Commit history for src/server
- Harden the git proxy and bridges before deploy: trust only ok'd refs, restrict v2 commands, fail closed on unloadable thin-pack bases, rate-limit before auth, shorten public raw caching, and charge bridged bytes to the head owner (CI-P6, GIT-P4..P7, P9..P12, GIT-14/PR-12).23526ca⌁taigrr committed
- Close pre-deploy auth gaps: deploy tokens die with repo transfers, password resets and lost admin; token revocation cascades through every descendant; agent tokens minted over REST stay within the caller's grant; TOTP failures lock out persistently; login, email removal, passkey counters, signing-key lookup and sign-out-everywhere hardened.c9c6455⌁taigrr committed
- Move ipBucket into a pure module so its tests cannot be broken by other suites mocking ./limits.643bd46⌁taigrr committed
- Close billing abuse gaps before launch: stop AI calls once tokens are spent, keep org billing owner-only (admins view-only), key rate limits on the IPv6 /64, withhold compute and AI from unverified free accounts and their orgs, and rate-limit scratch git mode and GitHub sign-ups.9058348⌁taigrr committed
- Generate deterministic lava-lamp avatars client-side in place of initials, static by default and drifting on hover, show owner avatars in repo lists, and keep unfinished repos and admin-only private repos out of explore.8e9a6c6⌁taigrr committed
- Merge roadmap/upsellefa5b44⌁taigrr committed
- Merge roadmap/pricing-posthog186686d⌁taigrr committed
- Merge roadmap/stripe-billinga22ce03⌁taigrr committed
- abuse and metering486d635⌁taigrr committed
- Merge roadmap/mergefix-proposals1e3de79⌁taigrr committed
a360a78⌁
- Open a paginated day breakdown under the contribution graph when a day is clicked, and let users show their private contributions to visitors as anonymous counts or keep them hidden.aa762f9⌁taigrr committed
- Sweep imports and forks whose provisioning Workflow was lost: refresh them once, then mark them failed if still pending.e543b2d⌁taigrr committed
- Show commits as their author's account wherever the commit email is one of that account's verified addresses, instead of the raw git name with a mismatched avatar.4e89c38⌁taigrr committed
- Serve GitHub-style .diff and .patch suffixes on commit, pull request and compare URLs so changes can be piped into git apply and git am.7cbad77⌁taigrr committed
- Gate idle self-hosted runner long-polls on per-scope job doorbells so they stop scanning queued jobs in D1 every two seconds until a job is actually queued for their repo or owner.91e0d88⌁taigrr committed
- Credit contributions by verified commit email from a per-repo commit index, let users keep several verified addresses, make mentions survive renames, add repo Insights, and move per-request counters, unread counts, webhook logs and git/download metering off D1 into Durable Objects so write load scales with entities instead of traffic.9517d99⌁taigrr committed
- Cap every non-push-token credential at read on unclaimed scratch repos, site admins and deploy tokens included, so LFS, contents API and web writes follow the git proxy guard459f46f⌁taigrr committed
- Merge roadmap/tests-securitydd86194⌁taigrr committed
- Skip dependency scans whose commit is no longer the default-branch head, so an out-of-order scan can't wipe newer results.056aadd⌁taigrr committed
- Allow loopback webhook sinks and disable rate limits for local e2e runs, only on a loopback forge with the dev flags set.55d6661⌁taigrr committed
- Accept pushes to scratch repositories only with their scratch push token, and return 422 for case-insensitive duplicate labels.f760be0⌁taigrr committed
- Security: tighten the POST-A/B fixes after re-review (entity-decoded camo decisions, own-host images load directly, own-host checks on verify and redirects, SVG badges kept, targeted 5xx masking, same-site user-content as a warning, per-isolate walk dedupe, plan gate on preview tickets).d958823⌁taigrr committed
- Security: fix post-audit feature review findings POST-B1..B7 (AI suggestions billed to the viewer, no owner usage leak, container plan gate on sync/preview, safe admin stop, one background tree walk per key, token imports always private).81d0558⌁taigrr committed
- Security: fix post-merge review findings POST-A1..A8 (user-content redirect with Basic credentials, grant revocation, same-site user-content origin, camo bypasses and self-proxying, rel injection, avatar cache purge, 5xx error messages).9837efb⌁taigrr committed
- Hide failed and in-progress imports from explore, landing, search and other users' profilesf3bf2c9⌁taigrr committed
- Make the unsubscribe-token tamper test deterministic (it was a no-op when the signature began with 1)1b847be⌁taigrr committed
- Dispose Artifacts handles that resolve after a call timeout, and release the status-check handle on failure705afe0⌁taigrr committed