mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-23 00:41:13 +00:00
75f8ed845b
Tighten the browser-based install flow after correctness and adversarial review, without changing the external wizard shape. - Persist the actual bind in server.listen, not the canonical URL - Reject concurrent /install/finish and rapid GitHub App retries - Keep the prior GitHub Token strategy until App callback succeeds - Recover from poisoned install locks instead of propagating panics - Rollback both settings and vault on failed persistence - Redirect GitHub callback errors back into the wizard UI - Validate LLM keys via /models probe instead of a billed generate() - Reject canonical URLs with trailing slash, path, query, or fragment - Accept any valid install-token source, not just the first present one - Redact the install token in structured logs - Assert install-mode SPA marker injection at startup - Warn on suspected concurrent operators via UA + X-Forwarded-For - Add component-level test for the GitHub callback error banner Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| tests/it | ||
| build.rs | ||
| Cargo.toml | ||