Xiangzhe a03cb03110 fix(security): route OAuth auto-import through the LOCAL_ONLY tier ...

The cursor / kiro / raycast auto-import routes read host-local credential files,
but the broad /api/oauth/ PUBLIC prefix classified them PUBLIC — which skips the
LOCAL_ONLY tier entirely, so the loopback-only guard never ran. They are now
excluded from PUBLIC (classify MANAGEMENT) and added to LOCAL_ONLY_API_PREFIXES,
so a non-loopback caller is rejected before the handler runs. OAuth callbacks and
browser flows under /api/oauth/ stay PUBLIC.

Reported by @ntdat812 via GHSA-wgwc-crjm-pmwv and @koyokr via GHSA-gxv4-955v-v6cm.

2026-08-21 14:49:31 -03:00

..

_helpers

…

_setup

…

benchmarks

…

boundary

…

e2e

fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)

2026-08-18 05:51:34 -03:00

fixtures

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

golden-set

…

helpers

fix(responses): replace synthetic reasoning keepalive (#10806)

2026-08-20 09:49:55 -03:00

homolog

…

integration

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

translator

…

unit

fix(security): route OAuth auto-import through the LOCAL_ONLY tier

2026-08-21 14:49:31 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…