Cherry-pick upstream + post-merge code review fixes (security, dedup, MCP encryption)#2

Merged

Lef-F merged 26 commits into

mainfrom

lef/upstream-merge

May 12, 2026

Commits on May 8, 2026

fix(security): fail fast when download HMAC secret is missing

Metbcy
authored and
Lef-F
committed
fix(security): remove persisted raw Claude stream log

fayerman-source
authored and
Lef-F
committed
fix(projects): validate folder ownership before folder mutations

fayerman-source
authored and
Lef-F
committed
fix(chat): require project access on chat creation endpoint

ryanmcdonough
authored and
Lef-F
committed
feat: Add OpenRouter as third LLM provider

Charles Becker
authored and
Lef-F
committed
chore(self-host): apply incremental migrations after the one-shot schema
Lef-F
committed
feat(mcp): add user-configurable Connectors with OAuth 2.1

ZachLaik
authored and
Lef-F
committed
chore(self-host): wire OPENROUTER_API_KEY, BACKEND_PUBLIC_URL, DOWNLOAD_SIGNING_SECRET into compose
Lef-F
committed
fix(security): add RLS policies to projects, chats, and chat_messages

ryanmcdonough
authored and
Lef-F
committed
fix(security): harden data access, document uploads, and secret handling

kveton
authored and
Lef-F
committed
chore(self-host): renumber security migration + fix incremental migration ordering
Lef-F
committed
chore(self-host): generate and pass DOWNLOAD_SIGNING_SECRET + USER_API_KEYS_ENCRYPTION_KEY
Lef-F
committed
chore(self-host): use --legacy-peer-deps for backend npm ci
Lef-F
committed
fix(security): require DOWNLOAD_SIGNING_SECRET for MCP OAuth state tokens
Lef-F
committed
fix(security): include user_mcp_servers in PostgREST lockdown
Lef-F
committed
fix(security): SSRF guard on MCP server URLs + clear creds on URL change
Lef-F
committed
fix(mcp): cap tool output bytes + structured ok/truncated result
Lef-F
committed
fix(security): lowercase emails on shared_with lookups + jsonb form in tabular
Lef-F
committed
fix(llm): three OpenRouter bugs (debug log, tool-call id, model slugs)
Lef-F
committed
fix(upload): scan first 1024 bytes for PDF + drop JSZip private-API zip-size guard
Lef-F
committed
fix(frontend): 3 post-merge bugs (auth race, openrouter tabular, provider tooltip)
Lef-F
committed
refactor(backend): consolidate handleDocumentUpload to a single home
Lef-F
committed
refactor(frontend): extract apiKeysFromProfile helper to remove 4-fold dup
Lef-F
committed
refactor(backend): centralize provider-key encrypt/decrypt mapping
Lef-F
committed
refactor(backend): use native Buffer base64url everywhere
Lef-F
committed
feat(mcp): encrypt headers + oauth_tokens at rest with lazy upgrade
Lef-F
committed