Skip to content

v3.3.7 Luxor

Latest
Latest

Choose a tag to compare

View all tags
@amrmelsayed amrmelsayed released this 03 Nov 03:38
· 2 commits to main since this release
v3.3.7
87ec0aa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v3.3.7 Luxor

Released: 2026-11-03

Summary

A single, focused patch on top of 3.3.6: the Codev IDE can now be opened from Tower's local dashboard. Until now a browser on the same machine was refused at Tower's /ide/ route and the IDE was reachable only through Codev Cloud or a hand-built URL. Each workspace card now leads with an IDE row whose Open IDE action opens the workbench for that folder through Tower, with the IDE server's connection token kept out of the browser and rotated on every start. The change was designed and reviewed with a dedicated security pass; the trust notes in the afx ide reference describe what the new session cookie is and where it should not be used.

Open the IDE from the local dashboard (#1869, PR #1872)

Each workspace card on Tower's home page now leads with an IDE row whose Open IDE action opens the Codev IDE workbench for that folder in a new tab, through Tower on port 4100, with no cloud session and no hand-built URL. Behind it, Tower accepts an origin-guarded session cookie for the /ide/ prefix, routes the workbench and its WebSockets through itself, keeps the IDE server's connection token out of the browser's cookie jar, and rotates that token on every IDE server start. The trust notes in the afx ide reference describe the cookie and why the Open IDE path is for single-user machines.

What the live review added: the workbench's own WebSockets are routed through Tower rather than straight to the IDE server, the IDE server's connection-token cookie is stripped from forwarded responses and the token is supplied to the workbench page instead, and the token is regenerated on every IDE server start. Any cross-origin header the IDE server sends that would allow credentialed reads is dropped on the way through.

Breaking changes

None.

Upgrade

npm install -g @cluesmith/codev@3.3.7
afx tower stop && afx tower start
afx ide stop && afx ide start

The VS Code extension is unchanged in this release. The Marketplace listing stays at 3.3.6; the sidebar embedded in the npm package is rebuilt from this release.

Contributors

  • Amr Elsayed (@amrmohamed) — owner: scoped the local IDE access work, ruled on the security residuals, exercised the dev-approval pass live.
  • Builders working under the PIR protocol on PR #1872, with a dedicated security-architect review of the plan and the implementation.

Contributors

amrmohamed
Assets 2
Loading