Refactor/api endpoints audit - #2729

Merged

diegosouzapw merged 22 commits into

release/v3.8.4from

refactor/api-endpoints-audit

May 26, 2026

Commits on May 25, 2026

fix(openapi): add x-always-protected to shutdown and database routes
diegosouzapw
committed
db57fa9
feat(openapi): add LOCAL_ONLY tier — MCP routes and cli-tools/runtime annotation
diegosouzapw
committed
da63540
fix(openapi): remove non-existent POST from cli-tools/runtime — route is GET-only
diegosouzapw
committed
5651297
fix(openapi): add missing description to POST /api/mcp/stream
diegosouzapw
committed
2f0f620
feat(openapi): pipe vendor extension fields through spec route + security-tiers test
diegosouzapw
committed
2e8bfe1
feat(dashboard): add security tier badges and filters to api-endpoints page
diegosouzapw
committed
0ad089a
i18n(dashboard): replace hardcoded tier filter and badge strings with t() calls
diegosouzapw
committed
e8ac541
feat(openapi): Phase C — document webhooks, tunnels, skills, memory, logs, missing v1 routes
diegosouzapw
committed
d496f88
feat(openapi): Phase D — mark 150+ internal routes with x-internal: true
diegosouzapw
committed
9e64f61
feat(check): add openapi-coverage validation script + test (≥95% threshold)
diegosouzapw
committed
9556e58
feat(check): add openapi-security-tiers cross-reference script
diegosouzapw
committed
9ba1a25
chore(hooks): add openapi-coverage and openapi-security-tiers to pre-commit
diegosouzapw
committed
3af4459
docs(security): add OpenAPI tier documentation section to ROUTE_GUARD_TIERS.md
diegosouzapw
committed
851c09a
fix(openapi): sanitize error message in spec route — Hard Rule #12
diegosouzapw
committed
21b4da7
feat(openapi): reach 100% coverage + i18n all 41 locales
diegosouzapw
committed
3b26ff5
docs(openapi): update stale 95% threshold references to 99%
diegosouzapw
committed
f70fbca

Navigation Menu

Uh oh!

Refactor/api endpoints audit - #2729

Refactor/api endpoints audit#2729
diegosouzapw merged 22 commits into
release/v3.8.4from
refactor/api-endpoints-audit

Commits on May 25, 2026

fix(openapi): add x-always-protected to shutdown and database routes

feat(openapi): add LOCAL_ONLY tier — MCP routes and cli-tools/runtime annotation

fix(openapi): remove non-existent POST from cli-tools/runtime — route is GET-only

fix(openapi): add missing description to POST /api/mcp/stream

feat(openapi): pipe vendor extension fields through spec route + security-tiers test

feat(dashboard): add security tier badges and filters to api-endpoints page

i18n(dashboard): replace hardcoded tier filter and badge strings with t() calls

feat(openapi): Phase C — document webhooks, tunnels, skills, memory, logs, missing v1 routes

feat(openapi): Phase D — mark 150+ internal routes with x-internal: true

feat(check): add openapi-coverage validation script + test (≥95% threshold)

feat(check): add openapi-security-tiers cross-reference script

chore(hooks): add openapi-coverage and openapi-security-tiers to pre-commit

docs(security): add OpenAPI tier documentation section to ROUTE_GUARD_TIERS.md

fix(openapi): sanitize error message in spec route — Hard Rule #12

feat(openapi): reach 100% coverage + i18n all 41 locales

docs(openapi): update stale 95% threshold references to 99%

Commits on May 26, 2026

refactor(media-providers): extract media kind constants from nav component

chore: resolve changelog conflicts

chore: resolve changelog conflicts again

fix(openapi): normalize catch-all path syntax to OpenAPI 3.x standard

test(openapi): add reverse routeGuard→YAML symmetry check for security tiers

chore: resolve merge conflicts