chore: v2.8.19 — avatar from a link the browser loads, Files groups workspaces by owner

openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 2.8.18
+  version: 2.8.19
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ
@@ -14564,10 +14564,12 @@ paths:
       tags:
         - Auth
       operationId: getMyAvatar
-      summary: The account's own picture (nosniff, sandbox CSP)
+      summary: The account's own picture (nosniff, sandbox CSP), or a 302 to its avatar link
       responses:
         '200':
           description: The image (PNG, JPEG, GIF or WebP)
+        '302':
+          description: Redirect to the account's avatar link
         '401':
           description: EAUTH
           content:
@@ -14846,7 +14848,7 @@ paths:
       tags:
         - Auth
       operationId: setMyAvatarFromUrl
-      summary: Set the account's picture from an https link the server downloads (public addresses only, at most 3 redirects, PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited
+      summary: Set the account's picture to an https link, stored and never downloaded — the avatar GETs answer 302 to it (no userinfo, no localhost/private IP literal, at most 2048 chars). Login cookie only, audited
       requestBody:
         required: true
         content:
@@ -14867,7 +14869,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/MyAccount'
         '400':
-          description: EBADURL / EPRIVATEURL / EBADIMAGE
+          description: EBADURL / EPRIVATEURL
           content:
             application/json:
               schema:
@@ -14884,18 +14886,6 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ErrorResponse'
-        '413':
-          description: ETOOBIG
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '502':
-          description: EFETCH — the link could not be downloaded
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
   /api/users/{id}/avatar:
     get:
       tags:
@@ -14911,6 +14901,8 @@ paths:
       responses:
         '200':
           description: The image (PNG, JPEG, GIF or WebP)
+        '302':
+          description: Redirect to that account's avatar link
         '403':
           description: EADMIN — a developer
           content: