evOo-local

History

fix(api): refuse artifact uploads from untrusted origins

Uploads with a text/plain, text/csv or text/markdown body are CORS "simple"
requests that a browser sends cross-site without a preflight. The session
cookie's SameSite default already keeps it off such requests, but a
deployment that relaxes it would accept uploads from any page. The route now
applies the same origin rule as CORS before reading the session.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u

2026-10-03 13:56:47 +00:00

adapter-kit

feat(media): stream artifacts over HTTP with Range support

2026-10-03 13:31:39 +00:00

adapters

feat(media): give agents attached media and larger bot files

2026-10-03 13:53:48 +00:00

auth

Initial clean evOo-local from f00577b

2026-09-20 17:15:16 +02:00

chat-ui

fix(web): keep chat text readable in the light theme (#104 )