lint

Fix provider forwarding upstream

routstr/balance.py

@@ -211,8 +211,20 @@ async def _refund_cache_set(authorization: str, value: dict[str, str]) -> None:
         _refund_cache[key] = (expiry, value)
 
 
+async def _lookup_key_no_create(
+    bearer_value: str, session: AsyncSession
+) -> ApiKey | None:
+    """Look up an existing API key without creating one Used by the refund endpoint"""
+    if bearer_value.startswith("sk-"):
+        return await session.get(ApiKey, bearer_value[3:])
+    if bearer_value.startswith("cashu"):
+        hashed = hashlib.sha256(bearer_value.encode()).hexdigest()
+        return await session.get(ApiKey, hashed)
+    return None
+
+
 async def _restore_balance(
-    session: AsyncSession, hashed_key: str, balance: int, reserved_balance: int
+    session: AsyncSession, hashed_key: str, balance: int, reserved_balance: int, mint_url: str
 ) -> None:
     """Restore balance after a failed refund mint attempt."""
     restore_stmt = (
@@ -227,7 +239,7 @@ async def _restore_balance(
     await session.commit()
     logger.info(
         "refund_wallet_endpoint: balance restored after mint failure",
-        extra={"hashed_key": hashed_key, "restored_balance": balance},
+        extra={"hashed_key": hashed_key, "restored_balance": balance, "mint_url": mint_url},
     )
 
 
@@ -282,7 +294,12 @@ async def refund_wallet_endpoint(
         )
 
     bearer_value: str = authorization[7:]
-    key: ApiKey = await validate_bearer_key(bearer_value, session)
+    key: ApiKey | None = await _lookup_key_no_create(bearer_value, session)
+    if key is None:
+        raise HTTPException(
+            status_code=401,
+            detail="Key not found. Deposit first via /v1/wallet/create before requesting a refund.",
+        )
 
     if key.total_balance <= 0:
         if cached := await _refund_cache_get(bearer_value):
@@ -378,11 +395,11 @@ async def refund_wallet_endpoint(
 
     except HTTPException:
         # Minting failed — restore the debited balance
-        await _restore_balance(session, key.hashed_key, pre_debit_balance, pre_debit_reserved)
+        await _restore_balance(session, key.hashed_key, pre_debit_balance, pre_debit_reserved, key.refund_mint_url or "")
         raise
     except Exception as e:
         # Minting failed — restore the debited balance
-        await _restore_balance(session, key.hashed_key, pre_debit_balance, pre_debit_reserved)
+        await _restore_balance(session, key.hashed_key, pre_debit_balance, pre_debit_reserved, key.refund_mint_url or "")
         error_msg = str(e)
         logger.error(
             "refund_wallet_endpoint: mint/send failed",

routstr/core/main.py

@@ -30,6 +30,7 @@ from .db import create_session, init_db, run_migrations
 from .exceptions import general_exception_handler, http_exception_handler
 from .logging import get_logger, setup_logging
 from .middleware import LoggingMiddleware
+from .not_found import _NOT_FOUND_HTML, not_found_catch_all  # noqa: F401
 from .settings import SettingsService
 from .settings import settings as global_settings
 from .version import __version__

routstr/core/not_found.py

@@ -0,0 +1,55 @@
+"""Shared 404 handler used by the proxy catch-all and tests."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import Request
+from fastapi.responses import HTMLResponse, JSONResponse, Response
+
+_NOT_FOUND_HTML_FILE = Path(__file__).parent.parent.parent / "ui_out" / "404.html"
+
+
+def _read_not_found_html() -> str | None:
+    try:
+        return _NOT_FOUND_HTML_FILE.read_text(encoding="utf-8")
+    except OSError:
+        return None
+
+
+_NOT_FOUND_HTML: str | None = _read_not_found_html()
+
+
+def build_not_found_response(request: Request, path: str) -> Response:
+    """Return a 404 response.
+
+    HTML 404 page only for GET requests from browsers (Accept: text/html).
+    All POST requests and API clients receive a JSON 404.
+    """
+    accept = request.headers.get("accept", "").lower()
+    prefers_html = (
+        request.method == "GET"
+        and "text/html" in accept
+        and "application/json" not in accept
+    )
+    request_id = getattr(request.state, "request_id", "unknown")
+
+    if prefers_html and _NOT_FOUND_HTML is not None:
+        return HTMLResponse(content=_NOT_FOUND_HTML, status_code=404)
+
+    return JSONResponse(
+        status_code=404,
+        content={
+            "error": {
+                "message": f"Path '/{path}' not found",
+                "type": "not_found",
+                "code": 404,
+            },
+            "request_id": request_id,
+        },
+    )
+
+
+async def not_found_catch_all(request: Request, path: str) -> Response:
+    """ASGI handler form of :func:`build_not_found_response`."""
+    return build_not_found_response(request, path)

routstr/proxy.py

@@ -1,9 +1,8 @@
 import json
-from pathlib import Path
 from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException, Request
-from fastapi.responses import HTMLResponse, JSONResponse, Response, StreamingResponse
+from fastapi.responses import Response, StreamingResponse
 from sqlmodel import select
 
 from .algorithm import create_model_mappings
@@ -18,6 +17,7 @@ from .core.db import (
     get_session,
 )
 from .core.exceptions import UpstreamError
+from .core.not_found import build_not_found_response
 from .core.settings import settings
 from .payment.helpers import (
     calculate_discounted_max_cost,
@@ -151,50 +151,30 @@ async def refresh_model_maps_periodically() -> None:
             )
 
 
-_API_PATH_PREFIXES = ("v1/", "responses")
-
-_NOT_FOUND_HTML_FILE = Path(__file__).parent.parent / "ui_out" / "404.html"
-
-
-def _read_not_found_html() -> str | None:
-    try:
-        return _NOT_FOUND_HTML_FILE.read_text(encoding="utf-8")
-    except OSError:
-        return None
-
-
-_NOT_FOUND_HTML: str | None = _read_not_found_html()
-
-
-def _build_not_found_response(request: Request, path: str) -> Response:
-    """Return a 404 for unknown paths.
-    """
-    accept = request.headers.get("accept", "").lower()
-    prefers_json = "application/json" in accept and "text/html" not in accept
-    request_id = getattr(request.state, "request_id", "unknown")
-
-    if not prefers_json and _NOT_FOUND_HTML is not None:
-        return HTMLResponse(content=_NOT_FOUND_HTML, status_code=404)
-
-    return JSONResponse(
-        status_code=404,
-        content={
-            "error": {
-                "message": f"Path '/{path}' not found",
-                "type": "not_found",
-                "code": 404,
-            },
-            "request_id": request_id,
-        },
-    )
+_API_PATH_PREFIXES = (
+    "v1/",
+    "responses",
+    "chat/",
+    "completions",
+    "models",
+    "embeddings",
+    "audio/",
+    "images/",
+    "moderations",
+    "providers",
+)
 
 
 @proxy_router.api_route("/{path:path}", methods=["GET", "POST"], response_model=None)
 async def proxy(
     request: Request, path: str, session: AsyncSession = Depends(get_session)
 ) -> Response | StreamingResponse:
-    if not path.startswith(_API_PATH_PREFIXES):
-        return _build_not_found_response(request, path)
+    # GET requests must hit a known API prefix; otherwise return a 404 (HTML
+    # for browsers, JSON for API clients). POST requests are always forwarded
+    # so that OpenAI-style endpoints work with or without the `v1/` prefix
+    # (e.g. `/chat/completions` as well as `/v1/chat/completions`).
+    if request.method == "GET" and not path.startswith(_API_PATH_PREFIXES):
+        return build_not_found_response(request, path)
 
     headers = dict(request.headers)
 

routstr/wallet.py

@@ -48,6 +48,8 @@ async def recieve_token(
     if token_obj.mint not in settings.cashu_mints:
         return await swap_to_primary_mint(token_obj, wallet)
 
+    await wallet.load_mint(keyset_id=token_obj.keysets[0])
+
     wallet.verify_proofs_dleq(token_obj.proofs)
     await wallet.split(proofs=token_obj.proofs, amount=0, include_fees=True)
 

tests/integration/test_wallet_refund.py

@@ -372,17 +372,17 @@ async def test_refund_rejects_concurrent_topup_on_same_key(
     topup_amount_sat = 500
     topup_token = await testmint_wallet.mint_tokens(topup_amount_sat)
 
-    validate_called = asyncio.Event()
+    key_looked_up = asyncio.Event()
     allow_refund_to_continue = asyncio.Event()
-    original_validate_bearer_key = balance_module.validate_bearer_key
+    original_lookup = balance_module._lookup_key_no_create
     delayed_once = False
 
-    async def delayed_validate_bearer_key(*args: Any, **kwargs: Any) -> ApiKey:
+    async def delayed_lookup_key_no_create(*args: Any, **kwargs: Any) -> ApiKey | None:
         nonlocal delayed_once
-        key = await original_validate_bearer_key(*args, **kwargs)
-        if not delayed_once:
+        key = await original_lookup(*args, **kwargs)
+        if not delayed_once and key is not None:
             delayed_once = True
-            validate_called.set()
+            key_looked_up.set()
             await allow_refund_to_continue.wait()
         return key
 
@@ -390,7 +390,7 @@ async def test_refund_rejects_concurrent_topup_on_same_key(
         return await authenticated_client.post("/v1/wallet/refund")
 
     async def issue_topup() -> Any:
-        await validate_called.wait()
+        await key_looked_up.wait()
         try:
             return await authenticated_client.post(
                 "/v1/wallet/topup", params={"cashu_token": topup_token}
@@ -399,7 +399,7 @@ async def test_refund_rejects_concurrent_topup_on_same_key(
             allow_refund_to_continue.set()
 
     with patch(
-        "routstr.balance.validate_bearer_key", new=delayed_validate_bearer_key
+        "routstr.balance._lookup_key_no_create", new=delayed_lookup_key_no_create
     ):
         refund_response, topup_response = await asyncio.gather(
             issue_refund(), issue_topup()

tests/unit/test_balance.py

@@ -168,12 +168,12 @@ async def test_apikey_refund_stores_cashu_transaction_with_apikey_source() -> No
     refund_token = "cashuArefund_apikey_token"
 
     session = MagicMock()
+    session.get = AsyncMock(return_value=key)
     session.exec = AsyncMock(return_value=_update_result(1))
     session.add = MagicMock()
     session.commit = AsyncMock()
 
     with (
-        patch("routstr.balance.validate_bearer_key", AsyncMock(return_value=key)),
         patch("routstr.balance.get_billing_key", AsyncMock(return_value=key)),
         patch("routstr.balance.send_token", AsyncMock(return_value=refund_token)),
         patch("routstr.balance.store_cashu_transaction", AsyncMock()) as mock_store,
@@ -203,12 +203,12 @@ async def test_apikey_refund_logs_token() -> None:
     refund_token = "cashuAlogged_token"
 
     session = MagicMock()
+    session.get = AsyncMock(return_value=key)
     session.exec = AsyncMock(return_value=_update_result(1))
     session.add = MagicMock()
     session.commit = AsyncMock()
 
     with (
-        patch("routstr.balance.validate_bearer_key", AsyncMock(return_value=key)),
         patch("routstr.balance.get_billing_key", AsyncMock(return_value=key)),
         patch("routstr.balance.send_token", AsyncMock(return_value=refund_token)),
         patch("routstr.balance.store_cashu_transaction", AsyncMock()),
@@ -232,12 +232,12 @@ async def test_apikey_refund_log_includes_path() -> None:
     refund_token = "cashuApath_token"
 
     session = MagicMock()
+    session.get = AsyncMock(return_value=key)
     session.exec = AsyncMock(return_value=_update_result(1))
     session.add = MagicMock()
     session.commit = AsyncMock()
 
     with (
-        patch("routstr.balance.validate_bearer_key", AsyncMock(return_value=key)),
         patch("routstr.balance.get_billing_key", AsyncMock(return_value=key)),
         patch("routstr.balance.send_token", AsyncMock(return_value=refund_token)),
         patch("routstr.balance.store_cashu_transaction", AsyncMock()),
@@ -269,6 +269,7 @@ async def test_apikey_refund_rejects_on_concurrent_balance_change() -> None:
     key = _make_api_key(balance=5000, refund_currency="sat")
 
     session = MagicMock()
+    session.get = AsyncMock(return_value=key)
     # Debit returns rowcount=0 → balance changed concurrently
     session.exec = AsyncMock(return_value=_update_result(0))
     session.commit = AsyncMock()
@@ -276,7 +277,6 @@ async def test_apikey_refund_rejects_on_concurrent_balance_change() -> None:
     mock_send_token = AsyncMock(return_value="cashuAshould_not_be_minted")
 
     with (
-        patch("routstr.balance.validate_bearer_key", AsyncMock(return_value=key)),
         patch("routstr.balance.get_billing_key", AsyncMock(return_value=key)),
         patch("routstr.balance.send_token", mock_send_token),
         patch("routstr.balance.store_cashu_transaction", AsyncMock()),
@@ -333,11 +333,11 @@ async def test_apikey_refund_restores_balance_on_mint_failure() -> None:
 
     # First exec call = debit (succeeds), second = restore
     session = MagicMock()
+    session.get = AsyncMock(return_value=key)
     session.exec = AsyncMock(side_effect=[_update_result(1), _update_result(1)])
     session.commit = AsyncMock()
 
     with (
-        patch("routstr.balance.validate_bearer_key", AsyncMock(return_value=key)),
         patch("routstr.balance.get_billing_key", AsyncMock(return_value=key)),
         patch("routstr.balance.send_token", AsyncMock(side_effect=Exception("mint down"))),
         patch("routstr.balance.store_cashu_transaction", AsyncMock()),
@@ -355,3 +355,49 @@ async def test_apikey_refund_restores_balance_on_mint_failure() -> None:
     assert exc_info.value.status_code == 503
     # Verify two exec calls: debit + restore
     assert session.exec.await_count == 2
+
+
+# ---------------------------------------------------------------------------
+# no-create guarantee: fresh Cashu/unknown sk- tokens must not create API keys
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_refund_fresh_cashu_bearer_returns_401() -> None:
+    """Fresh Cashu token not in DB must get 401, never create a new ApiKey."""
+    from fastapi import HTTPException
+
+    session = MagicMock()
+    session.get = AsyncMock(return_value=None)
+
+    with pytest.raises(HTTPException) as exc_info:
+        await refund_wallet_endpoint(
+            authorization="Bearer cashuAfresh_never_deposited_token",
+            x_cashu=None,
+            session=session,
+        )
+
+    assert exc_info.value.status_code == 401
+    session.get.assert_awaited_once()
+    # No add/commit → no key was persisted
+    session.add.assert_not_called()
+    session.commit.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_refund_unknown_sk_bearer_returns_401() -> None:
+    """Unknown sk- key not in DB must get 401."""
+    from fastapi import HTTPException
+
+    session = MagicMock()
+    session.get = AsyncMock(return_value=None)
+
+    with pytest.raises(HTTPException) as exc_info:
+        await refund_wallet_endpoint(
+            authorization="Bearer sk-unknownhash",
+            x_cashu=None,
+            session=session,
+        )
+
+    assert exc_info.value.status_code == 401
+    session.get.assert_awaited_once()

tests/unit/test_proxy_not_found.py

@@ -1,4 +1,4 @@
-"""Tests for the built-in 404 handler in routstr.proxy."""
+"""Tests for the app-level 404 handler in routstr.core.main."""
 
 from __future__ import annotations
 
@@ -6,18 +6,22 @@ import pytest
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
-from routstr import proxy
-from routstr.proxy import proxy_router
+from routstr.core import main as core_main
 
 
 def _make_app() -> FastAPI:
     app = FastAPI()
-    app.include_router(proxy_router)
+    app.add_api_route(
+        "/{path:path}",
+        core_main.not_found_catch_all,
+        methods=["GET", "POST"],
+        include_in_schema=False,
+    )
     return app
 
 
 @pytest.mark.skipif(
-    proxy._NOT_FOUND_HTML is None,
+    core_main._NOT_FOUND_HTML is None,
     reason="UI bundle (ui_out/404.html) not present in this environment",
 )
 def test_unknown_path_returns_html_404_for_browser() -> None:
@@ -41,24 +45,26 @@ def test_unknown_path_returns_json_404_for_api_client() -> None:
     assert "/some/random/page" in payload["error"]["message"]
 
 
-def test_root_path_returns_404_for_proxy_router() -> None:
+def test_root_path_returns_404() -> None:
     client = TestClient(_make_app())
     response = client.get("/", headers={"accept": "application/json"})
     assert response.status_code == 404
 
 
-def test_v1_path_is_not_intercepted_by_404_handler() -> None:
-    """Paths starting with v1/ must reach the proxy logic, not the 404 handler."""
-    client = TestClient(_make_app(), raise_server_exceptions=False)
-    response = client.get("/v1/anything")
-    if response.status_code == 404:
-        # Any 404 here must come from inner proxy logic, not our HTML page.
-        assert "<!DOCTYPE html>" not in response.text
-
-
 def test_json_returned_when_ui_html_missing(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(proxy, "_NOT_FOUND_HTML", None)
+    from routstr.core import not_found as nf
+
+    monkeypatch.setattr(nf, "_NOT_FOUND_HTML", None)
     client = TestClient(_make_app())
     response = client.get("/some/random/page", headers={"accept": "text/html"})
     assert response.status_code == 404
     assert response.headers["content-type"].startswith("application/json")
+
+
+def test_post_unknown_path_returns_json_even_for_browser() -> None:
+    client = TestClient(_make_app())
+    response = client.post("/some/random/page", headers={"accept": "text/html"})
+    assert response.status_code == 404
+    assert response.headers["content-type"].startswith("application/json")
+    payload = response.json()
+    assert payload["error"]["type"] == "not_found"

ui/components/add-provider-model-dialog.tsx

@@ -1,6 +1,6 @@
 'use client';
 
-import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import React, { useEffect, useMemo, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { z } from 'zod';
 import { zodResolver } from '@hookform/resolvers/zod';

ui/components/app-page-shell.tsx

@@ -21,6 +21,7 @@ import { adminLogout } from '@/lib/api/services/auth';
 import { Button } from '@/components/ui/button';
 import { CurrencyToggle } from '@/components/currency-toggle';
 import { ThemeToggle } from '@/components/theme-toggle';
+import { VersionStatus } from '@/components/version-status';
 import {
   Sheet,
   SheetClose,
@@ -110,6 +111,7 @@ export function AppPageShell({
                   <h1 className='truncate text-lg font-semibold tracking-tight whitespace-nowrap'>
                     Routstr Node
                   </h1>
+                  <VersionStatus className='mt-0.5' />
                 </div>
               </div>
               <Button
@@ -279,9 +281,12 @@ export function AppPageShell({
                     height={24}
                     className='rounded-sm'
                   />
-                  <p className='truncate text-base font-medium tracking-tight'>
-                    Routstr Node
-                  </p>
+                  <div className='min-w-0'>
+                    <p className='truncate text-base font-medium tracking-tight'>
+                      Routstr Node
+                    </p>
+                    <VersionStatus className='mt-0.5' />
+                  </div>
                 </div>
                 <SheetClose asChild>
                   <Button

ui/components/version-status.tsx

@@ -0,0 +1,282 @@
+'use client';
+
+import { useQuery, useQueryClient } from '@tanstack/react-query';
+import {
+  AlertTriangleIcon,
+  CheckCircle2Icon,
+  ExternalLinkIcon,
+  InfoIcon,
+  Loader2Icon,
+  RefreshCwIcon,
+} from 'lucide-react';
+import { ConfigurationService } from '@/lib/api/services/configuration';
+import { Button } from '@/components/ui/button';
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from '@/components/ui/popover';
+import { cn } from '@/lib/utils';
+import {
+  deriveStatus,
+  formatReleaseDate,
+  formatVersionLabel,
+  parseVersion,
+  type StatusKind,
+} from '@/lib/utils/version';
+
+interface NodeInfo {
+  version?: string;
+}
+
+interface GithubRelease {
+  tag_name: string;
+  name?: string;
+  html_url: string;
+  published_at?: string;
+  body?: string;
+}
+
+const NODE_QUERY_KEY = ['node-version'] as const;
+const RELEASE_QUERY_KEY = ['routstr-latest-release'] as const;
+const THIRTY_MINUTES = 30 * 60 * 1000;
+
+const GITHUB_RELEASES_URL = `https://api.github.com/repos/Routstr/routstr-core/releases/latest`;
+const RELEASES_PAGE_URL = `https://github.com/Routstr/routstr-core/releases`;
+
+async function fetchNodeInfo(): Promise<NodeInfo> {
+  const baseUrl = ConfigurationService.getLocalBaseUrl().replace(/\/+$/, '');
+  const response = await fetch(`${baseUrl}/v1/info`, {
+    headers: { 'Content-Type': 'application/json' },
+  });
+  if (!response.ok) {
+    throw new Error('Unable to load node info');
+  }
+  return (await response.json()) as NodeInfo;
+}
+
+async function fetchLatestRelease(): Promise<GithubRelease | null> {
+  const response = await fetch(GITHUB_RELEASES_URL, {
+    headers: { Accept: 'application/vnd.github+json' },
+  });
+  if (response.status === 403 || response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error(`GitHub responded ${response.status}`);
+  }
+  return (await response.json()) as GithubRelease;
+}
+
+function pickColorClass(status: StatusKind): string {
+  if (status === 'outdated') return 'text-amber-600 dark:text-amber-400';
+  if (status === 'unknown') return 'text-muted-foreground';
+  if (status === 'ahead' || status === 'commit-drift') {
+    return 'text-sky-600 dark:text-sky-400';
+  }
+  return 'text-emerald-600 dark:text-emerald-400';
+}
+
+function renderStatusIcon(status: StatusKind, className: string) {
+  if (status === 'outdated') {
+    return <AlertTriangleIcon className={className} />;
+  }
+  if (status === 'commit-drift' || status === 'ahead' || status === 'unknown') {
+    return <InfoIcon className={className} />;
+  }
+  return <CheckCircle2Icon className={className} />;
+}
+
+function describeStatus(status: StatusKind): string {
+  if (status === 'outdated') return 'A newer release is available.';
+  if (status === 'commit-drift') {
+    return 'Running release version on a non-release commit.';
+  }
+  if (status === 'ahead') {
+    return 'Running ahead of the latest published release.';
+  }
+  if (status === 'current') return 'Up to date with the latest release.';
+  return 'Version status unavailable.';
+}
+
+interface VersionStatusProps {
+  variant?: 'expanded' | 'compact';
+  className?: string;
+}
+
+export function VersionStatus({
+  variant = 'expanded',
+  className,
+}: VersionStatusProps) {
+  const queryClient = useQueryClient();
+
+  const nodeQuery = useQuery({
+    queryKey: NODE_QUERY_KEY,
+    queryFn: fetchNodeInfo,
+    staleTime: THIRTY_MINUTES,
+    retry: 1,
+  });
+
+  const releaseQuery = useQuery({
+    queryKey: RELEASE_QUERY_KEY,
+    queryFn: fetchLatestRelease,
+    staleTime: THIRTY_MINUTES,
+    refetchInterval: THIRTY_MINUTES,
+    refetchOnWindowFocus: false,
+    retry: 1,
+  });
+
+  const currentVersion = parseVersion(nodeQuery.data?.version);
+  const latestVersion = parseVersion(releaseQuery.data?.tag_name);
+  const status = deriveStatus(currentVersion, latestVersion);
+
+  const isRefreshing = releaseQuery.isFetching || nodeQuery.isFetching;
+
+  const handleRefresh = async (): Promise<void> => {
+    await Promise.all([
+      queryClient.invalidateQueries({ queryKey: NODE_QUERY_KEY }),
+      queryClient.invalidateQueries({ queryKey: RELEASE_QUERY_KEY }),
+    ]);
+  };
+
+  const colorClass = pickColorClass(status);
+  const versionLabel = currentVersion
+    ? formatVersionLabel(currentVersion)
+    : nodeQuery.isLoading
+      ? '…'
+      : 'unknown';
+
+  if (!nodeQuery.data && nodeQuery.isLoading && variant === 'expanded') {
+    return null;
+  }
+
+  const statusDescription = describeStatus(status);
+  const ariaLabel = `Node version ${versionLabel}. ${statusDescription} Click for details.`;
+
+  const releaseRateLimited = releaseQuery.data === null;
+
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <button
+          type='button'
+          onClick={(e) => e.stopPropagation()}
+          className={cn(
+            'hover:bg-accent/40 inline-flex items-center gap-1 rounded-md px-1 py-0.5 font-mono text-[10px] leading-tight transition-colors',
+            colorClass,
+            className
+          )}
+          title='View version details'
+          aria-label={ariaLabel}
+        >
+          {renderStatusIcon(status, 'h-3 w-3 shrink-0')}
+          <span className='truncate'>{versionLabel}</span>
+        </button>
+      </PopoverTrigger>
+      <PopoverContent
+        side='bottom'
+        align='start'
+        sideOffset={6}
+        className='w-72 p-3'
+      >
+        <div className='flex items-start justify-between gap-2'>
+          <div className='min-w-0 space-y-0.5'>
+            <div className='flex items-center gap-1.5 text-sm font-medium'>
+              {renderStatusIcon(status, cn('h-4 w-4 shrink-0', colorClass))}
+              Node Version
+            </div>
+            <p className='text-muted-foreground text-xs leading-snug'>
+              {statusDescription}
+            </p>
+          </div>
+          <Button
+            type='button'
+            variant='outline'
+            size='icon'
+            className='h-7 w-7 shrink-0'
+            onClick={handleRefresh}
+            disabled={isRefreshing}
+            title='Check for latest release'
+          >
+            {isRefreshing ? (
+              <Loader2Icon className='h-3.5 w-3.5 animate-spin' />
+            ) : (
+              <RefreshCwIcon className='h-3.5 w-3.5' />
+            )}
+            <span className='sr-only'>Check for latest release</span>
+          </Button>
+        </div>
+
+        <div className='mt-3 space-y-2'>
+          <div className='border-border/60 bg-card/30 grid gap-1.5 rounded-md border p-2'>
+            <div className='flex items-center justify-between gap-3'>
+              <span className='text-muted-foreground text-[10px] tracking-wide uppercase'>
+                Current
+              </span>
+              <span className='font-mono text-xs'>{versionLabel}</span>
+            </div>
+            {currentVersion?.commit ? (
+              <div className='flex items-center justify-between gap-3'>
+                <span className='text-muted-foreground text-[10px] tracking-wide uppercase'>
+                  Commit
+                </span>
+                <code className='font-mono text-[11px]'>
+                  {currentVersion.commit}
+                </code>
+              </div>
+            ) : null}
+          </div>
+
+          <div className='border-border/60 bg-card/30 grid gap-1.5 rounded-md border p-2'>
+            <div className='flex items-center justify-between gap-3'>
+              <span className='text-muted-foreground text-[10px] tracking-wide uppercase'>
+                Latest release
+              </span>
+              <span className='font-mono text-xs'>
+                {releaseQuery.isLoading
+                  ? 'loading…'
+                  : releaseQuery.isError
+                    ? 'unavailable'
+                    : releaseRateLimited
+                      ? 'rate-limited'
+                      : (releaseQuery.data?.tag_name ?? 'unknown')}
+              </span>
+            </div>
+            {releaseQuery.data?.published_at ? (
+              <div className='flex items-center justify-between gap-3'>
+                <span className='text-muted-foreground text-[10px] tracking-wide uppercase'>
+                  Published
+                </span>
+                <span className='text-[11px]'>
+                  {formatReleaseDate(releaseQuery.data.published_at)}
+                </span>
+              </div>
+            ) : null}
+          </div>
+
+          {releaseQuery.isError ? (
+            <p className='text-muted-foreground text-[11px]'>
+              Failed to fetch latest release from GitHub.
+            </p>
+          ) : releaseRateLimited ? (
+            <p className='text-muted-foreground text-[11px]'>
+              GitHub rate limit reached. Try again later.
+            </p>
+          ) : null}
+        </div>
+
+        <div className='border-border/60 mt-3 border-t pt-2'>
+          <a
+            href={releaseQuery.data?.html_url ?? RELEASES_PAGE_URL}
+            target='_blank'
+            rel='noopener noreferrer'
+            className='text-primary inline-flex items-center gap-1 text-xs hover:underline'
+          >
+            View release changelog
+            <ExternalLinkIcon className='h-3 w-3' />
+          </a>
+        </div>
+      </PopoverContent>
+    </Popover>
+  );
+}

ui/lib/utils/version.ts

@@ -0,0 +1,72 @@
+export interface ParsedVersion {
+  raw: string;
+  base: string;
+  parts: readonly number[];
+  commit: string | null;
+}
+
+export type StatusKind =
+  | 'unknown'
+  | 'outdated'
+  | 'ahead'
+  | 'commit-drift'
+  | 'current';
+
+export function parseVersion(
+  raw: string | undefined | null
+): ParsedVersion | null {
+  if (!raw) return null;
+  const trimmed = raw.trim().replace(/^v/i, '');
+  if (!trimmed) return null;
+  const [base, commitPart] = trimmed.split('+', 2);
+  const parts = (base ?? '')
+    .split('.')
+    .map((segment) => Number.parseInt(segment, 10))
+    .filter((value) => Number.isFinite(value));
+  if (parts.length === 0) return null;
+  return {
+    raw,
+    base: base ?? '',
+    parts,
+    commit: commitPart ?? null,
+  };
+}
+
+export function compareVersionParts(
+  a: readonly number[],
+  b: readonly number[]
+): number {
+  const length = Math.max(a.length, b.length);
+  for (let i = 0; i < length; i += 1) {
+    const diff = (a[i] ?? 0) - (b[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+export function deriveStatus(
+  current: ParsedVersion | null,
+  latest: ParsedVersion | null
+): StatusKind {
+  if (!current || !latest) return 'unknown';
+  const cmp = compareVersionParts(current.parts, latest.parts);
+  if (cmp < 0) return 'outdated';
+  if (cmp > 0) return 'ahead';
+  return current.commit ? 'commit-drift' : 'current';
+}
+
+export function formatReleaseDate(iso: string | undefined): string | null {
+  if (!iso) return null;
+  const date = new Date(iso);
+  if (Number.isNaN(date.getTime())) return null;
+  return date.toLocaleDateString(undefined, {
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+  });
+}
+
+export function formatVersionLabel(version: ParsedVersion | null): string {
+  if (!version) return 'unknown';
+  return version.raw.startsWith('v') ? version.raw : `v${version.raw}`;
+}

ui/next.config.ts

@@ -6,6 +6,9 @@ const nextConfig: NextConfig = {
   images: {
     unoptimized: true,
   },
+  turbopack: {
+    root: __dirname,
+  },
 };
 
 export default nextConfig;