Audit fixes: revive the API, close the token leak, make self-hosting the default - #19

Merged

Bogzx merged 14 commits into

mainfrom

audit/fixes-and-features

Aug 17, 2026

Commits on Aug 17, 2026

Fix infinite recursion in tracedGenerate; add apps/api test suite
claude
committed
94cb497
Surface /coach LLM failures; default auto-create off; drop leaked token; add LICENSE
claude
committed
4696417
Add wiki markdown export (GET /wiki/export)
claude
committed
475a75d
Add hot-path DB indexes; correct schema.sql table count
claude
committed
47d68eb
README honesty pass: correct six claims that describe a different product
claude
committed
83b008a
Remove root clutter
claude
committed
51953ed
Move duplicated response types into @trailhead/shared
claude
committed
41083b7
Check the .mjs sources and verify .d.mts declarations against them
claude
committed
c8f8612
Landing page: ship production React instead of the development builds
claude
committed
3e7d607
Add license: MIT to seven of the nine manifests
claude
committed
42c1c06
Narrow the bubble classifier and scope the DOM scan
claude
committed
1c11677
Stop GET /teams leaking every tenant's token; make self-hosting the default
claude
committed
9599e64
README: document the compose quick start, /wiki/export and the new /teams
claude
committed
eda1164
Review fixes: correct npx trailhead-mcp docs; drop dead unauth listTeams client

Bogzx
and
claude
committed
ac8e2bc