chore: v2.8.15 — Oh My Pi login sharing, omp --allow-home, Markdown Preview default, first-login password

- omp-share.js: an admin's switch (S3) runs omp's own auth broker + gateway as the host on loopback; a member's omp pane reaches it as a scoped client keyed by its pane token (clients file = live omp panes only), runs on --model agenthub/<model>, never holds a credential. - omp catalog: --allow-home, so a workspace at the account's home keeps its sessions there (they were recorded under a temp dir and dropped). - Settings → Appearance → Open Markdown as: Preview (default) or Raw, for Files/Changes, the config viewer and a chat's file panel. - First-login password change and password rules, avatar URLs, Artifacts "Mine" includes installed shared skills/plugins, a member's own hook pages.
2026-10-22 10:04:30 +07:00
parent 8a6dc6a29e
commit 750d74a2af
66 changed files with 3021 additions and 696 deletions
@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
  title: Agent Dashboard for Claude Code API
-  version: 2.8.13
+  version: 2.8.14
  description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
  contact:
    name: Nguyễn Ngọc Trí Vĩ
@@ -12481,6 +12481,42 @@ paths:
            application/json:
              schema:
                $ref: '#/components/schemas/AiToolsView'
+  /api/ai-tools/omp-sharing:
+    get:
+      tags:
+        - AI Tools
+      summary: Oh My Pi login sharing state
+      description: 'Server mode with per-user accounts (S3): whether every member''s omp pane runs on the HOST account''s omp login through omp''s own auth broker + gateway on loopback (server/lib/omp-share.js), and whether both daemons run. Never returns a token.'
+      operationId: aiToolsOmpSharing
+      responses:
+        '200':
+          description: '`{available, enabled, installed, broker: {running, error?}, gateway: {running, port?, error?}}`.'
+    put:
+      tags:
+        - AI Tools
+      summary: Turn Oh My Pi login sharing on or off
+      description: An admin's switch (off by default). On starts `omp auth-broker serve` and `omp auth-gateway serve --clients=…` as the host; off stops them and empties the clients file, so no pane keeps a way in. Same-origin only; audited.
+      operationId: aiToolsSetOmpSharing
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - enabled
+              properties:
+                enabled:
+                  type: boolean
+      responses:
+        '200':
+          description: The new state, as GET.
+        '400':
+          description: EBADFIELD
+        '403':
+          description: Not an admin
+        '409':
+          description: ENOS3 — not server mode with per-user accounts
  /api/ai-tools/{id}:
    put:
      tags:
@@ -14498,7 +14534,7 @@ paths:
      tags:
        - Auth
      operationId: changeMyPassword
-      summary: 'Change the account''s own password: the current one required (throttled); this login stays, every other ends'
+      summary: 'Change the account''s own password: the current one required (throttled); the new one must pass every rule (8+ characters, lower, upper, digit, symbol, not the username) and differ from the current one; this login stays, every other ends; clears mustChangePassword'
      requestBody:
        required: true
        content:
@@ -14518,7 +14554,7 @@ paths:
        '200':
          description: 'Changed ({ok: true})'
        '400':
-          description: EBADPASSWORD
+          description: EBADPASSWORD / EWEAKPASSWORD (error.rules names the failed rules)
          content:
            application/json:
              schema:
@@ -14844,6 +14880,61 @@ paths:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
+  /api/me/avatar/url:
+    post:
+      tags:
+        - Auth
+      operationId: setMyAvatarFromUrl
+      summary: Set the account's picture from an https link the server downloads (public addresses only, at most 3 redirects, PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - url
+              properties:
+                url:
+                  type: string
+                  format: uri
+      responses:
+        '200':
+          description: Set
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MyAccount'
+        '400':
+          description: EBADURL / EPRIVATEURL / EBADIMAGE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '401':
+          description: EAUTH — no login cookie (a pane token is refused)
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '403':
+          description: ELOCALMODE
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '413':
+          description: ETOOBIG
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        '502':
+          description: EFETCH — the link could not be downloaded
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
  /api/users/{id}/avatar:
    get:
      tags: