v0.18.0

0.18.0 (2026-07-22)

Added

• admin: mount Resend service card at /admin/services (3c552db)
• authz: object-level authorization on account write actions (69edcfe)
• authz: object-level authorization on contact write actions (c08d61b)
• authz: object-level authorization on contract write actions (12750da)
• authz: object-level authorization on CRM task write actions (8be1abb)
• authz: object-level authorization on lead write actions (747d9dc)
• authz: object-level authorization on opportunity write actions (c0c8379)
• authz: object-level authorization on target write actions (522ac83)
• authz: object-level authorization on target-list write actions (a748ef1)
• authz: parent-scoped authorization on contract line-items (cad5741)
• authz: parent-scoped authorization on opportunity line-items (a973962)
• authz: write-scope asserts for lead, opportunity, contract, target-list, crm-task, line-items (4eead0e)
• dev: Inngest dev server via docker-compose.dev.yml for host development (7596978)
• dev: local pgvector Postgres service for host development (c28e2d4)
• dev: point DATABASE_URL at local Postgres, add db:migrate (0e9b69c)
• dev: seed local database, add db:seed and db:reset (8f4f415)
• mcp: assertScopeOrNotFound adapter for object-level tool authorization (d9e12d2)
• mcp: object-level authorization on project board tools (df19c69)
• mcp: object-level authorization on project comment + document-link tools (b8d967c)
• mcp: object-level authorization on project section tools (a5faf98)
• mcp: object-level authorization on project task tools; drop userBoardWhere (f36e85a)
• mcp: read-scoped authorization on project watch_board (escalation fix) (7f6d2f8)
• net: assertPublicHost — resolve-validate-pin guard against SSRF/DNS-rebinding (e4f8e95)
• net: ip-rules — refuse non-public-unicast addresses (SSRF) (17cbb28)
• security: SSRF host-guard on IMAP test/discover/create sinks (a775e0d)
• security: SSRF host-guard on SMTP send and background IMAP connect (53eeac4)

Fixed

• authz: guard directly-callable convertTarget action (8b9f291)
• authz: use shared opportunity write-scope in setInactiveOpportunity (30f9544)
• db-guard: block empty/unresolvable host instead of passing it (521137f)
• db-guard: close query-string @localhost bypass, fix bracketed IPv6 (8909bc3)
• dev: bind local Postgres to loopback and bound db:wait retries (989e2ed)
• dev: guard db scripts against remote DB and correct local Postgres docs (3482cd0)
• security: authorize Resend key action, harden IMAP/SMTP connect surface (648160f)