All pull requests

Pull requests

• fix(security): Content Security Policy for the renderer

  #131·blackenzee opened Oct 26, 2026·

  ·
  1

• perf(frontend): load Monaco without the language services — renderer 34 MB to 17 MB

  #130·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(ui): findings from the redesign review — page edges, link-button hover, i18n, ARIA

  #129·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(mcp): tools for the rest of WDC — sites, services, PHP, Composer, Node, databases, hosts, plugins, backups

  #128·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(mcp): deploy tools call the real routes and can mint every intent they need

  #127·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(mcp): explain refusals to the agent; confirmation status and long-poll; keep the newest log lines

  #126·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(a11y): labels, list semantics and nested controls flagged by axe

  #125·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(mcp): ship the MCP server with the app and add a "Connect an AI client" card

  #124·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(mcp): approvals that survive a closed app, Approve on the Intents page, no stale banners

  #123·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(mcp): persistent grants actually auto-approve MCP-server calls

  #122·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(security): run AI-client read-only SQL in a read-only transaction with limits

  #121·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(ui): consistent form controls and alerts

  #120·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(ui): site page — apply pipeline ruler, breadcrumb title, quiet web server row

  #119·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(ui): bring the remaining pages into the Cobalt style — flat page heads, sentence-case labels, one page edge

  #118·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(settings): AI clients (MCP) section with operator switches per capability group

  #117·blackenzee opened Oct 26, 2026·

  ·
  1

• test: read the site endpoint contract from SiteEndpoints.cs after the Program.cs split

  #116·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(security): Host allow-list against DNS rebinding, narrower CORS, sandboxed renderer

  #115·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(security): write port/token files and the MySQL root password owner-only

  #114·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(security): confine backup ?out= to the backups root; no overwrite; owner-only archive

  #113·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(security): intent gates for MySQL/PostgreSQL root reset and user drop; Cloudflare credentials behind capability + intent

  #112·blackenzee opened Oct 26, 2026·

  ·
  1

• fix(security): MCP policy on matched routes; operator-controlled MCP capabilities

  #111·blackenzee opened Oct 26, 2026·

  ·
  1

• feat: native OS notifications on Windows, macOS and Linux with per-channel settings

  #110·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(ui): Services — list and detail panel with the log tail of the selected service

  #109·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(ui): Sites — state filter, status column, quiet runtime and address cells

  #108·blackenzee opened Oct 26, 2026·

  ·
  1

• feat(ui): Overview — needs-attention list and stack table instead of tiles

  #107·blackenzee opened Oct 26, 2026·

  ·
  1