[pull] main from oomol-lab:main

AGENTS.md

@@ -42,6 +42,8 @@
 - User-supplied content/download URLs (e.g. `fileUrl`, `sourceUrl`, `imageUrl`) must ALWAYS be validated public-only — call `assertPublicHttpUrl` without `allowPrivateNetwork` and download them with the public-only `providerFetch`, never a private-aware `context.fetcher`. The private-network opt-in covers only the trusted instance host.
 - Prefer the shared `assertPublicHttpUrl` / `isBlockedIpAddress` over a bespoke per-provider hostname guard; bespoke guards have missed the cloud-metadata blocklist and bracketed-IPv6 forms.
 - Gotcha: a provider that branches on `fetcher === fetch` (e.g. to gate rate limiting to production) must compare against `providerFetch`, since that is the fetcher the runtime now injects — not the global `fetch`.
+- Non-fetch egress is held to the same policy. A provider that opens a WebSocket must use `openGuardedWebSocket` from `src/core/guarded-websocket.ts`, never `new WebSocket(...)` directly: it validates the target with the same `assertGuardedEgressUrl` hop check the guarded fetch uses (URL literal plus DNS resolved addresses), accepts the same `allowPrivateNetwork` / `skipDnsValidation` options, and maps `ws`/`wss` onto the `http`/`https` form the guard understands. It works on Node and on workerd, which both expose a client `WebSocket` constructor. Any future non-HTTP transport should reuse `assertGuardedEgressUrl` rather than growing a second, drifting host check.
+- The private-network opt-in only means the guard permits the target — it does not make it reachable. Cloudflare Workers cannot route to private addresses at all, so a self-hosted provider pointed at a LAN instance works on Node/Docker/Fly deployments only, regardless of `OOMOL_CONNECT_ALLOW_PRIVATE_NETWORK`.
 
 ## TypeScript And Tooling
 

README.md

@@ -15,15 +15,27 @@
 
 </div>
 
-OpenConnector is an open-source connector gateway for AI agents and an alternative to Composio.
+OpenConnector is an open-source connector gateway for AI agents and an alternative to Pipedream/Composio.
 Connect user app accounts once, then expose a shared catalog of 1,000+ providers and 10,000+
 prebuilt Actions to agents and applications.
 
-> [!IMPORTANT]
-> **Need OAuth ready to use?** [OOMOL-hosted connectors](https://oomol.com/apps) include managed OAuth
-> apps for supported providers and monthly Connect credits for roughly 15,000–20,000 calls,
-> depending on usage. Self-hosted OpenConnector includes the OAuth flow, credential storage, and
-> token refresh, but you provide your own OAuth apps.
+<table>
+  <tr>
+    <td width="33.33%" align="center"><img src="assets/deployment-options/oomol.svg" alt="OOMOL" width="140"></td>
+    <td width="33.33%" align="center"><img src="assets/deployment-options/cloudflare.svg" alt="Cloudflare" width="140"></td>
+    <td width="33.33%" align="center"><img src="assets/deployment-options/self-hosted.svg" alt="Self-hosted" width="140"></td>
+  </tr>
+  <tr>
+    <td width="33.33%" valign="top">Managed OAuth and hosted runtime, ready to use. No deployment or OAuth app setup.</td>
+    <td width="33.33%" valign="top">Run on Workers, D1, R2, and Static Assets in your Cloudflare account. You manage deployment and OAuth apps.</td>
+    <td width="33.33%" valign="top">Run locally or on your own infrastructure with Docker or Node.js. You manage storage and OAuth apps.</td>
+  </tr>
+  <tr>
+    <td width="33.33%" align="center">🚀 <a href="https://oomol.com/docs/connector-saas/"><strong>OOMOL Hosted</strong></a></td>
+    <td width="33.33%" align="center"><a href="docs/cloudflare.md"><strong>Deploy to Cloudflare</strong></a></td>
+    <td width="33.33%" align="center"><a href="https://oomol.com/docs/openconnector-self-hosting/"><strong>Self-host</strong></a></td>
+  </tr>
+</table>
 
 Use the [Connector SDK](https://github.com/oomol-lab/connector-sdk) from app code,
 [oo CLI](https://github.com/oomol-lab/oo-cli) as the local-agent relay, MCP from agent hosts,

assets/star-history/.star-history.sig

@@ -1 +1 @@
-5fce469efba1acded6c25fd254f229634b078b15f764d24a1ac20499548e172e
+56b7ab31a0c93e1bbc04856fa71a852bd37be8b6ad6b5935268f5e160e7902cb

docker-compose.yml

@@ -20,6 +20,7 @@ services:
       OOMOL_CONNECT_BLOCKED_ACTIONS:
       OOMOL_CONNECT_ALLOWED_PROXIES:
       OOMOL_CONNECT_BLOCKED_PROXIES:
+      OOMOL_CONNECT_EGRESS_TRUSTED_HOSTS:
 
 volumes:
   connector-data:

docs/README.fr.md

@@ -15,16 +15,27 @@
 
 </div>
 
-OpenConnector est un connector gateway open source pour AI agents, et une alternative à Composio.
+OpenConnector est un connector gateway open source pour AI agents, et une alternative à Pipedream/Composio.
 Connectez les comptes d'apps utilisateur une fois, puis exposez un catalog partagé de 1,000+
 providers et 10 000+ Actions prêtes à l'emploi aux agents et applications.
 
-> [!IMPORTANT]
-> **Besoin d'un OAuth prêt à l'emploi ?** Les
-> [connectors hébergés par OOMOL](https://oomol.com/apps) incluent des apps OAuth configurées pour
-> les providers pris en charge et des Connect credits mensuels représentant environ 15 000 à 20 000
-> appels gratuits selon l'utilisation. OpenConnector self-hosted prend également en charge OAuth,
-> mais vous devez enregistrer et configurer vos propres apps OAuth.
+<table>
+  <tr>
+    <td width="33.33%" align="center"><img src="../assets/deployment-options/oomol.svg" alt="OOMOL" width="140"></td>
+    <td width="33.33%" align="center"><img src="../assets/deployment-options/cloudflare.svg" alt="Cloudflare" width="140"></td>
+    <td width="33.33%" align="center"><img src="../assets/deployment-options/self-hosted.svg" alt="Auto-hébergé" width="140"></td>
+  </tr>
+  <tr>
+    <td width="33.33%" valign="top">OAuth géré et runtime hébergé, prêts à l'emploi. Aucun déploiement ni configuration d'app OAuth.</td>
+    <td width="33.33%" valign="top">Utilisez Workers, D1, R2 et Static Assets dans votre compte Cloudflare. Vous gérez le déploiement et les apps OAuth.</td>
+    <td width="33.33%" valign="top">Exécutez OpenConnector en local ou sur votre infrastructure avec Docker ou Node.js. Vous gérez le stockage et les apps OAuth.</td>
+  </tr>
+  <tr>
+    <td width="33.33%" align="center">🚀 <a href="https://oomol.com/docs/connector-saas/"><strong>OOMOL hébergé</strong></a></td>
+    <td width="33.33%" align="center"><a href="cloudflare.md"><strong>Déployer sur Cloudflare</strong></a></td>
+    <td width="33.33%" align="center"><a href="https://oomol.com/docs/openconnector-self-hosting/"><strong>Auto-héberger</strong></a></td>
+  </tr>
+</table>
 
 Utilisez le [Connector SDK](https://github.com/oomol-lab/connector-sdk) dans le code applicatif,
 [oo CLI](https://github.com/oomol-lab/oo-cli) comme relais pour les agents locaux, MCP pour les

docs/README.ja.md

@@ -15,15 +15,27 @@
 
 </div>
 
-OpenConnector は AI Agent 向けのオープンソース connector gateway であり、Composio の代替です。
+OpenConnector は AI Agent 向けのオープンソース connector gateway であり、Pipedream/Composio の代替です。
 ユーザーのアプリアカウントを一度接続すれば、1,000+ の provider と 10,000+ の事前定義済み Action を含む共有
 catalog を Agent とアプリケーションに公開できます。
 
-> [!IMPORTANT]
-> **OAuth をすぐに使いたい場合は？** [OOMOL hosted connectors](https://oomol.com/apps) には、対応
-> provider 向けに設定済みの OAuth app と、利用量に応じて約 15,000～20,000 回の無料呼び出しに相当する
-> 毎月の Connect credits が含まれます。Self-hosted OpenConnector も OAuth に対応していますが、
-> OAuth app は自身で登録、設定する必要があります。
+<table>
+  <tr>
+    <td width="33.33%" align="center"><img src="../assets/deployment-options/oomol.svg" alt="OOMOL" width="140"></td>
+    <td width="33.33%" align="center"><img src="../assets/deployment-options/cloudflare.svg" alt="Cloudflare" width="140"></td>
+    <td width="33.33%" align="center"><img src="../assets/deployment-options/self-hosted.svg" alt="セルフホスト" width="140"></td>
+  </tr>
+  <tr>
+    <td width="33.33%" valign="top">マネージド OAuth と hosted runtime をすぐに利用できます。デプロイや OAuth app の設定は不要です。</td>
+    <td width="33.33%" valign="top">Cloudflare アカウントで Workers、D1、R2、Static Assets を使用します。デプロイと OAuth app は自身で管理します。</td>
+    <td width="33.33%" valign="top">Docker または Node.js を使い、ローカル環境や自分の infrastructure で実行します。storage と OAuth app は自身で管理します。</td>
+  </tr>
+  <tr>
+    <td width="33.33%" align="center">🚀 <a href="https://oomol.com/docs/connector-saas/"><strong>OOMOL Hosted</strong></a></td>
+    <td width="33.33%" align="center"><a href="cloudflare.md"><strong>Cloudflare にデプロイ</strong></a></td>
+    <td width="33.33%" align="center"><a href="https://oomol.com/docs/openconnector-self-hosting/"><strong>セルフホスト</strong></a></td>
+  </tr>
+</table>
 
 アプリコードには [Connector SDK](https://github.com/oomol-lab/connector-sdk)、ローカル
 Agent の relay には [oo CLI](https://github.com/oomol-lab/oo-cli)、Agent host には