yushen b9a4fa1a6d fix(auth): add CSRF state param, scheme validation, and .envrc to gitignore ...

Add state parameter to CLI browser login flow for CSRF protection — CLI
generates a random state, frontend passes it through, CLI verifies on
callback. Also restrict cli_callback to http: scheme only.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-26 15:04:46 +08:00

..

app

fix(auth): add CSRF state param, scheme validation, and .envrc to gitignore

2026-03-26 15:04:46 +08:00

components

feat: inbox actor tracking, issue detail extraction, UI polish

2026-03-26 12:36:12 +08:00

features

feat(auth): email verification login and personal access tokens

2026-03-26 14:32:30 +08:00

hooks

refactor(web): self-contained shadcn UI with base-nova style and design tokens

2026-03-24 18:19:26 +08:00

lib

refactor(web): self-contained shadcn UI with base-nova style and design tokens

2026-03-24 18:19:26 +08:00

public

Provision default workspaces and harden daemon pairing

2026-03-24 15:19:27 +08:00

shared

feat(auth): email verification login and personal access tokens

2026-03-26 14:32:30 +08:00

test

feat(auth): email verification login and personal access tokens

2026-03-26 14:32:30 +08:00

components.json

refactor(web): self-contained shadcn UI with base-nova style and design tokens

2026-03-24 18:19:26 +08:00

next-env.d.ts

…

next.config.ts

refactor(web): self-contained shadcn UI with base-nova style and design tokens

2026-03-24 18:19:26 +08:00

package.json

fix(web): add missing linkify-it dependency and types

2026-03-24 18:24:30 +08:00

postcss.config.mjs

refactor(web): self-contained shadcn UI with base-nova style and design tokens

2026-03-24 18:19:26 +08:00

tsconfig.json

refactor(web): restructure to feature-based architecture with zustand stores

2026-03-24 16:08:36 +08:00

vitest.config.ts

refactor(web): restructure to feature-based architecture with zustand stores

2026-03-24 16:08:36 +08:00