v0.2.2
0.2.2 (2026-06-13)
Bug Fixes
- auth: OIDC sign-in opens the provider's start endpoint, one button per provider (5e1e9ed)
- auth: only definite rejections invalidate a session — 404 on /auth/me keeps the cookie (413d411)
- auth: run the OIDC flow on the callback host (fixes 'missing pending-state cookie') (bc6f32a)
- auth: scope the browser-login cookie poll to the target origin (7b6f340)