LinYushen e20c507dcc fix(security): add Content-Security-Policy response header (#822) ...

Adds CSP middleware to the global middleware chain as a browser-level
defense against XSS: script-src 'self', object-src 'none',
frame-ancestors 'none', base-uri 'self', form-action 'self'.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 12:53:39 +08:00

..

auth

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

cli

fix(comments): address code review feedback on pagination

2026-04-04 01:01:48 +08:00

daemon

fix(agent): enable network access for Codex sandbox so Multica CLI can reach API

2026-04-13 01:03:43 +08:00

events

feat(realtime): WS invalidation + refetch pattern, inbox bugfixes, UI polish

2026-03-29 13:49:40 +08:00

handler

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

logger

feat(logging): add structured logging across server and SDK

2026-03-26 10:57:11 +08:00

mention

feat(mentions): support @mentioning issues + server-side auto-expansion (#242)

2026-04-02 13:48:53 +08:00

middleware

fix(security): add Content-Security-Policy response header (#822)

2026-04-13 12:53:39 +08:00

realtime

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

sanitize

fix(sanitize): preserve code blocks and inline code from HTML entity escaping (#774)

2026-04-12 21:32:35 +08:00

service

fix(server): skip auto-comment when agent already posted during task (#712)

2026-04-11 21:27:02 +08:00

storage

fix(storage): clean up variable shadowing and dead code (#761)

2026-04-12 14:06:46 +08:00

util

feat(mentions): support @mentioning issues + server-side auto-expansion (#242)

2026-04-02 13:48:53 +08:00