Jiang Bohan 8f9cea9226 fix(security): add ws: scheme and dynamic origins to CSP connect-src ...

The CSP connect-src directive only allowed 'self' and wss:, which
blocks WebSocket connections over ws:// in non-HTTPS environments
(e.g. dev deployments). Also, cross-origin API/WS endpoints were not
covered when frontend and backend are on different origins.

Changes:
- Add ws: alongside wss: in connect-src
- Dynamically inject ALLOWED_ORIGINS into connect-src so cross-origin
  connections are permitted by the policy
- Export BuildCSP / InitCSP for testability and router integration

Closes MUL-667

2026-04-13 14:18:42 +08:00

..

auth

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

cli

fix(comments): address code review feedback on pagination

2026-04-04 01:01:48 +08:00

daemon

feat(daemon): add token usage log scanning for OpenCode, OpenClaw, and Hermes runtimes

2026-04-13 13:42:05 +08:00

events

feat(realtime): WS invalidation + refetch pattern, inbox bugfixes, UI polish

2026-03-29 13:49:40 +08:00

handler

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

logger

feat(logging): add structured logging across server and SDK

2026-03-26 10:57:11 +08:00

mention

feat(mentions): support @mentioning issues + server-side auto-expansion (#242)

2026-04-02 13:48:53 +08:00

middleware

fix(security): add ws: scheme and dynamic origins to CSP connect-src

2026-04-13 14:18:42 +08:00

realtime

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

sanitize

fix(sanitize): preserve code blocks and inline code from HTML entity escaping (#774)

2026-04-12 21:32:35 +08:00

service

fix(server): skip auto-comment when agent already posted during task (#712)

2026-04-11 21:27:02 +08:00

storage

fix(storage): clean up variable shadowing and dead code (#761)

2026-04-12 14:06:46 +08:00

util

feat(mentions): support @mentioning issues + server-side auto-expansion (#242)

2026-04-02 13:48:53 +08:00