chengyongru 034bea1a44 fix(webui): require token_issue_secret for non-localhost bootstrap ...

The previous LAN-access fix (PR #3656) relaxed the bootstrap localhost
check when host was 0.0.0.0, but did not require any authentication —
any device on the network could obtain a token without credentials.

New behavior:
- token_issue_secret configured: always validate, regardless of source
  IP (handles reverse-proxy scenarios where all connections appear as
  localhost).
- No secret configured: only localhost can bootstrap (local dev mode).

This supersedes the host-based check from PR #3656.

2026-05-06 23:51:51 +08:00

..

agent

feat(webui): polish chat layout and titles

2026-05-06 22:20:35 +08:00

channels

fix(webui): require token_issue_secret for non-localhost bootstrap

2026-05-06 23:51:51 +08:00

cli

feat(cli): support github-copilot in provider logout

2026-05-04 12:10:06 +08:00

command

fix(commands): intercept non-priority commands during active turn

2026-04-21 21:50:37 +08:00

config

refactor(config): resolve env vars via in-place Pydantic walk

2026-04-22 22:31:40 +08:00

cron

test(cron): avoid Windows timer race

2026-05-06 00:43:00 +08:00

heartbeat

fix(heartbeat): prevent internal reasoning leaks and finalization fallback in delivery

2026-04-27 18:14:13 +08:00

providers

fix(transcription): address review nits on PR #3253

2026-05-06 15:52:29 +08:00

security

fix(security): add ssrfWhitelist config to unblock Tailscale/CGNAT (#2669)

2026-04-04 19:43:18 +08:00

session

fix: handle Windows PermissionError on directory fsync

2026-04-22 13:19:53 +08:00

tools

refactor(logging): preserve tracebacks and add channel context

2026-05-06 21:17:45 +08:00

utils

fix(runner): soft workspace boundary + per-target throttle (#3493 #3599 #3605)

2026-05-04 01:18:39 +08:00

test_api_attachment.py

fix: two bugs in document extraction pipeline

2026-04-14 13:15:04 +00:00

test_api_stream.py

Fix API stream lifecycle for tool-backed requests

2026-05-01 19:42:52 +08:00

test_build_status.py

fix(status): correct context percentage calculation and sync consolidator

2026-04-16 20:30:39 +08:00

test_context_documents.py

fix: two bugs in document extraction pipeline

2026-04-14 13:15:04 +00:00

test_docker.sh

docs: add core agent line count script and update README with real-time stats

2026-02-06 07:28:39 +00:00

test_document_parsing.py

fix(utils): recurse into PPTX groups and tables when extracting text (#3250)

2026-04-18 12:30:42 +08:00

test_msteams.py

refactor(logging): preserve tracebacks and add channel context

2026-05-06 21:17:45 +08:00

test_nanobot_facade.py

fix(sdk): populate RunResult.tools_used and RunResult.messages

2026-05-05 23:23:29 +08:00

test_openai_api.py

feat(api): add SSE streaming for /v1/chat/completions Wire up the existing on_stream/on_stream_end callbacks from process_direct() to emit OpenAI-compatible SSE chunks when stream=true. Non-streaming path is untouched.

2026-04-17 01:54:49 +08:00

test_package_version.py

fix(version): fall back to pyproject in source checkouts

2026-04-08 23:47:36 +08:00

test_tool_contextvars.py

refactor(agent): simplify subagent concurrency with rejection over semaphore

2026-05-05 22:22:04 +08:00

test_truncate_text_shadowing.py

fix(agent): avoid truncate_text name shadowing

2026-04-10 17:36:31 +08:00