DevvynandClaude Sonnet 5.5 4398dbfad0 feat(mcp): make sync opt-in and address review ...

Opt-in (mcpSyncEnabled, default OFF; routes 403 until on). Review fixes:
- codex TOML read/validated with smol-toml: CRLF, inline tables and
  command-less tables no longer yield a duplicate [mcp_servers.x]; the new
  text is re-parsed before writing
- null-prototype tables and own-key checks; unsafe names ignored at every level
- servers switched off in their own CLI (codex/opencode/antigravity) are not copied
- only CLIs that are installed or already have a config file take part
- files receiving env/headers are left 0600; symlinked configs are written through
- one apply at a time (409), unique tmp files cleaned on failure, failed status
- routes set real HTTP status codes; api-reference section; format type single-sourced

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-02 21:15:31 +08:00

..

admin-routes.ts

fix(webview): revoke proxy capabilities on logout and stamp Referrer-Policy

2026-09-04 15:21:13 +02:00

approval-routes.ts

fix(deepseek): review-driven hardening across the harness integration

2026-08-25 19:01:29 +02:00

case-routes.ts

fix(docker): gate gh/az seeding on its switch; no shared git sign-in for non-admin clones

2026-09-23 14:44:26 +08:00

cli-registry-routes.ts

fix(docker): merge-time fixes for #490

2026-09-28 16:28:29 +02:00

clipboard-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

cron-routes.ts

refactor(cli-registry): make CLI backends data instead of per-mode branching

2026-09-02 08:26:45 +08:00

custom-model-routes.ts

fix(custom-model): split the two confirmation questions, and seed the API key the way claude reads it

2026-09-19 12:32:50 +02:00

file-routes.ts

feat(files): render markdown in the File Viewer, with Lines/Wrap toggles

2026-09-28 01:49:37 -04:00

hook-event-routes.ts

feat(approvals): let a watching session keep quiet, and fix the tui gate

2026-09-22 08:10:05 +02:00

index.ts

feat(mcp): sync MCP servers across enabled CLIs

2026-10-02 18:27:06 +08:00

mcp-sync-routes.ts

feat(mcp): make sync opt-in and address review

2026-10-02 21:15:31 +08:00

me-routes.ts

feat(multiuser): phase 5b, frontend (identity boot + admin panel)

2026-07-20 04:31:30 +02:00

mux-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

orchestrator-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

plan-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

push-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

ralph-routes.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

readmymind-routes.ts

fix(deepseek): close the env-var clamp hole, bound the profile install, make the hook gate per-session

2026-08-24 16:01:02 +02:00

reboot-restore-routes.ts

fix(reboot-restore): the merge-time items from the #442 review

2026-09-18 13:46:04 +02:00

respawn-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

scheduled-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

search-routes.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

session-routes.ts

fix(input): deliver API prompts through tmux so their Enter is not lost

2026-09-28 16:44:59 +02:00

status-telemetry-routes.ts

fix(statusline): print nothing instead of the bare word codeman

2026-09-14 15:59:00 +02:00

system-routes.ts

fix(statusline): GET /api/settings never writes, and a save sends the collection switch only on a flip

2026-09-14 15:59:00 +02:00

tab-layout-routes.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

team-routes.ts

refactor: extract server.ts routes into domain modules (phase 3)

2026-02-28 19:12:45 +01:00

voice-routes.ts

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

webview-routes.ts

fix(webview): route webview:changed only to its owner in multi-user mode

2026-09-26 22:45:35 -04:00

ws-routes.ts

fix(input): an oversized paste no longer poisons the durable input queue (#484)

2026-09-24 18:17:06 +02:00