This release tightens default security by binding the server to loopback, restricting CORS, and rejecting cross-origin WebSocket connections. It also fixes running the dashboard on Windows and SELinux hosts, and improves structured output summaries.
Breaking Changes
The server now binds to loopback (localhost) and restricts CORS by default, so the dashboard is no longer reachable from other machines or cross-origin pages out of the box. If you access the dashboard remotely or from a different origin, you'll need to explicitly configure the server's host binding and allowed origins to opt back in.
Features
- Structured output summaries now include the field name for clearer context.
Fixes
- Bind the server to loopback and restrict CORS by default to prevent unwanted network access.
- Reject cross-origin WebSocket connections.
- Correctly mount transcript directories on Windows and fix the health check's database path.
- Relabel Docker bind mounts on SELinux hosts so containers can access them.
- Render the agent combobox and session icons on unassigned sessions.
Other
- Hardened the test suite (hermetic hook-autostart test, localStorage polyfill for jsdom on Node 26).
- Bumped better-sqlite3 and applied Prettier formatting across the codebase.