Added new models for Claude Opus 4.8 and GPT 5.4 Mini.

Disabled Cowork

src/app/api/cli-tools/cowork-settings/route.js

@@ -311,6 +311,8 @@ export async function GET() {
 }
 
 export async function POST(request) {
+  // Cowork disabled: spawns arbitrary processes (RCE risk).
+  return NextResponse.json({ error: "Cowork is disabled" }, { status: 403 });
   try {
     const { baseUrl, apiKey, models, plugins, localPlugins, customPlugins } = await request.json();
 

src/app/api/mcp/[plugin]/message/route.js

@@ -5,6 +5,8 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 export async function POST(request, { params }) {
+  // Cowork disabled: MCP stdio bridge spawns arbitrary processes (RCE risk).
+  return NextResponse.json({ error: "Cowork is disabled" }, { status: 403 });
   const { plugin } = await params;
   if (!findPlugin(plugin)) {
     return NextResponse.json({ error: `Unknown plugin: ${plugin}` }, { status: 404 });

src/app/api/mcp/[plugin]/sse/route.js

@@ -4,6 +4,8 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 export async function GET(request, { params }) {
+  // Cowork disabled: MCP stdio bridge spawns arbitrary processes (RCE risk).
+  return new Response("Cowork is disabled", { status: 403 });
   const { plugin } = await params;
   if (!findPlugin(plugin)) {
     return new Response(`Unknown plugin: ${plugin}`, { status: 404 });