Repository navigation

fix: guard OAuth destinations against link-local and metadata addresses in every client - #2796

Merged

cliffhall merged 4 commits into

v2/fix/2749-fetch-destination-guard

Oct 25, 2026

Merged

fix: guard OAuth destinations against link-local and metadata addresses in every client#2796
cliffhall merged 4 commits into
v2/mainfrom
v2/fix/2749-fetch-destination-guard

Commits on Oct 25, 2026
- fix(web): guard /api/fetch destinations against link-local and metadata addresses (#2749)
  
  cliffhall
  and
  claude
  committed
  bf5bbd8
- feat: guard OAuth requests in the CLI, TUI and mcpdo too; address review (#2749)
  
  cliffhall
  and
  claude
  committed
  b4a8df5
- fix: route well-known URIs to the OAuth guard under legacy SSE (#2749)
  
  cliffhall
  and
  claude
  committed
  c08a719
- fix: identify MCP traffic by request shape, not origin alone (#2749, #2802)
  
  cliffhall
  and
  claude
  committed
  903c04c