Lucas WintherandClaude Opus 5.5 ddc66f5be5 feat(ai): encrypt MCP env and headers at rest and mask them in the admin API ...

env/headers are sealed into secretCipher with the BYOK AES-GCM/HKDF box.
The admin GET returns masked values; a mask posted back for the same
server and key keeps the stored value, any other mask is a 400. The chat
and the test button use the stored values. upgradeAiData seals plaintext
v1 rows.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-30 20:33:56 +01:00

..

contracts

fix: final-review wave (CSRF guard, fail-closed owner bootstrap, streamed zips, e2e visibility suite)

2026-10-30 15:42:17 +01:00

core

fix: final-review wave (CSRF guard, fail-closed owner bootstrap, streamed zips, e2e visibility suite)

2026-10-30 15:42:17 +01:00

course-format

feat: resolve Phase 1 contract requests and compose every feature

2026-10-30 15:02:46 +01:00

db

feat: resolve Phase 1 contract requests and compose every feature

2026-10-30 15:02:46 +01:00

feature-ai

feat(ai): encrypt MCP env and headers at rest and mask them in the admin API

2026-10-30 20:33:56 +01:00

feature-import

fix: final-review wave (CSRF guard, fail-closed owner bootstrap, streamed zips, e2e visibility suite)

2026-10-30 15:42:17 +01:00

feature-learner

fix: final-review wave (CSRF guard, fail-closed owner bootstrap, streamed zips, e2e visibility suite)

2026-10-30 15:42:17 +01:00

feature-studio

fix: final-review wave (CSRF guard, fail-closed owner bootstrap, streamed zips, e2e visibility suite)

2026-10-30 15:42:17 +01:00

ui

fix(ui): cover tiles keep the monogram for landscape images; quiet pill header nav

2026-10-30 15:47:01 +01:00