2.12.34

What's Changed

• fix(api): close org-create user injection and cross-tenant repo listing by @chocobar in #3379
• fix(frontend): make the login/register dialog input styling theme-aware by @chocobar in #3372
• fix(api): authorize repository and projects in quick-create and clone by @chocobar in #3380
• fix(api): restrict sandbox host registry to admins and runners by @chocobar in #3381
• Keep users in the chat view after archiving the open task by @chocobar in #3385
• fix(api): scope agent memory store queries to user and app by @chocobar in #3384
• fix(api): stop returning API key secrets from key listings by @chocobar in #3383
• Agent-driven multi-PR & multi-spec-task proposals by @lukemarsden in #2382
• Add smoke test marker for spec task 003641 by @lukemarsden in #3387
• Remove smoke test marker for spec task 003641 by @lukemarsden in #3388
• feat(auth): waitlist OIDC sign-ins from outside allowed email domains by @lukemarsden in #3389
• Add user filter to the chat sidebar's projects-and-tasks view by @chocobar in #3386
• fix(frontend): keep chat user filter above projects by @chocobar in #3391
• fix(frontend): reject task URLs with mismatched projects by @chocobar in #3390
• feat(chat): render agent HTML visualizations inline in AgentChat by @nessie993 in #3370
• fix(frontend): scroll the new-chat project picker with a long list by @nessie993 in #3374
• Start sandbox Chrome on the first browser tool call by @lukemarsden in #3393
• feat(sandbox): non-escalating rootless desktop isolation by @chocobar in #3392
• build(desktop): install build-essential in the ubuntu desktop image by @lukemarsden in #3395
• fix(sandbox): drop SYS_ADMIN from rootless desktops by @chocobar in #3397
• fix(api): approve waitlisted users added to an org via project/repo access grants by @lukemarsden in #3394
• fix(hydra): remove SYS_ADMIN from headless rootless containers by @chocobar in #3398
• fix(frontend): wrap long lines in workspace file viewer by @chocobar in #3396
• fix(hydra): recover rootless runtime on session restart by @chocobar in #3401
• fix(webservice): expose project context for alerts by @chocobar in #3399
• feat(hydra): warm rootless desktop Podman golden caches by @chocobar in #3402
• fix(frontend): make admin settings panel usable on mobile viewports by @lukemarsden in #3404
• feat(api): invite one email to several projects; copy invite link; fix unreadable row hover by @lukemarsden in #3400
• Guard streaming against stale prefix overwrites and omitempty patch fields by @lukemarsden in #3405
• fix(desktop): measure BuildKit cache mounts on disk by @lukemarsden in #3406
• feat(desktop): set fresh clones' mtimes to their last commit time by @lukemarsden in #3407
• fix(desktop): give directories deterministic mtimes too by @lukemarsden in #3409
• feat(zed-build): add a 'fast' build profile for dev desktops and golden builds by @lukemarsden in #3410
• fix(vhost): let custom domains actually verify over :80 by @lukemarsden in #3411
• fix(desktop): scope rootless rollout and start on noexec tmpfs by @chocobar in #3403
• fix(webservice): accept upstream HTTP errors during readiness by @chocobar in #3412
• fix(api): use task actor credentials for PR metadata edits by @chocobar in #3382
• fix(webservice): supersede stale deploys and fail missing sandboxes by @chocobar in #3413

Full Changelog: 2.12.33...2.12.34