Added new models for Claude Opus 4.8 and GPT 5.4 Mini.

Disabled Cowork

src/app/(dashboard)/dashboard/cli-tools/[toolId]/ToolDetailClient.js

@@ -144,6 +144,19 @@ export default function ToolDetailClient({ toolId, machineId }) {
     }
   };
 
+  // Guard removed/unknown tools (e.g. disabled Cowork) to avoid crash on direct URL.
+  if (!tool) {
+    return (
+      <div className="mx-auto flex w-full max-w-5xl flex-col gap-4 px-1 sm:px-0">
+        <Link href="/dashboard/cli-tools" className="inline-flex items-center gap-1 text-sm text-text-muted hover:text-primary w-fit">
+          <span className="material-symbols-outlined text-[18px]">arrow_back</span>
+          Back to CLI Tools
+        </Link>
+        <p className="text-sm text-text-muted">Tool not found or disabled.</p>
+      </div>
+    );
+  }
+
   return (
     <div className="mx-auto flex w-full max-w-5xl flex-col gap-4 px-1 sm:px-0">
       <Link href="/dashboard/cli-tools" className="inline-flex items-center gap-1 text-sm text-text-muted hover:text-primary w-fit">

src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.js

@@ -540,62 +540,19 @@ export default function ProviderLimits() {
       const visibleConnections = await fetchConnections(page);
       setConnectionsLoading(false);
 
-      const cache = getQuotaCache();
-      const nextLoading = {};
-      const cachedQuotas = {};
-      const connectionsToFetch = [];
-      let latestCachedAt = null;
+      // Always fetch fresh quota on mount, no cache display
+      setLoading(buildLoadingState(visibleConnections));
+      setErrors((prev) =>
+        filterQuotaStateByConnections(prev, visibleConnections),
+      );
+      setQuotaData((prev) =>
+        filterQuotaStateByConnections(prev, visibleConnections),
+      );
 
-      visibleConnections.forEach((conn) => {
-        const cachedEntry = cache[conn.id];
-        if (cachedEntry) {
-          nextLoading[conn.id] = false;
-          cachedQuotas[conn.id] = {
-            quotas: cachedEntry.quotas,
-            plan: cachedEntry.plan,
-            message: cachedEntry.message,
-            raw: cachedEntry.raw,
-          };
-          if (cachedEntry.cachedAt) {
-            const cachedTime = new Date(cachedEntry.cachedAt);
-            if (!latestCachedAt || cachedTime > latestCachedAt) {
-              latestCachedAt = cachedTime;
-            }
-          }
-        } else {
-          nextLoading[conn.id] = true;
-          connectionsToFetch.push(conn);
-        }
-      });
-
-      setLoading(nextLoading);
-      setErrors((prev) => {
-        const nextErrors = filterQuotaStateByConnections(
-          prev,
-          visibleConnections,
-        );
-        visibleConnections.forEach((conn) => {
-          if (cache[conn.id]) {
-            nextErrors[conn.id] = null;
-          }
-        });
-        return nextErrors;
-      });
-      setQuotaData((prev) => ({
-        ...filterQuotaStateByConnections(prev, visibleConnections),
-        ...cachedQuotas,
-      }));
-
-      if (latestCachedAt) {
-        setLastUpdated(latestCachedAt);
-      }
-
-      if (connectionsToFetch.length > 0) {
-        await Promise.all(
-          connectionsToFetch.map((conn) => fetchQuota(conn.id, conn.provider)),
-        );
-        setLastUpdated(new Date());
-      }
+      await Promise.all(
+        visibleConnections.map((conn) => fetchQuota(conn.id, conn.provider)),
+      );
+      setLastUpdated(new Date());
     };
 
     initializeData();

src/app/api/cli-tools/cowork-settings/route.js

@@ -311,6 +311,8 @@ export async function GET() {
 }
 
 export async function POST(request) {
+  // Cowork disabled: spawns arbitrary processes (RCE risk).
+  return NextResponse.json({ error: "Cowork is disabled" }, { status: 403 });
   try {
     const { baseUrl, apiKey, models, plugins, localPlugins, customPlugins } = await request.json();
 

src/app/api/mcp/[plugin]/message/route.js

@@ -5,6 +5,8 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 export async function POST(request, { params }) {
+  // Cowork disabled: MCP stdio bridge spawns arbitrary processes (RCE risk).
+  return NextResponse.json({ error: "Cowork is disabled" }, { status: 403 });
   const { plugin } = await params;
   if (!findPlugin(plugin)) {
     return NextResponse.json({ error: `Unknown plugin: ${plugin}` }, { status: 404 });

src/app/api/mcp/[plugin]/sse/route.js

@@ -4,6 +4,8 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 export async function GET(request, { params }) {
+  // Cowork disabled: MCP stdio bridge spawns arbitrary processes (RCE risk).
+  return new Response("Cowork is disabled", { status: 403 });
   const { plugin } = await params;
   if (!findPlugin(plugin)) {
     return new Response(`Unknown plugin: ${plugin}`, { status: 404 });