release: v2.5.0 — upstream parity, device sharing, web dashboard - #25
Open
soumyadebroy3 wants to merge 2 commits into
Open
release: v2.5.0 — upstream parity, device sharing, web dashboard#25soumyadebroy3 wants to merge 2 commits into
soumyadebroy3 wants to merge 2 commits into
Conversation
Major upstream-parity release. Adds new providers and cost-accuracy fixes, the context/acting features, and two greenfield subsystems — opt-in LAN device sharing (mutual-TLS) and a loopback-only web dashboard. Nothing network-facing is on by default. - Device sharing: `codeburn share` / `codeburn devices`, mDNS discovery, mutual-TLS + trust-on-first-use cert pinning, 6-digit PIN and approve-style matching-code pairing, bearer tokens bound to the peer cert. Only sanitized aggregates leave the machine — never project names, paths, or session detail. - Web dashboard: `codeburn web`, loopback-only (127.0.0.1, Host/Origin-guarded) React SPA with a granular usage timeline and By Tool / Top Projects / Model Efficiency / Skills / MCP / Subagents panels plus a context explorer. - Context token breakdown, acting layer (optimize --apply, act list|undo|report), overview/audit/price-override commands, Codex credits + a menubar credits hero, Lifetime (all-time) period, and new providers (Grok, zcode, Hermes, Open Design, Zed, LingTai, Devin, ZeroStack). Cursor real composer-context tokens. - Security: pairing confirmation code widened 3 -> 6 digits (collision-resistant); manual host+PIN pairing warns to verify the typed address. tsc clean, 1121 tests pass, Swift menubar and web SPA build.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| path, | ||
| key: ep.identity.key, | ||
| cert: ep.identity.cert, | ||
| rejectUnauthorized: false, |
|
|
||
| constructor(private readonly opts: ShareServerOptions) { | ||
| this.server = createServer( | ||
| { key: opts.identity.key, cert: opts.identity.cert, requestCert: true, rejectUnauthorized: false }, |
| const url = new URL(req.url ?? '/', 'https://localhost') | ||
| const json = (code: number, body: unknown): void => { | ||
| res.writeHead(code, { 'content-type': 'application/json' }) | ||
| res.end(JSON.stringify(body)) |
| res.end(JSON.stringify({ ok: true, name: device.name })) | ||
| } catch (err) { | ||
| res.writeHead(409, { 'content-type': 'application/json; charset=utf-8' }) | ||
| res.end(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) })) |
| startError = err instanceof Error ? err.message : String(err) | ||
| } | ||
| res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' }) | ||
| res.end(JSON.stringify({ ...(await share.status()), error: startError })) |
| } | ||
| } catch (err) { | ||
| res.writeHead(500, { 'content-type': 'application/json' }) | ||
| res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) })) |
Semver-safe lockfile bumps that resolve the high/medium Dependabot alerts in build/test tooling only (none are runtime deps; the published package ships compiled dist/ and is unaffected): - vite: server.fs.deny bypass on Windows alternate paths (HIGH) - vite: launch-editor NTLMv2 hash disclosure (MEDIUM) - ws: memory-exhaustion DoS (HIGH) [root, via vitest] - vite (windows/ Tauri app): server.fs.deny bypass (HIGH) Root now: 0 high/medium; 1 low residual (esbuild dev-server file-read on Windows) left as-is — clearing it needs a major tsx/tsup bump for a low-severity, dev-only, Windows-only issue. Full test suite still green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v2.5.0 — upstream parity, device sharing, web dashboard
Major upstream-parity release. Adds new providers + cost-accuracy fixes, the context/acting features, and two greenfield subsystems. Nothing network-facing is on by default.
Highlights
codeburn share/codeburn devices/status --scope combined. Mutual-TLS with trust-on-first-use cert pinning, 6-digit PIN + approve-style matching-code pairing, bearer tokens bound to the peer cert. Only sanitized aggregates leave the machine — never project names, paths, or session detail (sanitized on send, re-sanitized on receipt).codeburn web— loopback-only (127.0.0.1, Host/Origin-guarded) React SPA: granular usage timeline + By Tool / Top Projects / Model Efficiency / Skills / MCP / Subagents panels + context explorer.codeburn context), acting layer (optimize --apply,act list|undo|report), overview/audit/price-override, Codex credits (+ menubar credits hero), Lifetime period, and new providers (Grok, zcode, Hermes, Open Design, Zed, LingTai, Devin, ZeroStack).Security
Device-sharing crypto surface reviewed adversarially. Pairing confirmation code widened 3 → 6 digits (collision-resistant); manual host+PIN pairing warns to verify the typed address. TLS pinning, token↔cert binding, and the egress boundary verified.
Verification
tscclean · 1121 tests pass · Swift menubar builds · web SPA builds · web dashboard demoed live end-to-end.