Codeman maintainer 33f0bc423f fix(multi-user): keep the admin's Deepgram key out of a non-admin's settings read ...

GET /api/settings returned the whole settings.json to every signed-in user.
An admin's App Settings save stores the Deepgram key there
(voiceSettings.apiKey), so any regular user could read it, and their
browser copied it into its own voice config and dictated on the admin's
account. caseOrder and lastUsedCase also named the admin's cases.

In multi-user mode a non-admin now reads the file without those three
(settingsForNonAdmin). Admins and single-user mode get the file as it
is. Pinned by route tests and the live multi-user test.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-16 13:10:59 +02:00

..

admin-routes.ts

feat(admin): count revoked html-view capabilities in the logout audit line

2026-10-13 17:14:00 +02:00

approval-routes.ts

feat(codex): raise a screen-read dialog as BLOCKED, alert-only

2026-10-14 05:18:37 +02:00

case-routes.ts

fix(multi-user): make server-wide settings writes admin-only

2026-10-16 12:06:05 +02:00

cli-registry-routes.ts

fix(cli-install): address review: drop every npm_config_prefix spelling, probe async

2026-10-09 19:42:06 +08:00

clipboard-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

cron-routes.ts

refactor(cli-registry): make CLI backends data instead of per-mode branching

2026-09-02 08:26:45 +08:00

custom-model-routes.ts

fix(custom-model): split the two confirmation questions, and seed the API key the way claude reads it

2026-09-19 12:32:50 +02:00

doctor-routes.ts

fix(doctor): resolve CLIs via searchDirs, single-flight runs, admin-gate the group (#536 review)

2026-10-05 09:11:10 +08:00

file-routes.ts

fix(html-view): a ~/ HTML link renders as a page too (#547/#604 integration)

2026-10-13 18:56:58 +02:00

git-status-routes.ts

fix(git-status): #543 landing fixes

2026-10-09 05:36:57 +02:00

hook-event-routes.ts

fix(approvals): treat DeepSeek permission prompts as terminal-only alerts

2026-10-12 16:16:16 +08:00

html-view-routes.ts

fix(html-view): a ~/ HTML link renders as a page too (#547/#604 integration)

2026-10-13 18:56:58 +02:00

index.ts

feat(worktrees): create, list and remove git worktrees of a local case

2026-10-14 05:16:00 +02:00

mcp-sync-routes.ts

feat(mcp-sync): sync GitHub Copilot CLI's MCP servers too

2026-10-09 18:42:00 +08:00

me-routes.ts

feat(multiuser): phase 5b, frontend (identity boot + admin panel)

2026-07-20 04:31:30 +02:00

mux-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

orchestrator-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

plan-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

push-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

ralph-routes.ts

fix(multi-user): make server-wide settings writes admin-only

2026-10-16 12:06:05 +02:00

readmymind-routes.ts

fix(deepseek): close the env-var clamp hole, bound the profile install, make the hook gate per-session

2026-08-24 16:01:02 +02:00

reboot-restore-routes.ts

feat(agent-skill): give the codeman skill to every agent CLI, not just Claude

2026-10-13 12:33:47 +02:00

respawn-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

scheduled-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

search-routes.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

session-routes.ts

fix(multi-user): make server-wide settings writes admin-only

2026-10-16 12:06:05 +02:00

status-telemetry-routes.ts

fix(telemetry): store the prompt cache only for CLIs whose statusline reports it

2026-10-13 20:45:13 -04:00

system-routes.ts

fix(multi-user): keep the admin's Deepgram key out of a non-admin's settings read

2026-10-16 13:10:59 +02:00

tab-layout-routes.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

team-routes.ts

refactor: extract server.ts routes into domain modules (phase 3)

2026-02-28 19:12:45 +01:00

voice-routes.ts

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

webhook-routes.ts

fix(notifications): main Save keeps webhook edits, glue test, docs and nits (#523 review)

2026-10-04 23:52:41 +02:00

webview-routes.ts

fix(webview): route webview:changed only to its owner in multi-user mode

2026-09-26 22:45:35 -04:00

worktree-routes.ts

fix(#625): never remove a worktree that is, or holds, a Docker case workspace

2026-10-16 01:36:45 +02:00

ws-routes.ts

fix(input): an oversized paste no longer poisons the durable input queue (#484)

2026-09-24 18:17:06 +02:00