9 Commits

Include renames

Author	SHA1	Message	Date
Daniel Salazar	589a98b12c	feat(kv): share KV prefixes with other users at watch/read/write, and bound what apps can be granted (#4331) ... * feat(kv): share key-value prefixes with other users, and bound what apps can be granted - KV share handles move out of Events into KvShareService, served at /kv/shares (the /events/kv-handles routes stay as an alias). - Shares have watch, read and write levels, encoded in the permission root (kv-share, kv-share-read, kv-share-write) with write implying read and watch. - Every puter.kv method takes optConfig.handle; keys are relative to the shared prefix, cursors are sealed, and private entries stay hidden. - New puter.kv.share, unshare, listShared and listSharedByMe; optional label; kv.share.received notice in the app's mailbox only; recipient blocks apply. - puter.kv.set gains onlyIfAbsent. - fs and kv events gain viaWorker, and kv events report self from the writer. - /auth/grant-user-app only accepts canonical permissions from a fixed set of families; the consent dialog, puter.perms and docs follow. - Migrations: kv_share_handles gains revoked_by, label, and grantee and app indexes (mysql_mig_49, postgres_mig_38, sqlite 0095). * fix(kv): never name a private key in a cross-app or handle cursor, and bound flat-permission scans - Listings of another namespace (cross-app or through a handle) resume after the last entry they returned, and their cursors are sealed, bound to the namespace or handle, and padded to one length. Old plain cross-app cursors are still read when they name the target namespace; other namespaces get 400. - PermissionStore scans flat permissions a few roots at a time and skips roots nested under another root in the same call.	2026-10-25 08:16:19 -07:00
Juan Fernando Castro	1627650abc	refactor: make teams an optional feature (#4248) ... * refactor: let core run without a teams registration Teams becomes optional: `services.team` and `stores.team` may be absent, and core stops assuming either is there. Seventeen call sites across share, signup, account deletion and the homepage now degrade instead of throwing: a team recipient that cannot be resolved is "no such recipient" rather than a fault, a group share folds in nothing, and account deletion stops asking what a seat was charged for. This generalises the pattern `gates.ts` and `SocketService` already used. Teams' own files take a private handle to their store and service, so the feature's code stays free of optionality that only core needs. No behaviour changes where Teams is registered. * refactor: put a contract between core and teams `core/teams.ts` holds the shapes core reads and the calls it makes, and the registries declare the pair as provided rather than built in. The service, store and controller are registered by whatever runs the feature. Typing them properly turned up eight AuthController call sites the previous commit could not see: the controller reads its stores from the built-in registry, so an absent `team` fell to an index signature and typed as `unknown` instead of erroring. They now go through the same optional path as the rest. The feature's own tests move with it. The cases in core suites that build a team to exercise a core rule still need relocating, so those suites are red here. * test: stub core's seat rules, rehome the rest with the feature A core suite can no longer build a team, so the rules that refuse a seat get `testFixtures/seatStub.ts` instead: it answers the contract, which is all those rules read, and puts the registry back when the test ends. Seventeen cases move that way. Four could not: group shares and a seat's 2FA enrolment over HTTP need the real feature and the `/teams` route, so they go with it, as does the whole of `GroupGrants.test.ts`. Two whoami cases asserted a seat's team through `extension.import`, which resolves the registry rather than the stores object. They now assert the absent case, and the behaviour they covered is asserted against `buildUserDetails`, which takes its stores as an argument. Suite: 12252 passed, 38 skipped. * refactor: take the teams console out of the built-in tabs `TabTeams`, `teamsConsole` and `teamActionIcons` are no longer built in. The dashboard already invites a tab through its `dashboard-will-open` event, so whatever provides Teams contributes the console the same way. Its 113 strings go with it and register into the shipped English dictionary at load, so `i18n('teams_*')` resolves as it did. Only `en.js` ever carried them, so no translation is lost. Three modules stay, because things other than the console use them: `teamBadge` (the dashboard shell), `orgSeat` (Home, Account, Security) and `shareTeams` (the share picker). They already render nothing when the account has no team. `teams_account_of` stays with `teamBadge` for the same reason, and the `share_*` and `plan_team_*` strings stay with their callers. The GUI builds clean with no console at all, and builds it in when the tab is contributed. * docs: seats past the owner's current limit get no allowance	2026-10-22 15:32:39 -04:00
Daniel Salazar	1261976088	feat: user profiles in a system-owned store, public only for paid accounts (#3919) ... - ProfileService keeps each profile as /system/profiles/<uuid>.profile, admin-owned and served by the protected puter-profiles subdomain - GET/POST /profile; puter.auth.getProfile/updateProfile, with getProfilePicture reading through them - another user's profile is served only while its owner is on a paid plan (profileGate.enabled kill switch); the hosted file is gated through the new site.access.check hook the hosting middleware asks before streaming any file - SubdomainStore.create takes isProtected - the GUI reads and writes the profile through the SDK - docs: getProfile, updateProfile, UserProfile, limits PUT-1859 PUT-1860 PUT-1861 PUT-1862	2026-09-21 23:28:56 -07:00
Juan Castro	9bc2cd741c	feat: add TeamController, the teams_enabled flag, and the isolation suite ... Covers PUT-1708, PUT-1709 and PUT-1743. Twelve routes, every one setting requireUserActor -- that option is what installs requireAuthGate, requireVerifiedAccount and requireNonAccessTokenGate, because server.ts derives `needsAuth` from the route options. Reads need it as much as writes: without an auth option a route gets no suspension check and admits access tokens, so a just-disabled member could still read the roster and a scoped third-party token could read the audit log. Authority is checked before anything observable. Validating the body first made POST /members answer 400 before 403, and resolving :username first turned the member routes into a global username-existence oracle. Provisioning applies the same username and email rules as signup rather than its own -- USERNAME_REGEX, USERNAME_MAX_LENGTH, RESERVED_USERNAMES and validator.isEmail, now exported from AuthController. Without them a workspace could mint accounts signup would refuse, claim unregistered reserved names, and mail arbitrary unvalidated addresses. Handle problems are 400 or 409 rather than a bare Error, which the server turns into a 500 and a deduped critical alarm -- an uppercase handle should not page on-call. Disable drops sessions through SessionStore.removeByUuid rather than a raw DELETE. The store invalidates every composite cache key; without that a disabled member kept authenticating from cache for the session TTL, which is exactly the "takes effect on the next request, not after a cache TTL" property disable is supposed to have. Revoking also preserves last_ip/last_user_agent, which the member-facing audit view reads. Audit writes live in TeamService at the point of each action rather than in the route, so a caller reaching the service directly cannot skip them, and the SQL lives in TeamStore. Audit reads map internal user ids to usernames, and remain readable by the owner after the workspace is soft-deleted -- otherwise the delete_team entry was written and immediately unreachable. teams_enabled gates route registration through an optional isEnabled() the server honours, so with it off the paths do not exist rather than existing and refusing. It does not gate DDL. TeamIsolation.http.test.ts asserts the negative the feature rests on: the workspace manages accounts and cannot read them, including through a full-access token and after the member is disabled. It asserts outcomes rather than the absence of an implicator.	2026-09-03 15:57:23 -04:00
Daniel Salazar	0dfbceb047	feat: durable event subscriptions store, cache, and routes (PUT-1673) (#3679) ... * feat: durable event subscriptions store, cache, and routes (PUT-1673) * fix: durable subscription hardening (PUT-1673) - Expired rows stop delivering at dispatch time and no longer count toward the per-account cap, instead of waiting for the sweep. - The expiry sweep runs hourly with a jittered first pass shortly after boot; a 24 h interval never fired on a fleet that redeploys more often than that. - Only a durable generation bump marks peer regions cold. A session subscribe/unsubscribe in one region used to force a primary read in every other region on its next dispatch. - `subject`/`anchor_path` widen to varchar(4096) to match `fsentries.path`, and subjects longer than that are refused with `invalid_subject` rather than failing the insert on MySQL/Postgres. - The dispatch and durable integration suites wait for the specific delivery they expect and assert only within their own folder; the old any-delivery `settle()` let a late event from a previous test satisfy or pollute the next one under CI load.	2026-09-02 16:00:13 -07:00
Nariman Jelveh	7ceb2090b7	feat: app user feedback system (#3546) ... * feat: app user feedback system Add puter.ui.showFeedbackDialog(), letting users send feedback to an app's developer. In the app environment the Puter desktop renders the dialog; on a third-party website a puter.com popup hosts it. The message is stored in a new app_feedback table and emailed to the app owner's confirmed email — it never passes through the app's own code. Feedback is strictly opt-in per app via a new apps.feedback_enabled column (a real column, not an app-metadata key, so Dev Center's whole-blob metadata saves can't silently erase it), settable through the existing puter.apps.update path (feedbackEnabled). Backend follows the layered stack: AppFeedbackStore (durable count queries) -> AppFeedbackService (opt-in check, message normalization, abuse caps, best-effort owner email) -> AppFeedbackController (POST /app-feedback, GET /app-feedback/target). New app-user-feedback email template uses the escaping-safe nl2br triple-stash. Defensive by design: - requireUserActor blocks app tokens, so feedback can't be submitted programmatically; guiOriginOnly keeps cross-origin pages out. - App identity comes only from the validated IPC sender (desktop) or the browser-attested opener origin (popup), never from message contents. - The send-feedback popup action is in NON_AUTH_POPUP_ACTIONS, so it never delivers a token to the opener. - Layered limits: route rate limits, plus DB-count caps that fail closed when the limiter backend is down, plus a per-app daily owner-email cap. - Owner email is fully best-effort: an unconfigured transport, unconfirmed/unsubscribed/suspended owner, or send failure never fails the request or blocks storage. - The dialog and SDK method are resolve-only and always settle, so a caller is never left hanging. Migrations for sqlite/mysql/postgres, puter.js types, docs, backend tests (sqlite + postgres), and a Playwright e2e spec are included. * feat: add feedback control to the dashboard app-drawer Surface the feedback dialog directly from the app window's chrome in dashboard mode: apps that opt in (apps.feedbackEnabled) get a "Send Feedback" button in the dashboard app-drawer, next to minimize/close. It opens the same UIWindowAppFeedback dialog, targeting this app by uid. The control is only rendered when the app opted in — feedback_enabled is threaded from the launched app's metadata into the window options — and the dialog still re-checks opt-in server-side, so a stale flag can't send anywhere. Reuses the existing .dashboard-app-drawer-btn styling and the app_feedback_title i18n string, so no new CSS or strings. Adds e2e coverage: the control appears and opens the dialog for an opted-in app, and is absent for an app that hasn't opted in. * feat: enable app feedback by default in Dev Center New apps created in Dev Center now have feedbackEnabled set on creation, so users can send the developer feedback without any extra setup. A "User Feedback" toggle in the app's settings lets developers turn it off (and back on); it's wired into the save payload, the dirty-state tracking, and the reset-to-original path like the neighboring toggles. The Save update omits feedbackEnabled unless the toggle is present, and the backend leaves an omitted field untouched, so the default survives the create-then-save flow Dev Center runs. Add an SDK apps-suite guard covering that round-trip (create-on -> unrelated update keeps it -> can be turned off). * fix: feedback modal polish + share sender email Address four issues with the app feedback UI: - Dashboard app-drawer: the extra "feedback" control pushed the close button past the drawer's derived width and clipped it. A `has-feedback` modifier widens the surface by one button + gap so all three controls fit. The control's glyph is now a message bubble with text lines, which reads more clearly at 14px than the previous bare speech bubble. - The feedback dialog is no longer a UIWindow. It's a from-scratch overlay modal in the spirit of the dashboard modals (uninstall, add-app): a fixed scrim + centered card with self-contained, theme-aware color tokens (light default + dark override), a bottom-sheet layout on narrow screens, backdrop/Escape close, and an entrance transition. This renders consistently across the three contexts it's opened from (desktop app-IPC, dashboard drawer, standalone popup), so the callers no longer pass UIWindow-specific window_options. - Feedback now shares the sender's email (not just their username) with the developer so they can respond: the owner email sets Reply-To to the sender and shows the address in the body — but only when the sender's email is verified (an unverified address could be anyone's, so it's never used as a reply target). EmailClient.send gains an optional replyTo. The dialog note now says the email will be shared. Tests: e2e updated for the new modal (7 pass); backend feedback suite covers the verified/unverified sender-email split (sqlite + postgres); EmailClient + GUI unit suites pass; type-check clean. * fix: resolve 'app-'-prefixed app names in feedback target lookup APP_NAME_REGEX allows names beginning with "app-" (e.g. the seeded app-center), but resolveTargetApp's startsWith('app-') heuristic sent those to a uid-only lookup with no name fallback, so feedback for such apps 403'd even when enabled. Use AppStore.resolveApp (uid, then name) like the rest of the codebase. * fix: make feedback daily caps fail closed under concurrent submissions The per-user and per-user-per-app caps were check-then-insert and the per-app email cap was count-then-send, so parallel requests (or multiple nodes, or the route limiter failing open) could all read a stale under-cap count and push past every limit — the exact scenario the DB-backed caps exist to stop. Now the user caps recount after the insert (own row included) and roll the row back with 429 if a burst breached them, and the email cap claims its slot (email_sent=1) before sending, recounts, and releases the slot if over cap or if the send fails. * docs: disclose the Dev Center's feedback-on-by-default in SDK docs/types The Dev Center deliberately creates apps with feedbackEnabled (see 32c950de5), but the SDK docs, apps.d.ts, and AppFeedbackService's class doc all described feedback as strictly opt-in / default-false with no qualification — so a Dev Center developer reading them would wrongly conclude feedback is off for their app. State the Dev Center behavior alongside the API default, and correct the update-path docs: an omitted feedbackEnabled leaves the current value unchanged rather than defaulting to false. * fix: don't mint a user-app token as a side effect of the feedback popup Every embedded_in_popup boot ran the user-app token exchange, and the exchange is a write: /auth/get-user-app-token bootstraps an app row for the opener origin, grants flag:app-is-authenticated (what makes the site count as connected to the account), and creates its AppData dir. So merely opening — or immediately cancelling — a send-feedback popup recorded a user<->site relationship the read-only feedback flow never needs: the server resolves the feedback target from the attested origin without any of it. Gate the exchange behind runsUserAppTokenExchange(action) in all three popup paths that mint (main postAuthActions exchange, temp-user signup success, manual signup fallback). request-permission keeps the exchange since grants are written against the app row it bootstraps. * fix: refuse feedback when the deployment cannot deliver it With no email transport configured (the common self-hosted default), submissions were stored in app_feedback — a table with no read path beyond the abuse-cap COUNTs — the owner email was silently skipped, and the sender was still shown 'Feedback sent. Thank you!'. The developer never learns the feedback exists while the user believes it was delivered. Gate acceptsFeedback on clients.email.isConfigured so the pre-flight reports enabled:false (the dialog shows its 'not accepting feedback' pane) and submit returns 403 instead of swallowing messages. Owner-level store-without-email cases (unconfirmed owner email, per-app email cap overflow) keep their existing deliberate semantics. * fix: settle showFeedbackDialog instead of hanging on older host GUIs In the app environment showFeedbackDialog awaited an IPC reply with no capability check. A host GUI that predates this feature (self-hosted Puter running the live js.puter.com SDK) has no handler for the message and never replies, so the promise documented as 'never rejects' also never resolved. The GUI now advertises the IPC dialogs it can answer via a puter.gui_features param on the app iframe URL, and the SDK resolves false when 'feedback-dialog' isn't listed. A reply timeout could not substitute: legitimate replies only arrive when the user closes the dialog, so any timeout would false-negative while the user is typing. Older SDKs ignore the extra param. * fix: guard app-triggered feedback dialog against desktop-lockout loops The showFeedbackDialog IPC handler had no re-entry or abuse guard, and the dialog it opens is a full-viewport overlay above the taskbar and every window — so 'while (true) await puter.ui.showFeedbackDialog()' kept the desktop permanently covered (for signed-out users, the same loop spams the full-page signup window instead). Every dismissal just settled the promise and let the app immediately reopen it. Allow one dialog at a time, and back off reopens per app after each dismissal that sent nothing: 10s, then 60s, then blocked until page reload. A successful send resets the backoff, and user-initiated paths (dashboard drawer) are unaffected since they don't go through IPC. * fix: carry feedback_enabled in suggested/recommended app summaries launch_app uses options.app_obj verbatim when provided, and the suggested-apps launch paths (open_item.js, UIWindowSearch.js, UIDesktop.js) pass summaries from toAppSummary — which omitted feedback_enabled. So an opted-in editor launched by opening a .txt file showed no Send Feedback control in the dashboard drawer, while the same app launched from the Apps tab (full puter.apps.get object) did. * fix: gate feedback dialog Cancel/X on an in-flight submit Escape and backdrop clicks were already ignored while the POST was pending, but the X, Close, and Cancel buttons weren't — clicking one mid-send settled the promise false and tore down the overlay while the submission still landed server-side: the developer got the email, the app was told sent=false, and a user who resubmitted 'the failed one' sent a duplicate and burned a daily-cap slot. Apply the same !sending gate to the buttons and disable them visually while the send is in flight. * fix: reject feedback origins longer than the source_origin column readTargetParam accepted values up to 3000 chars but the raw origin is stored verbatim into source_origin VARCHAR(2048) (MySQL/Postgres), so a 2049-3000 char origin passed every validation and then blew up the INSERT with an HTTP 500 on Postgres/strict MySQL — or was silently truncated on non-strict MySQL, corrupting the abuse-forensics value the column exists for. Cap the param at the column size. * fix: make the feedback dialog's privacy note match what is shared The note unconditionally said 'Your email address will be shared with the developer so they can respond', but AppFeedbackService shares the username always and the email only when it exists and is verified — an unverified or temp-user sender was promised a reply path that never materializes, and nobody was told about the username. Show 'username and email' when the signed-in user's email is verified, and 'username' otherwise. * fix: stop HTML-escaping email subject lines Subjects were compiled with default Handlebars escaping, so the app-user-feedback subject rendered a title like "Bob's App & Games" as "Bob&#x27;s App &amp; Games" — literal entities in the recipient's mail client. Subjects are plain-text headers, not HTML; compile them with noEscape. Header safety is unaffected: the transport encodes newlines and free-form values collapse whitespace upstream. * docs: state exactly what showFeedbackDialog shares with the developer The doc claimed the dialog 'tells the user their username will be shared', while the dialog's note talked only about the email address and the implementation shares the username always plus the email (as Reply-To) only when verified. Describe the actual disclosure: username always, email when verified. * docs: document the COOP false-resolve limitation of showFeedbackDialog Under COOP the popup's opener link is severed, so the SDK deliberately resolves false while the popup stays open and the user can still submit (a feedback submission has no server read-back the way a permission grant does). The documented contract ('resolves to true if the user submitted feedback') was silently wrong on cross-origin-isolated pages — state the limitation in the doc and the SDK jsdoc: false means 'not confirmed', not 'not sent'. * feat: point the feedback email footer at the Dev Center The footer told developers to turn feedback off via a puter.apps.update one-liner, but the toggle lives in the Dev Center app settings — and Dev Center is where apps get feedback enabled by default in the first place. Reword it to 'manage it in the Dev Center' with a link built from config.origin (like app_link) so it holds on self-hosted deployments. * test: cover the feedback service and store layers directly The service owns every feedback business rule — target resolution, eligibility, message normalization, the durable caps, and the owner-email preconditions — but was only reachable through the controller's tests. Give it and the store their own suites so a regression names the layer it broke. Service coverage adds the branches the route tests could not reach: a blocked origin resolving to null rather than surfacing a 403, owners who are suspended or unsubscribed, length measured after normalization, the 24h cap window boundary, subject-header injection via the app title, and the email links being rooted at config.origin. The two describes already labelled `AppFeedbackService ...` move out of the controller test, which keeps only the caller-facing promise that a failed send still returns success. * refactor: prep the feedback cap error once instead of via a factory Both throw sites are in one call and only one can ever run, so a plain const reads the same and drops a function that existed only to defer a constructor. * Require verified users for app feedback API Add `requireVerified: true` to both app feedback routes (`GET /target` and `POST /`) in `AppFeedbackController`. This tightens access control so only verified user accounts can fetch feedback targets or submit app feedback.	2026-08-12 09:49:24 -07:00
Daniel Salazar	116d6e6663	tests: big test push for better coverage (#3490)	2026-08-01 14:29:59 -07:00
Nariman Jelveh	267f464232	Add AGPL license headers to source files (#2877)	2026-05-01 13:50:42 -07:00
6 people	d4d78ac7db	rework: change backend and backend extensions to use simpler code structure and patterns (#2815) ... * fix: dynamodb health checks and client recreation (#2789) * wip: no nanoServices groundwork * feat: data clients in new shape * wip: auth and perms in new system * more wip * middlewaters mainly done * wip: fsv2 in new layout * old fs v2 migration * driver system * driver and old fs fixes * ai drivers wip * stream support * metering in ai chat driver * wip: new auth * rate limit and auth routes * captcha and anti csrf * fix: types * auth store * app logic * wip most other dricvers * fs * mostly kill all legacy stuff * fs finish * fix: redis usage * ai controller * driver cleanup * socket io in v2 * broadcast and crudq stuff * subdomains * notifcations and shares * fix bad syntaxes * auth wip Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * extensions * extension setup * more routes * sql migrations and default services * home router * tier 7 * everything else * everything else * remaining missing bits * server health * logs * cleanup * deps * cleanup 2 * more cleanup 2 * boot * fix launch * config fix * move file * fix: tsconfig things * fix: extension loading * launching * fix: drivers * fix: others * fix: icons * fix: file uploads * fs fixes * fix: fs api * fix: dev-center * config * add back telemetry * lint stuff * husky hooks * fix: fs oss * fix: config migration * config migration * migrate scripts + replicate * runner * fix: merge defafult config * fix: default region * fix: api domain * fix paths in readfile * fix fs entry default s3 * NS: Remove Referral && Entri Service * dep cleanups * fix: static assets * fix: kv and perms * fix: driver registrations * fix: home mapping * fix: rao * adding back 500 alarm * fix: build paths * fix: fs and kv shapes * fix: kv shape * more kv coercing and ai chat matching format as prior * fix: private app gates * private app caches * fix: whole bunch of legacy shape issues * update template jsonc * fix caching partial oidc and fs signed paths * more oidc fixes * fix: wip * fix: private apps * admin route fixes * fix: last few things hopefully * claude uploads * fix security for app only routes * fix kv system namespace * stuff * fix: app and kv and suggested apps * fix:open item * fix: FS operations * fix: default app icons * add back token-read and WSL support * metering fixes * fix: fsEntry * perm scanners and implicators * proper download endpoint * fix: download * fix anti csrft on v2 * fix file extensions, app icons * fold in v1 fixes from origin/main into v2 equivalents Re-applies the v1 fixes that landed on origin/main into their v2 counterparts since the v1 files were deleted on DS/wip during the v2 migration. v1 commits referenced below. - SQLBatcher: flush immediately when queue hits maxBatchSize instead of racing the timer (v1 12f48238). - RedisClient: drop maxRetriesPerRequest from 2 to 1 to shrink failure window (v1 b6776ab4). - ChatCompletionDriver: default minimumCredits to 1 when unset/zero so zero-cost precheck doesn't auto-pass (v1 36bd6073). - OpenAiImageProvider: add gpt-image-2 support — open-ended size rules, token-based cost estimator, arbitrary-size normalizer, isGpt prefix broadened to gpt-image- (v1 f14f1bf4). models.ts auto-merged via rename detection. - AppStore: bump row cache TTL from 5m to 24h (v1 6b3196ed). Not ported: v1 app-object Redis cache (bdfa12b5/b886dde3) — v2's #toClient recomputes filetype_associations/created_from_origin per read; adding a second cache layer is a larger change for a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * remoe anti-csrf from auth routes that had not used them * more icon fixes * fix worker functionality * fix: app and subdomain es Co-authored-by: Copilot <copilot@github.com> * fix PUT-761 * fix: PUT-748 * fix: rename fsService * Add security back to WorkerDriver * Migrate worker from fsEntry to fs. Fix cache issue * remove ability to create symlinks * strict webdav acl * require auth for wisp * chore: service renames * Add metering back to puter peer api * fix: PUT-760 PUT-749 * fix: PUT-746 * fix: peer cost Co-authored-by: Copilot <copilot@github.com> * fix: 771 * change order of peer controller * fix: create appdata folder for app on get auth token * fix: align delete site and list sites * delete: putility * fix subdomains * Add support for tilde in subdomains, fix subdomain update * cleanup PeerController.ts and fix billing oversight (#2844) * fix: PUT-786 * fix: bugs * fix: issues with multiple subdomain queries, or permission checks * fix: harden response shapes to not contain uneeded fields * fix: move state to redis * fix: missing kv methods + better sec Co-authored-by: Copilot <copilot@github.com> * fix: subdomainStore limit * fix: missing path resolution Co-authored-by: Copilot <copilot@github.com> * fs fixes * fix: undef error * fix fs + cleanup * fix: npm audit fixes * heal path entries where missing Co-authored-by: Copilot <copilot@github.com> * fix: caching Co-authored-by: Copilot <copilot@github.com> * fix: cache inconsistencies Co-authored-by: Copilot <copilot@github.com> * fix: app driver metadata Co-authored-by: Copilot <copilot@github.com> * remove extraneous comma * fix: associated app icons * fix: bad tool call * Add validation to WorkerDriver#getFilePaths * misc fs and auth issues Co-authored-by: Copilot <copilot@github.com> * fix: oidc errors Co-authored-by: Copilot <copilot@github.com> * fix: PUT-797 * fix: legacy appdata_app Co-authored-by: Copilot <copilot@github.com> * fix: add alert logs Co-authored-by: Copilot <copilot@github.com> * fix: error handling * Disable sharecontroller * fix: remove private user identifier for ai * fix: private app fixes * Add backback signup_server * fix: completionId size Co-authored-by: Copilot <copilot@github.com> * fix: revalidate path for oidc * fix: revalidate path for oidc * fix: email validation Co-authored-by: Copilot <copilot@github.com> * fix: user create query * fix: middleware extensions Co-authored-by: Copilot <copilot@github.com> * use x-forwarded-for for req ip forwarded * fix: missing last_activity ts * feat: add cache broadcast to subdomains * fix: update config typing --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: ProgrammerIn-wonderland <3838shah@gmail.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Nariman Jelveh <nj@puter.com> Co-authored-by: velzie <velzie@velzie.rip>	2026-04-30 12:13:43 -07:00