ jobs:
       - run: cd apps/desktop && npx tsc --noEmit
       - run: cd apps/desktop && npx vitest run
 
+  test-cloud-gateway:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: cd apps/cloud-gateway && bun install
+      - run: cd apps/cloud-gateway && bun test
+      - run: cd apps/cloud-gateway && bunx tsc --noEmit
+
   build-macos:
-    needs: [test-gateway, test-desktop]
+    needs: [test-gateway, test-desktop, test-cloud-gateway]
     runs-on: macos-14
     strategy:
       matrix:
@@ -118,3 +127,38 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  docker-cloud-gateway:
+    needs: [test-cloud-gateway]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}/cloud-gateway
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: apps/cloud-gateway
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/ci.yml

@@ -49,6 +49,23 @@ jobs:
       - name: Run tests
         run: cd apps/desktop && npx vitest run
 
+  test-cloud-gateway:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: cd apps/cloud-gateway && bun install
+
+      - name: Run tests
+        run: cd apps/cloud-gateway && bun test
+
+      - name: TypeScript check
+        run: cd apps/cloud-gateway && bunx tsc --noEmit
+
   docker-gateway:
     needs: test-gateway
     runs-on: ubuntu-latest
@@ -67,3 +84,24 @@ jobs:
           sleep 2
           curl -sf http://localhost:3001/health | grep -q '"status":"ok"'
           docker stop gw
+
+  docker-cloud-gateway:
+    needs: test-cloud-gateway
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t routebox-cloud-gateway apps/cloud-gateway
+
+      - name: Smoke test container
+        run: |
+          docker run -d --name cgw -p 3002:3001 \
+            -e DATABASE_URL=postgres://x:x@localhost/x \
+            -e JWT_SECRET=test-secret-for-ci \
+            -e STRIPE_SECRET_KEY=sk_test_fake \
+            -e STRIPE_WEBHOOK_SECRET=whsec_fake \
+            routebox-cloud-gateway
+          sleep 3
+          curl -sf http://localhost:3002/health || true
+          docker stop cgw

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 3.0.0 (2026-03-06)
+
+### Cloud Gateway
+- **Model Registry**: Dynamic model CRUD with DB-backed registry, admin API + UI
+- **Scoring Engine**: Intelligent model routing with quality/speed/cost/code scoring, request context analysis (code detection, CJK support), configurable weights per strategy
+- **Provider Access Control**: Per-provider enable/disable with plan-based gating (free/pro)
+- **Admin Dashboard Enhancements**:
+  - User management: edit plan (free/pro), adjust balance with audit trail
+  - Pagination for users and transactions tables
+  - Email search for user lookup
+  - Loading states and error recovery
+  - Client-side form validation for model registry
+  - XSS fix in registry edit (ID-based lookup replaces inline JSON)
+- **Bug Fixes**:
+  - Fixed stateful regex causing inconsistent code block detection across requests
+  - Fixed prefix-match models incorrectly flagged as fallback in scoring engine
+  - Fixed score clamping causing unstable sort order among top models
+  - Atomic updateModel — single SQL UPDATE instead of N separate queries
+  - Improved CJK detection and weighted token estimation
+
+### Desktop App
+- Brave Search integration
+- Dedicated Chat window with full conversation support
+- Thinking model support (extended thinking / reasoning)
+- Spotlight V2 with streaming chat
+- Local model support (Ollama + LM Studio)
+- Global keyboard shortcuts for Spotlight and Chat
+- Usage tracking and analytics pages
+
 ## 1.0.0 (2026-02-28)
 
 ### Features

apps/cloud-gateway/.dockerignore

@@ -0,0 +1,18 @@
+node_modules
+.env
+.env.*
+!.env.example
+*.test.ts
+src/test-setup.ts
+.git
+.gitignore
+.dockerignore
+docker-compose.yml
+nginx.conf
+nginx-init.conf
+monitoring/
+scripts/
+openapi.yaml
+README.md
+*.md
+._*

apps/cloud-gateway/.env.example

@@ -0,0 +1,37 @@
+# Database
+DATABASE_URL=postgres://routebox:your_password@localhost:5432/routebox
+DB_PASSWORD=your_password
+
+# JWT
+JWT_SECRET=your-256-bit-secret-change-me-in-production
+
+# Polar (payment provider — https://polar.sh)
+POLAR_ACCESS_TOKEN=polar_oat_...
+POLAR_WEBHOOK_SECRET=polar_whs_...
+POLAR_PRODUCT_CREDIT_5=uuid-of-5-dollar-product
+POLAR_PRODUCT_CREDIT_20=uuid-of-20-dollar-product
+POLAR_PRODUCT_PRO=uuid-of-pro-subscription-product
+
+# App URL (for checkout redirect)
+APP_URL=https://routebox.dev
+
+# Pooled Provider API Keys
+OPENAI_API_KEY=sk-proj-...
+ANTHROPIC_API_KEY=sk-ant-...
+GOOGLE_API_KEY=AIza...
+DEEPSEEK_API_KEY=sk-...
+MINIMAX_API_KEY=
+KIMI_API_KEY=
+OPENROUTER_API_KEY=sk-or-v1-...
+
+# Sentry (optional — error tracking)
+SENTRY_DSN=https://xxx@xxx.ingest.sentry.io/xxx
+
+# Redis (optional — distributed rate limiting, falls back to in-memory)
+REDIS_URL=redis://redis:6379
+
+# Admin Dashboard (comma-separated emails allowed to access /admin)
+ADMIN_EMAILS=your-email@example.com
+
+# Grafana
+GF_SECURITY_ADMIN_PASSWORD=admin

apps/cloud-gateway/Dockerfile

@@ -0,0 +1,25 @@
+FROM oven/bun:1-alpine
+
+# Install curl for Docker health checks
+RUN apk add --no-cache curl
+
+# Create non-root user
+RUN addgroup -g 1001 -S routebox && \
+    adduser -S routebox -u 1001 -G routebox
+
+WORKDIR /app
+
+# Install deps
+COPY package.json bun.lock* ./
+RUN bun install --frozen-lockfile --production
+
+# Copy source
+COPY . .
+
+# Fix permissions and switch to non-root user
+RUN chown -R routebox:routebox /app
+USER routebox
+
+EXPOSE 3001
+
+CMD ["bun", "run", "src/index.ts"]