v0.4.1

Changelog

• 9b50abd chore: add .oneleetignore.json to suppress false-positive SAST findings
• 7eae11b chore: merge upstream security and SAST fixes (v0.1.2-v0.1.4)
• 6d5d522 deps(arc-relay): bump golang.org/x/crypto, x/sys, go.opentelemetry.io/otel to clear CVEs
• c31eba1 docs(changelog): record the memory-ingest chunking fix
• 466599a docs(spec): expand dashboard redesign — fold in admin fleet view of /api-keys
• c591e8e feat(api): PUT/DELETE /api/skills/{slug}/upstream
• 37b38ff feat(arc-sync): skill set-upstream / clear-upstream subcommands
• 7da3c52 feat(dashboard): admin form to set/edit/clear skill upstream
• ac2e454 feat(dashboard): expose API-key capability picker
• b0cd71d feat(dashboard): surface skill drift state on /skills pages
• 025d67f feat(web): add buildActivityFeed with 5 unit tests [Task 1]
• 5234e71 feat: add Recent*, CountActiveAPIKeys, ListAllAPIKeys store helpers
• f0d8345 feat: admin fleet view of all API keys at /api-keys?all=1 [Task 4]
• a1ebe01 feat: edit skill metadata in place — visibility/display_name/description
• a7e5e09 feat: real MCP Servers page with 4-stat summary [Task 3]
• cfaf04a feat: rename Servers nav to MCP Servers, show to all authenticated users [Task 5]
• 2266e09 feat: tile-based dashboard with activity feed [Task 2]
• 6f6e21e fix(arc-relay): confine variable file paths (Oneleet SAST file-inclusion)
• 599ff32 fix(arc-relay): hoist CLAUDE.md read so #nosec G304 attaches cleanly
• 846f82b fix(deps): complete go.sum for otel v1.44.0 (go-logr/logr, stdr)
• 2053a18 fix(docker): bump builder image to golang:1.25-alpine for go 1.25 module
• d2c9a5e fix(release): point goreleaser at the current repo owner
• 9bec52b fix(sync): chunk memory ingest so a large delta cannot wedge the watcher
• 2f7eed0 fix(web): address code review findings in dashboard_activity [Task 1]
• 1f3bcf3 fix(web): extract timeAgoStr helper, fix /servers redirect [Task 2]
• d66233e fix(web): handle ListAPIKeys error and preserve fleet context on revoke [Task 4]
• 46089d3 fix(web): unify Flash to struct in handleAPIKeys, remove duplicate Flash block from api_keys.html
• c7b2649 fix: correct error message wording in CountActiveAPIKeys
• 932dca2 fix: correct nosec comment placement on HTTP calls in main.go
• cac1f07 fix: remove extra whitespace on http.Post line
• 50ba2c8 fix: tighten dir permissions and annotate HTTP URL in main.go (SAST)
• 092d56b fix: tighten dir permissions in project/codex.go (SAST)
• e616a7c fix: tighten file permissions in testutil/golden.go (SAST)
• bd1d911 fix: tighten file permissions in testutil/temp_project.go (SAST)
• a5642d4 fix: tighten temp_project.go file/dir permissions to 0600/0750
• 0758e66 security: resolve gosec G703/G710 findings in web handlers