xarmian 475a70b57a fix(mcp): harden attachment image resource label + download bound (#933) ...

Follow-up to #930: label the blob from downloaded bytes (TOCTOU fix), bound FetchBytes buffering at the 1 MiB limit, and fix stale 'deferred to TASK-2076' docs. Adversarial-review + Codex findings; Codex CLEAN.

Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra

2026-07-14 15:56:17 -04:00

..

artifact

feat(artifact): MD+frontmatter export/import core for playbooks & conventions (#754)

2026-06-22 11:07:37 -04:00

attachments

fix(ci): gofmt + bump race-detector timeout to 30m (#299)

2026-04-29 15:41:12 -04:00

billing

feat(admin): add /api/v1/admin/billing-stats proxy + cloud client (TASK-827) (#266)

2026-04-27 14:42:53 -04:00

cli

fix(agent): support OpenCode install target (#923)

2026-07-11 19:01:08 -04:00

cmdhelp

feat(cmdhelp): tests + golden contract + drift validator (TASK-938) (#332)

2026-05-01 07:17:58 -04:00

collab

fix(collab): dedup binary frames by content in replay-cursor test (BUG-1924) (#797)

2026-07-03 18:56:26 -04:00

collections

test(collections): drift-guard for NL-canonical playbook invocation (TASK-1862) (#752)

2026-06-21 15:36:47 -04:00

config

feat(security): enforce session UA binding under strict mode (TASK-2056) (#912)

2026-07-10 23:32:22 -04:00

diff

Initial release

2026-03-26 01:52:36 +00:00

email

feat(store): email_verification_tokens + SendEmailVerification + token reaper (TASK-1936) (#806)

2026-07-04 01:19:41 -04:00

events

feat(api): bulk-mutation endpoint + single SSE batch event (TASK-1668) (#669)

2026-05-30 18:41:55 -04:00

items

feat(items): field-level PATCH + conflict envelope + read-only version history (TASK-2022) (#876)

2026-07-08 16:47:34 -04:00

links

feat(backlinks): cross-workspace wiki-links + request-independent ACL (Phase 2b) (#622)

2026-05-24 13:27:40 -04:00

logging

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

mcp

fix(mcp): harden attachment image resource label + download bound (#933)

2026-07-14 15:56:17 -04:00

metrics

feat(metrics): MCP + OAuth observability metrics for /mcp (TASK-961) (#398)

2026-05-03 16:37:49 -04:00

models

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

oauth

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

server

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

store

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

urlimport

feat(urlimport): OpenAPI 3.x → Markdown converter (TASK-1471) (#555)

2026-05-15 00:24:14 -04:00

webhooks

fix(webhooks): track delivery goroutines + bounded retry (BUG-2012) (#864)

2026-07-08 12:02:49 -04:00