Daniel Salazar 4e2b3ed423 fix(auth): issue reauth tokens only for browser sessions ...

A rejected token's 401 carried a signed reauth_token, which /signup turns
into a session on a temp account. Any revoked app or access token, a stale
token from a deleted app whose uid was reused, or a worker credential could
get one. Only a GUI/browser session's rejection now carries a reauth_token;
everything else still gets reauth_required without it. The stale-app check
also runs before the session is touched.

2026-10-04 05:18:36 -07:00

..

backend

fix(auth): issue reauth tokens only for browser sessions

2026-10-04 05:18:36 -07:00

cli

…

dev-center

fix: app uuid fixes (#3980)

2026-09-28 19:43:23 -07:00

docs

fix(ai-ocr): check credits for the whole document before calling the provider (#4055)

2026-10-04 00:53:19 -07:00

gui

fix: clarify team directory app access (#4031)

2026-10-04 00:51:02 -07:00

mcp-connector

fix: cap app lookups and fields, dedupe icon processing, rate-limit app landing pages (PUT-1891) (#4012)

2026-10-01 17:54:25 -07:00

puter-js

fix(metering): decide app-usage access in MeteringService only (PUT-2015) (#4061)

2026-10-04 00:47:37 -07:00

worker

…

worker-types

…