Maurice 4fad7f04a9 fix(plugins): serve frame assets root-relative and cross-origin loadable ...

res.sendFile(absolutePath) resolves against the rewritten req.url under
the Nest ExpressAdapter and 404s spuriously (files-download already
works around the same trap), which broke every plugin frame document.
And helmet's CORP: same-origin made the browser drop the opaque-origin
frame's own script/style subresources, so a multi-file plugin client
could never boot. Serve root-relative and mark frame responses
cross-origin — sandbox + per-plugin CSP stay the isolation boundary.

2026-07-14 09:57:57 +02:00

..

db

fix(budget): settle in the trip's real currency, not always EUR

2026-07-13 22:23:13 +02:00

mcp

v3.4.0 (#1527)

2026-07-13 12:40:00 +02:00

middleware

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

nest

feat(trips): let users set the trip currency, and rebase the budget when it changes

2026-07-13 22:23:14 +02:00

plugins

fix(plugins): serve frame assets root-relative and cross-origin loadable

2026-07-14 09:57:57 +02:00

services

feat(help): serve the in-app wiki from disk instead of fetching GitHub

2026-07-13 23:11:59 +02:00

systemNotices

feat(system-notices): replace expiresAt with [minVersion, maxVersion) version gate

2026-04-17 20:03:23 +02:00

utils

fix(security): re-validate LLM endpoint fetch redirects per hop (GHSA-fmq9)

2026-07-11 21:58:14 +02:00

idempotency-cleanup.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

scheduler.test.ts

Bug fixes - April 27th 2026 (#907)

2026-04-28 05:17:20 +02:00

shared-contract.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00