Skip to content

CommandCode Bridge 1.74.0.d

Latest
Latest

Choose a tag to compare

View all tags
@yelixir-dev yelixir-dev released this 04 Oct 05:02
v1.74.0.d
6162389

CommandCode Bridge 1.74.0.d lets you delete a credential from the dashboard without the bridge API key. The CommandCode CLI baseline remains 1.74.0; the 85-model catalog is unchanged.

What changed

  • Deleting a credential and pressing Save used to fail with 401 Unauthorized in any browser that had not stored the client key, and the Credentials tab gave no place to enter it.
  • The delete button on the Credentials tab now asks for confirmation and applies the deletion immediately. No Save, no restart, and no key are needed: the bridge stops using that key for new requests at once, and the deletion is written to the credentials file so it survives a restart.
  • Keys that came from COMMANDCODE_API_KEY(S) or the CLI auth file can be deleted too; the remaining keys are written to the credentials file.
  • The last credential cannot be deleted (add another key first). Unknown ids return 404.
  • Adding or replacing keys, other settings, and restarts still require the bridge API key.

Security notice

Anyone who can reach the bridge can now delete credentials (not add or replace them). A web page on another origin cannot trigger it, because a DELETE needs a CORS preflight that the bridge answers only for the same hostname; DNS rebinding against a loopback-only bridge is not covered. Keep the bridge on a trusted network. See docs/SECURITY.md.

Updating an installation

Install or rebuild this version using the deployment method already in use and restart the managed service. Publishing this release does not update running servers automatically. Verify that /health reports 1.74.0.d afterward. After that, delete keys directly from the Credentials tab.

The attached npm archive contains built runtime files and requires the dependencies declared in package.json; it is not a standalone executable or a complete Docker build context. Use the source archive for a Docker build.

Verification scope

npm run verify passed with 311 tests in 16 files, and GitHub CI passed on Node 20, 22, and 24. A headless browser against the built bridge, with no stored client key, deleted a credential after confirmation, kept it deleted across the dashboard refresh, routed live requests only to the remaining key without a restart, and refused the last key. Live upstream calls and Windows are not covered by those checks.

Assets 4
Loading