- Add HTTP transport (StreamableHTTPServerTransport)
- Add shared server module (src/server/)
- Configure production for hub.descomplicar.pt
- Add SSH tunnel script (start-tunnel.sh)
- Fix connection leak in pg-client.ts
- Fix atomicity bug in comments deletion
- Update docs with test plan for 164 tools
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- fix(pagination): SQL injection em cursor pagination - validação de nomes de campos
- fix(transaction): substituir Math.random() por crypto.randomBytes() para jitter
- fix(monitoring): memory leak - adicionar .unref() ao setInterval
- docs: adicionar relatório completo de bugs (BUG-REPORT-2026-01-31.md)
- chore: actualizar versão para 1.2.4
Security:
- Fix potential SQL injection in Savepoint class by sanitizing savepoint names
- Only allow alphanumeric characters and underscores
- Prefix with "sp_" if name starts with number
- Limit to 63 characters (PostgreSQL identifier limit)
Code quality:
- Add missing radix parameter to parseInt calls in:
- collections.ts (4 occurrences)
- groups.ts (1 occurrence)
- revisions.ts (1 occurrence)
- users.ts (1 occurrence)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New modules:
- export-import.ts (2 tools): export_collection_to_markdown, import_markdown_folder
- desk-sync.ts (2 tools): create_desk_project_doc, link_desk_task
Updated:
- CHANGELOG.md: Version 1.2.1
- CLAUDE.md: Updated to 164 tools across 33 modules
- CONTINUE.md: Updated state documentation
- AUDIT-REQUEST.md: Updated metrics and file list
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- auth.ts: Use suspendedAt instead of isSuspended, role instead of isAdmin
- comments.ts: Use role='admin' for admin user queries
- documents.ts: Use suspendedAt IS NULL for active users
- events.ts: Return actorRole instead of actorIsAdmin
- shares.ts: Use role='admin' for admin user queries
All queries validated against Outline v0.78 schema (10/10 tests pass).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Users: Use role enum instead of isAdmin/isViewer/isSuspended booleans
- Users: Remove non-existent username column
- Groups: Fix group_users table (no deletedAt, composite PK)
- Attachments: Remove url and deletedAt columns, use hard delete
All 10/10 core queries now pass validation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
