feat(preview): authenticated preview gateway, serve mode, and stability fixes - #5

Merged

awtprod merged 10 commits into

feature/command-center-corefrom

fix/web-dev-allowedhosts-loopback

Jul 25, 2026

Commits on Jul 23, 2026

fix(web): disable dev-server host check on loopback binds

atryan
and
claude
committed
b9667ec

Commits on Jul 24, 2026

Add database provider settings page
atryan
committed
056fdaa

Commits on Jul 25, 2026

feat(database): wire Supabase project connections through settings and MCP

atryan
and
claude
committed
12ff5c2
feat(preview): authenticated preview gateway, serve mode, and stability fixes

atryan
and
claude
committed
4028bf3
fix(scripts): read the server manifest through FileSystem and Schema

atryan
and
claude
committed
093aef4
fix(preview-gateway): close four credential-leak paths found in review

atryan
and
claude
committed
e22c944
docs(preview-gateway): record the three residual risks in the module header

atryan
and
claude
committed
c593823
fix(security): validate WebSocket origin and block control-plane loopback ports

atryan
and
claude
committed
55f533c
fix(desktop): give the renderer a real origin so the WS origin check admits it

atryan
and
claude
committed
5a48b28
docs(security): record measured limits of the WS origin and scheme registration
atryan
committed
4004d98