v0.7.39

Public Mirror Bidirectional Sync Dashboard & Webhook Sandbox (#343, #345)

• Public Mirror Bidirectional Sync Dashboard & Monitoring (#343):
  • Implemented lib/mirror-dashboard.js with client methods in lib/gitea-client.js (listPushMirrors, syncPushMirrors, syncPullMirror).
  • Added agent tool gitea_mirror_sync_status to inspect Gitea push mirror statuses, error reports, and commit lag between local main and remote mirrors (github, mirror).
  • Supports dry-run protected forced mirror synchronization (action: sync gated by confirm: true).
  • Integrated mirror synchronization status and commit lag alerting into lib/chip-pr-ci.js (enrichChip) and Git status chip in lib/client.js with non-blocking timeout protection.
  • Added hub actions mirror-status and mirror-sync in lib/routes-hub.js.
• Webhook Sandbox & Event Replayer (#345):
  • Implemented lib/webhook-sandbox.js featuring an isolated 20-entry FIFO ring buffer of raw incoming webhook requests.
  • Automatically captures incoming POST requests on /dsh-gitea/webhook with timestamp, event type, action, raw byte size, client IP, delivery headers, and HMAC-SHA256 signature validation status (valid, invalid, unsigned, unconfigured).
  • Automatically sanitizes sensitive tokens, API keys, passwords, and private keys from buffered payloads (sanitizeWebhookPayload).
  • Added event replay functionality (replayWebhook) to re-inject buffered or simulated events into eventsStore, giteaEventsService event bus, and push notification dispatcher without contacting external Gitea or GitHub servers.
  • Added agent tool gitea_webhook_sandbox (list, get, replay, clear with confirm: true gate).
  • Added hub actions webhook-sandbox, webhook-sandbox-get, webhook-replay, and webhook-clear in lib/routes-hub.js.
• Route Architecture Modularization:
  • Extracted Gitea Hub endpoint execution into dedicated modular handler lib/routes-hub.js (287 lines), reducing lib/routes.js to 435 lines to strictly enforce the < 600 line limit across all route modules.

v0.7.38

Intelligent Reviewer Auto-Assignment, Branch Protection & Deploy Keys Security Audit (#339, #342)

• Intelligent Reviewer Matcher & CODEOWNERS Auto-Assignment (#339):
  • Implemented lib/reviewer-matcher.js supporting multi-location discovery across CODEOWNERS, .gitea/CODEOWNERS, .github/CODEOWNERS, and docs/CODEOWNERS.
  • Implemented glob pattern matching (*, **, file extensions, directory prefixes) with standard git precedence (later matching rules override earlier ones).
  • Integrated git blame / commit log contributor ranking fallback when explicit CODEOWNERS rules are absent for modified files.
  • Automatically filters out PR author to prevent self-assignment and provides confidence metrics (high, medium) with rationale.
  • Added agent tool gitea_suggest_reviewers (in lib/tool-defs/reviews.js and lib/handlers/reviews.js) and integrated automated reviewer recommendations into PR creation (lib/issue-to-pr.js).
• Branch Protection Governance & Deploy Keys Security Audit (#342):
  • Extended lib/gitea-client.js with comprehensive branch protection and deploy key administration endpoints.
  • Implemented lib/branch-protection.js with policy inspection, enforcement (required_approvals, block_force_push, branch deletion rules), and dry-run preview before mutations (confirm: true gate).
  • Implemented deploy keys management (gitea_deploy_keys) with read-only/write access inspection, creation, and secure deletion.
  • Implemented automated repository security audit (gitea_security_audit) assessing branch protections, deploy key risks, and push rules.
  • Integrated branch protection audit checks into repository health diagnostics (lib/project-health.js).
  • Added agent tools gitea_branch_protection_get, gitea_branch_protection_set, gitea_deploy_keys, and gitea_security_audit (in lib/tool-defs/repos.js and lib/handlers/repos.js).

v0.7.37

Domain Handlers & Tool Definitions Architecture, Conventional Commits SemVer & Packages Registry (#354, #344, #337)

• Domain Handlers & Tool Definitions Decomposition (#354):
  • Decomposed monolithic lib/handlers.js (1538 lines) and lib/tool-defs.js (940 lines) into dedicated domain submodules (lib/handlers/ and lib/tool-defs/ for issues, prs, releases, repos, reviews, worktrees, formatters, and common helpers).
  • Enforced strict < 600 lines per file architecture constraint across all hand-written source code (every decomposed module is between 25 and 281 lines).
  • Preserved 100% public contracts, legacy tool aliases, and export signatures via root facades lib/handlers.js (~115 lines) and lib/tool-defs.js (1 line).
• Conventional Commits SemVer Analyzer & Release Generator (#344):
  • Implemented lib/release-generator.js with automated commit parsing according to Conventional Commits specification.
  • Automatically calculates next SemVer version (calculateSemverBump, bumpVersion) based on breaking change markers (!, BREAKING CHANGE: footer), new features (feat:), and fixes/chores.
  • Generates structured, grouped Markdown changelogs with scopes, PR links, and author attribution.
  • Integrated automated security scanner (scanReleaseTextForSecrets) to detect and sanitize private IPs and leaked credential tokens from release notes.
  • Added agent tool gitea_release_plan and wired into release assistant workflow.
• Gitea Package Registry Integration (#337):
  • Implemented lib/package-registry.js with client methods in lib/gitea-client.js (listPackages, getPackage, deletePackageVersion).
  • Added agent tools gitea_packages_list, gitea_package_get, gitea_package_delete (gated by confirm: true with dry-run preview), and gitea_package_config.
  • Supports client configuration generation for npm (.npmrc), PyPI (~/.pypirc), OCI/Docker (docker login), and Generic packages.

v0.7.36

Release v0.7.36

v0.7.35

Release v0.7.35

v0.7.34

Release v0.7.34

v0.7.33

Release v0.7.33

v0.7.32

Release v0.7.32

v0.7.31

DSH Connection Authentication & Route Security Boundary (#346, #347)

• Host Connection Authentication (#346, #347): Integrated DSH Host Connection Service (ctx.connection.requestRejection(req)) across all read and write routes (/dsh-gitea/config, /events, /git-status, /git-graph, /sse, /release-assistant, /hub), enforcing strict authentication for external LAN/WAN clients and rejecting unauthenticated requests with HTTP 401 Unauthorized or 403 Forbidden.
• Write Guard Bypass Remediation (#346): Eliminated reliance on spoofable client headers (Host, Origin, Sec-Fetch-Site) for write route authorization, preventing unauthenticated remote tampering with baseUrl and tokenEnv on POST /dsh-gitea/config and securing GITEA_TOKEN against exfiltration.
• Fail-Closed Socket Gating (#346, #347): Requests on active network sockets with missing or unknown remoteAddress strictly fail closed with HTTP 403.
• Loopback Fallback Isolation (#347): In test/standalone environments without the Connection service, endpoints fall back strictly to local loopback (127.0.0.1, ::1), denying non-loopback network access.

v0.7.30

Security Hardening & Settings Deserialization (#333)

• Hub Actions Write Guard (#333): Enforced rejectUntrustedWrite fail-closed guard on POST /dsh-gitea/hub endpoint (lib/routes.js) for PR approval, merging, closing, and worktree garbage collection actions, preventing cross-site request forgery and same-site cross-origin traversal.
• Settings Describe Row Status Resilience (#333): Treated row.status as optional in readServedConfig (lib/index.js), ensuring valid configuration documents returned by settingsSvc.describe() on DSH host startup are successfully restored and applied to dynamicConfig.