Jinwoo-H 7d11e89c2f fix(push): close the final security review findings in the desktop client (#8129) ...

- fetch never follows a redirect: a 307 would replay the host proof and the
  phone's token to whatever origin the redirect named
- registerPush params are strict and the paired identity is spread last
- a per-device bucket (10/min) bounds a phone looping registerPush, which
  costs a gateway write and a synchronous registry write each time

2026-09-06 15:19:22 -04:00

..

cli

docs(orchestration): never pick a worker model the user did not name (#19109)

2026-09-06 14:51:37 -04:00

main

fix(push): close the final security review findings in the desktop client (#8129)

2026-09-06 15:19:22 -04:00

preload

feat(orchestration): make multi-agent workflows durable (#16904)

2026-09-06 14:34:03 -04:00

relay

fix(ssh-relay): daemon owns the endpoint credential; a losing start never rotates it (#19052)

2026-09-06 14:39:25 -04:00

renderer

feat(mobile): structured native Claude chat (#18741)

2026-09-06 11:57:21 -07:00

shared

fix(push): close the final security review findings in the desktop client (#8129)

2026-09-06 15:19:22 -04:00

types

…