v13.3.0 - Agent Tooling, Tests & Security

Upgrade notes

• CSRF is enforced on every POST, PUT and DELETE. Plain HTML forms in custom templates need <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">; axios on layout.html pages sends the token automatically.
• checks.py is replaced by uv run pytest. Point TEST_DATABASE_URI only at a disposable database; the suite drops every table.
• Run uv sync to pick up Flask-Security-Too 5.9.1.

Security

• Flask-Security-Too 5.9.1 fixes an open redirect (GHSA-ccgp-pv8r-95wm).
• CSRF protection for the whole app. The admin JSON API previously accepted POST and DELETE requests without a token.

Added

• flask mcp: a local, read-only MCP server that gives coding agents the live routes, schema with row counts, migration revision and audit log. Install with uv sync --extra mcp; .mcp.json registers it.
• pytest suite: route access for anonymous users and non-admins, login and POST-only logout, audited admin CRUD, CSRF, migration drift and setup.sh modes. CI runs it on PostgreSQL across Python 3.11 to 3.14.
• setup.sh --docker, and prompt-free setup when there is no terminal (agents, CI).
• vendor.sh pins and downloads Vue, Vuetify and axios.
• /llms.txt starter file.

Fixes

• The activity log API crashed as soon as any activity existed.
• flask add-role never saved the role and crashed when the role was missing.
• migrations/env.py no longer uses get_engine(), which Flask-SQLAlchemy 3.2 removes.

Other

• AGENTS.md is the single agent guide for Claude Code, Codex, Cursor and others; the enferno-dev skill lives in .agents/skills/. Removed the stale .windsurfrules.
• Vue 3.5.43, Vuetify 3.13.6, axios 1.20.0, SQLAlchemy 2.1.4 and other dependency updates.