diegosouzapw 8dcc21476b feat(authz): add 3-tier route guard (local-only + always-protected) ...

Tier 1 — LOCAL_ONLY: /api/mcp/ and /api/cli-tools/runtime/ are
restricted to loopback regardless of auth (prevents CVE-class exposure
of process-spawning endpoints via tunnels or LAN access).

Tier 2 — ALWAYS_PROTECTED: /api/shutdown and /api/settings/database
always require auth, even when requireLogin=false.

Tier 3 — MANAGEMENT: existing behaviour (auth bypassed when
requireLogin=false). IPv6 loopback [::1] correctly parsed.

2026-05-14 23:08:40 -03:00

..

app

Merge PR #2261: fix: align managed model cleanup for imported models (thanks @InkshadeWoods)

2026-05-14 15:47:56 -03:00

domain

feat(resilience): expose model cooldown list with manual re-enable (#2146)

2026-05-11 21:38:26 -03:00

i18n

feat(antigravity): support custom Google Cloud project ID (#2227)

2026-05-14 05:11:24 -03:00

lib

feat(cli): add HMAC-SHA256 machine token for localhost CLI auth

2026-05-14 23:00:00 -03:00

middleware

feat(providers): add lm studio and grok 4.3 support

2026-04-21 08:27:48 -03:00

mitm

fix(security): close remaining CodeQL alerts + document mandatory patterns

2026-05-14 11:12:14 -03:00

models

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

scripts

feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)

2026-05-04 19:25:41 -03:00

server

feat(authz): add 3-tier route guard (local-only + always-protected)

2026-05-14 23:08:40 -03:00

shared

Merge PR #2240: feat: CLI Integration Suite for issue #2016

2026-05-14 09:27:18 -03:00

sse

fix(security): address P1/P2 findings from release review

2026-05-14 15:23:46 -03:00

store

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

types

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

instrumentation-node.ts

feat(auth): per-session sticky routing for codex (#1887)

2026-05-10 00:58:07 -03:00

instrumentation.ts

Add Claude prompt cache logging and exclude cache reads

2026-03-27 15:14:54 +09:00

proxy.ts

fix(providers): refresh web client user agents (#1699)

2026-04-28 02:41:19 -03:00

server-init.ts

fix(postinstall): extend native module repair to cover wreq-js for pnpm global installs (#1634)

2026-04-26 20:15:47 -03:00