Aug 8, 2026

1. Z
   chore: dedupe .gitignore, refresh lib/export lifecycle, drop obsolete cybersecurity.md

   zhenyi · 2 months ago

   efffb85
2. Z
   refactor(apphost): switch to clap-based CLI with serve and openapi subcommands

   zhenyi · 2 months ago

   74ba1ef
3. Z
   refactor(agent): extract OpenAI provider into agent/llm/provider/ module with openai subdir and tests

   zhenyi · 2 months ago

   2360a4a
4. Z
   refactor(lib): trim docs in lib/db repo_branch_protection_policy and lib/user profile types

   zhenyi · 2 months ago

   9d1724d
5. Z
   refactor(lib): trim verbose doc comments across dvcs/gitsmart, dvcs/gitssh, lib/repo, lib/issues

   zhenyi · 2 months ago

   68129bc
6. Z
   refactor(agent): simplify agent/llm types, error, fallback, register, skill and token modules

   zhenyi · 2 months ago

   6286449
7. Z
   Merge H1-H9 security fixes from worktree-h5-deny-list

   zhenyi · 3 months ago

   8d8ade6
8. Z
   chore(workspace): add agent/llm to workspace members and regenerate lockfile

   zhenyi · 3 months ago

   63c0b1c
9. Z
   refactor(export): make fmt_ts public for cross-crate timestamp formatting reuse

   zhenyi · 3 months ago

   21dc66f
10. Z
    feat(agent): add agent/llm crate (LLM abstraction layer with providers, embeddings, fallback, skills, types)

    zhenyi · 3 months ago

    579d39a
11. Z
    fix(git): enforce branch/tag protection at receive-pack time + schema columns (H6)

    zhenyi · 3 months ago

    ae79314
12. Z
    fix(ssh): per-channel buffer cap + enforce max_sessions (H7)

    zhenyi · 3 months ago

    086661f
13. Z
    fix(chat): scope idempotency keys by sender + ownership-check lookup (H8)

    zhenyi · 3 months ago

    0b1bd0b
14. Z
    fix(repo): enforce per-repo Read authz on all read-side usecases (H2)

    zhenyi · 3 months ago

    c298621
15. Z
    fix(auth): issue channel-membership check + profile PII redaction + end_room pre-authz (H3/H4/H9)

    zhenyi · 3 months ago

    aaf1302
16. Z
    fix(auth): wire JWT deny-list across repo/issues/chat + restrict SSH + suspend-as-inactive (H5)

    zhenyi · 3 months ago

    b782c17
17. Z
    chore(workspace): add lib/mcp to workspace, regenerate lockfile, add mcp defaults to default.yaml

    zhenyi · 3 months ago

    deeed92
18. Z
    feat(webapi): mount MCP routes and initialize MCP server in apphost

    zhenyi · 3 months ago

    52a935e
19. Z
    feat(config): add mcp section to central lib/config crate and refresh app/lib wiring

    zhenyi · 3 months ago

    087d727
20. Z
    feat(mcp): add lib/mcp crate (Model Context Protocol server with auth, access_key, ip_filter, tools, router, service)

    zhenyi · 3 months ago

    5562e7e
21. Z
    refactor(lib): trim CWE-fix follow-up comments and unused helpers across auth, webhook, gitauth, gitssh

    zhenyi · 3 months ago

    34204f3
22. Z
    refactor(repo): drop unused permission helpers and lifecycle authz scaffolding

    zhenyi · 3 months ago

    3609d73
23. Z
    refactor(obs): drop unused features and trim verbose comments in lib/obs and config obs section

    zhenyi · 3 months ago

    87e7190
24. Z
    docs: add cybersecurity notes

    zhenyi · 3 months ago

    41414ba
25. Z
    Merge branch 'worktree-fix-c3-ssh-authz'

    zhenyi · 3 months ago

    d5a1a44
26. Z
    fix(gitssh): drop unconditional RepoRead scope for SSH actors (CWE-863)

    zhenyi · 3 months ago

    32223f2
27. Z
    fix(repo): populate ActorContext.credential_max after C2 merge

    zhenyi · 3 months ago

    e77f56a
28. Z
    Merge branch 'worktree-fix-c1-repo-authz'

    zhenyi · 3 months ago

    a437e2c
29. Z
    fix(repo): 接入生命周期与全部写接口的权限校验 (CWE-306)

    zhenyi · 3 months ago

    ceb547e
30. Z
    fix(gitauth): bind git credentials to the account; auth via access keys (PAT)

    zhenyi · 3 months ago

    1588610