- Tambah users_lock (Mutex) di ApiState untuk serialisasi read-modify-write
users.json pada endpoint register; lock hanya dipegang selama operasi
file sinkron (tidak pernah lintas .await, menjaga future tetap Send)
- Hash password dihitung sebelum lock sehingga request concurrent tidak
saling blokir selama hashing Argon2
Security fixes hasil audit:
- fix(auth): refresh token kini memakai claim typ=refresh; access token
tidak bisa dipakai sebagai refresh token (sebelumnya bisa — eskalasi
masa berlaku 1 jam -> 7 hari)
- fix(api): layer JWT hanya melindungi route /sessions dan /chat;
/auth/login, /auth/register, /auth/refresh, /health kini publik
(sebelumnya semua route 401-lock, API tidak bisa dipakai sama sekali)
- fix(ws): endpoint /ws kini memverifikasi token ZESDEX_WS_TOKEN via
query param jika env diset (mencegah pemakaian LLM proxy terbuka)
- feat(api): rate limiting login/register/refresh (20 request / 10 menit
per client IP) memakai RateLimiter yang tadinya dead code
- test(jwt): tambah unit test token type access vs refresh + expired
- Moved `AccessTier` and `SubagentEvent` enums to `zesdex_domain::subagent`.
- Consolidated workflow-related types into `zesdex_domain::workflow`.
- Updated references across the codebase to use the new domain models.
- Refactored tool execution logic to utilize a new `ToolExecutor` trait.
- Enhanced `AgentTurnService` to handle tool calls and events more effectively.
- Adjusted API handlers and state management to align with new domain structure.
feat(bootstrap): create temporary settings and config files to prevent data loss
refactor(edit_log): switch from Vec to VecDeque for efficient memory management
fix(gateway): ensure store directories are created before starting the API server
refactor(bgbash): implement a global singleton for BashControl
feat(auth): enhance session authentication middleware to use SessionRepository
fix(edit_log_repo): update to use VecDeque for in-memory edit log storage
fix(memory_repo): add newline escaping for frontmatter fields
fix(session_lock_repo): improve error handling for lock file operations
fix(bash_tools): prevent path traversal in job_id argument
refactor(delete): enforce empty directory deletion in file system tools
fix(edit): optimize string replacement to only replace the first occurrence
fix(git_cred): improve credential management with piped input to git commands
feat(git_operator): add safety filter to block destructive git operations
fix(shell): register background jobs in Bash control
feat(spawn): add access tier specification for pipeline stages
refactor(hive_mind): run directives concurrently for improved performance
fix(auth): update refresh token verification in the refresh handler
fix(chat): optimize LLM client usage based on model matching
fix(conversations): enhance message deletion to target specific indices
feat(api): add JWT authentication middleware for all API routes
fix(state): implement refresh token verification in JwtTokenService
fix(daemon): improve usage tracking with saturating addition
fix(tui): handle compacted messages in the TUI state management
feat(tui): implement status bar with connection and turn state indicators
feat(tui): create workflow panel for agent status and progress visualization
feat(web): introduce web frontend interface with static file serving
feat(ws): add WebSocket interface for real-time communication and session management
asepharyana