## passkey.ts - Issue #1: Add NIP-98 Authorization header to /auth/login/verify fetchWithNip98() signs request with derived privkey; server was returning 401 Construct absolute URL from AUTH_API_BASE or window.location.origin ## link-preview-api/index.js - Issue #2: Add SSRF protection (isPrivateUrl guard) Blocks RFC-1918 private ranges, loopback, link-local, GCP metadata endpoint, cloud metadata 169.254.169.254, IPv6 ULA/loopback before fetching any URL ## image-api/src/server.ts - Issue #3: Add NIP-98 payload hash validation verifyNip98Auth() gains optional rawBody?: Buffer parameter DELETE /image/:imageId passes Buffer.alloc(0) — verifies payload tag absent/empty POST /upload routes pass undefined — skip (multipart body cannot be re-hashed) ## src/lib/db.ts - Issue #4: Fix pruneOldCache per-channel sort order Changed .where('channelId').equals().reverse() (which reversed primary-key/hash order) to .where('[channelId+created_at]').between(...).reverse() so .offset() correctly skips the newest N messages by created_at timestamp ## embedding-api/main.py - Issue #5: Add missing /api/embeddings/store, /list, /search endpoints In-memory namespace->key->entry store; cosine similarity search via numpy ## JSS (css-config.json + Dockerfile + entrypoint.sh) - Switch identity/pod/static.json → dynamic.json to enable /idp/register/ endpoint - Copy dreamlab.json into CSS package config dir so @css: imports resolve - Use --config @css:config/dreamlab.json (previously file.json had static pod mgmt) Co-Authored-By: claude-flow <ruv@ruv.net>

Investigate and report on CIC incorporation #3

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions