v0.1.1257

Binaries available at: https://github.com/veryfront/veryfront/releases/tag/v0.1.1257

What's Changed

• Keep runtime inference credentials separate from control-plane authority by @kojiwakayama in #4343
• fix(routing): dispatch explicit OPTIONS handlers by @kojiwakayama in #4346
• release: prepare v0.1.1256 RC by @kwakayama in #4350
• fix: authenticate plain OPTIONS before project middleware by @kwakayama in #4349
• Fix OPTIONS authentication before project middleware by @kojiwakayama in #4351
• Close run-scoped inference authority after settlement by @kojiwakayama in #4348
• fix(agent): revoke middleware continuations after settlement by @kojiwakayama in #4347
• fix(workflow): deprecate unsafe run TTL by @kojiwakayama in #4353
• Fix redaction of CSI-split URL schemes by @kojiwakayama in #4352
• docs(middleware): clarify CORS preflight ownership by @kojiwakayama in #4355
• feat(workflow): add fenced terminal-run retention by @kojiwakayama in #4354
• fix(mdx): keep npm Head on one React runtime by @kojiwakayama in #4357
• docs: document Jira service-account setup by @kwakayama in #4356
• fix(parser): preserve JSX for embedded framework sources by @kojiwakayama in #4358
• fix(storybook): update vulnerable browserslist by @kojiwakayama in #4359
• fix(cli): register bundler before deploy by @kojiwakayama in #4361
• fix(transforms): contain dependency hash reads by @kojiwakayama in #4362
• fix(release): transform materialized project sources locally by @kojiwakayama in #4360
• fix(release): finalize dependency-pinned module paths by @kojiwakayama in #4364
• Preserve cancellation across delayed durable starts by @kojiwakayama in #4366
• fix(cli): register bundler before up by @kojiwakayama in #4363
• fix(cli): resolve relative deploy project directories by @kojiwakayama in #4365
• Fix agent service heartbeat JSON body by @kojiwakayama in #4374
• fix(security): strip authToken cookie before forwarding to project code by @kojiwakayama in #4368
• fix(security): prevent unclosed runtime_context tags from stripping prompt guardrails by @kojiwakayama in #4367
• fix(security): never cache renders carrying an admitted application identity by @kojiwakayama in #4370
• fix(security): redact gate failure evidence in exported eval reports by @kojiwakayama in #4386
• fix(security): keep eval data from restoring disabled agent-service scope by @kojiwakayama in #4397
• fix(security): key module source-miss cache on the requested extension by @kojiwakayama in #4399
• fix(security): stop replayed messages from seeding skill delegation overrides by @kojiwakayama in #4401
• fix(security): detach replay checkpoint appends from shared prototypes by @kojiwakayama in #4402
• fix(security): bound Moonshot tool schema $ref inlining by @kojiwakayama in #4395
• fix(security): keep a gated project's module source out of shared caches by @kojiwakayama in #4392
• fix(security): scope stale MDX ESM cache recovery to mutable content sources by @kojiwakayama in #4391
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /tests/node/resolver-dependencies in the npm_and_yarn group across 1 directory by @dependabot[bot] in #4403
• fix(security): bound prewarm resolver probes by @kojiwakayama in #4385
• fix(security): stop validating env and stored tokens against project veryfront.json apiUrl by @kojiwakayama in #4369
• fix(security): scope hosted workflow Redis state per project by @kojiwakayama in #4371
• fix(security): scope bundled API route module reuse to project and env identity by @kojiwakayama in #4372
• fix(security): bound hosted chat replay validation and remove quadratic scan by @kojiwakayama in #4373
• fix(security): memoize the public stylesheet route's CSS import scan by @kojiwakayama in #4390
• fix(ci): retry npm publish on transient identity token errors by @kwakayama in #4405
• fix(security): key SSR MDX cache namespaces on collision-free source segments by @kojiwakayama in #4389
• fix(security): contain @/ alias paths inside the /_vf_modules/ transport by @kojiwakayama in #4381
• fix(security): harden URL policy in scaffolded chat Markdown renderers by @kojiwakayama in #4382
• fix(security): strip dataset content hash from redacted eval exports by @kojiwakayama in #4384
• fix(security): stop remote schedule runs from executing local veryfront.config.ts by @kojiwakayama in #4376
• fix(ci): give the sentry runtime packages job headroom on its timeout by @kwakayama in #4406
• fix(security): bind direct OTLP metric samples to their export target at enqueue time by @kojiwakayama in #4378
• fix(agent): bind inference token on default chat dispatch by @kwakayama in #4407
• fix(agent): stop a failed detached run from crashing the process by @kwakayama in #4411
• fix(agent): route inference through public API by @kojiwakayama in #4412
• fix(provider): trust internal cluster hostnames for run-scoped inference credentials by @kwakayama in #4413
• fix(security): stop pairing ambient CLI credentials with a repo-supplied veryfront.json apiUrl by @kojiwakayama in #4377
• release: v0.1.1256 by @kwakayama in #4414
• fix(security): stop .vfignore negations from overriding secret ignore defaults by @kojiwakayama in #4387
• release: prepare v0.1.1257 RC by @kwakayama in #4415
• release: v0.1.1257 by @kwakayama in #4417

Full Changelog: v0.1.1255...v0.1.1257