SpaceApp setup 1.1.5

SpaceApp setup 1.1.5 answers the independent reviews of 1.1.4: no credentialed CORS for other local origins, optional modules off by default in new installs, a purpose-bound credential key, a provenance check for this public tree, and every workspace test suite in public CI.

Install: npx --yes run-spaceapp@latest · Update: npx --yes run-spaceapp@latest update

Source: sanitized Space app @ 2a53fd9793 (4255 files). Addresses the
independent reviews of 1.1.4; open items are listed in
docs/quality/KNOWN_LIMITATIONS.md.

Security

• The API no longer grants credentialed CORS to other local origins, and
  rejects session requests that browser fetch metadata (or the Origin header)
  marks as another site. A page on another 127.0.0.1 port can no longer
  read the CSRF token or use your session.
• /metrics answers only loopback scrapers and administrators.
• Child processes (agent CLIs, demo projects, browsers, git) no longer receive
  the session secret or the database URL.
• Stored database passwords use a purpose-bound key; an unreadable password is
  reported instead of being used blank. Backups no longer carry the Google
  OAuth client or Telegram secrets.
• Admin Mode refuses to delete direct children of system roots and the
  workspace with its parents, and every Admin Mode file change is audited.
• Third-party images (PostgreSQL, Temporal, codex-lb) are pinned by digest.

Changed

• The UI no longer calls SpaceApp open source: it is source-available (BSL)
  until its Change Date, as the LICENSE says.
• Optional modules: the games, Job, Mail and Marketing Copilot, Slack/Teams
  channels, Telegram, the waitlist and the desktop update routes run only when
  enabled. New installs start with none of them; an upgraded installation keeps
  all of them. Change the optionalModules field of the launcher's
  config.json (all, none or a list such as job-copilot,games) and run
  spaceapp repair (see docs/operations.md).
• A multi-file upload that fails part-way reports which files were saved.
• npm test runs every exported workspace suite; the quality evidence
  (docs/quality/) ships with the code, and
  scripts/verify-export-provenance.mjs checks this tree against its export
  manifest.

Fixed

• When the first-launch free-model check fails, OpenCode still gets the
  installation instructions and its permission for the memory folder, so the
  first task no longer stops at an "Access external directory" prompt. The
  check runs again on the next launch.
• OpenCode may read /etc (read-only in the CLI container, where its startup
  instructions live) without asking; models that read the installation guide
  from there themselves no longer stop the first task at a permission prompt.
• A Claude Code login imported with a configuration bundle also marks Claude
  Code as onboarded, so its pane no longer repeats the first-run login screens.
• A configuration backup exported from a newer SpaceApp now imports what this
  version knows: settings and entries it does not recognise are skipped and
  named in a warning, and a file with a broken structure is still refused.

Known limitations

• WebSocket handshakes (the VNC stream and the shared-chat socket) do not yet get the same-site Origin
  check that 1.1.5 added for other requests, so a page on another local port of the same machine could
  open them with your session, as in 1.1.4. Fixed for 1.1.6. Until then, do not browse untrusted local
  pages in the browser profile you use for SpaceApp.
• OpenCode Zen's free tier can refuse requests for a while ("OpenCode's free tier can only be used from
  within OpenCode"). This is an upstream condition; in the 1.1.5 lab it hit the first prompt of a brand-new
  installation three times and cleared on its own. Retry later, or connect a provider with /connect.
• On the small profile the CLI container has 2 GiB. Two or more OpenCode panes working at once can reach
  that limit; in the 1.1.5 lab one run ended with an out-of-memory kill in the CLI container. Use the
  medium profile (3 GiB) for several simultaneous OpenCode panes. Capacity work for small is planned for 1.1.6.
• If an install fails and its data cannot be purged, installing again into the same folder reuses the old
  database volume and fails with a PostgreSQL authentication error. Run spaceapp uninstall --purge-data
  for that folder first (or install into another folder). 1.1.6 will detect this case.
• PostgreSQL and Temporal are now pinned by image digest. --local-images (offline use) never pulls, so an
  offline machine must have those exact digests loaded; otherwise an update stops with RECOVERY_REQUIRED and
  keeps the data. A normal update pulls them.
• The icon-package guard test (apps/web/tests/app-icons.test.tsx) is excluded from the public suite for
  1.1.5: two Live pane files at the release source still import icons directly. It returns in 1.1.6.
• The web UI suite retries a failed test up to twice when CI is set (long jsdom tests on shared CI
  runners); locally a failure stays a failure.
• The full register of open findings is docs/quality/KNOWN_LIMITATIONS.md.

Evidence

• Lab acceptance for this exact tree (Linux, Windows 11, macOS: install, 1.1.4 → 1.1.5 update, repair, Docker stopped, first agent task, small/medium/large profiles, plus the 1.1.3 upgrade, doctor, update badge and telemetry checks): release/acceptance.json.
• npm run-spaceapp@1.1.5 and the GHCR images (linux/amd64, linux/arm64) carry build provenance attestations.
• node scripts/verify-export-provenance.mjs . checks this tree against PUBLIC_EXPORT_MANIFEST.json.
• Review snapshot: the spaceapp-review-1.1.5 assets of this release.