- Add custom-server.js: inject unspoofable socket IP, strip client XFF
(wired into Docker CMD + CLI spawn + build-cli copy)
- loginLimiter: key on trusted x-9r-real-ip, TRUST_PROXY opt-in, global fallback
- Force password change on first remote login while default is in use
- Add /api/auth/reset-password (local-only) so CLI reset writes live SQLite
- CLI settings: reset via API instead of stale db.json
- Fix OAuth modals opening duplicate browser tabs on add-connection
- Add cli:pack / cli:publish scripts
Co-authored-by: Cursor <cursoragent@cursor.com>
## Features
- Add Cline & Kilo Code tool cards
- Tailscale TUN mode for stable Funnel TLS
- Sort APIKEY providers by usage, collapse to top 20
## Improvements
- Local Material Symbols font (no Google Fonts)
- Docker base: Bun → Node 22-alpine
- MITM reads aliases from JSON cache (no native sqlite)
- Stream stall timeout (2 min) in open-sse
## Fixes
- Fal.ai key test: use stable models endpoint
- Replaced `bun run build:bun` with `npm run build` in Dockerfile for consistency.
- Enhanced `DOCKER.md` to include `DATA_DIR` environment variable usage for database persistence.
- Clarified paths for container and host data storage.
- Added `DOCKER.md` documentation to guide users on using Docker with the project.
- Migrated Dockerfile to use `oven/bun:1-alpine` for performance improvements.
- Refined build process and permissions in the container for better compatibility.
- Excluded `.idea/` files in `.gitignore`.
- Enhanced `.npmignore` to clean redundant blank lines.
