- Drop unused email module and media text extraction path
- Remove 12 unused dependencies
- Remove unused imports in server.ts
- Add typecheck and test scripts
- Rewrite AGENTS.md to describe this project
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Require admin auth on interface-local-ip, network-interfaces,
next-listen-port and public-ip (interface-local-ip and public-ip
allowed unauthenticated command injection as root)
- Validate interface names and call ip/curl via execFileSync
- Write host/client WireGuard configs with fs instead of shell
heredocs, validating IPs, AllowedIPs, endpoint and listen port
- Replace rm -rf/cat/mkdir/chmod/test shell calls with fs APIs
- Refuse private media requested through the public media route
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Import types from @moduletrace/bun-sqlite/types now that the package
has an exports map, and guard optional ctx.props in signup server fn.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- setup-main-host-button: live availability status, grab-next-subnet helper, error/success feedback
- setup-wireguard-host: harden generated shell scripts with set -e
- check-private-ip-address-availability: add user access check, drop manual body validation
- setup-main-host: pass host object with wg_ip_address
- install-wg-ui.sh: run service as the invoking user (root or sudo) instead of a dedicated wgui user, and skip systemd/OpenRC daemon setup when NODE_ENV=development
tben
