debpalash 204eff2be1 fix(security): #1213 review — the share PIN must not gate RCE-class admin ...

CodeRabbit: the 6-digit share PIN is brute-forceable (10^6, no lockout), so
letting it unlock admin over the network was still weak. Admin now requires the
API key (a long operator secret) or loopback; the PIN is consumption-only and
never gates /system/* or /api/settings/*. A PIN-only deployment keeps admin
loopback-only. Docs (api-auth.md, remote-gpu.md) aligned with the conditional
gate (no credential -> admin open; API key -> admin) and the PIN exclusion.
Test inverted: presenting the PIN over the network is now 403 on admin.

2026-07-20 22:57:31 +05:30

..

adr

chore: retire finished planning archives from the repo root (#1095)

2026-07-12 11:28:28 +05:30

dubbing

feat(dub): paste a translation from an external source onto existing segments

2026-07-20 13:18:51 +05:30

engines

fix: resolve open issue batch — #1172 #1173 #1174 #1185 #1186 #1188

2026-07-19 04:29:33 +05:30

features

Phase 1 Wave 2: per-OS install docs + Settings UI + error→docs deeplinks (#94)

2026-05-20 06:22:10 +05:30

install

Merge remote-tracking branch 'origin/main' into fix/1177-surface-backend-diagnosis

2026-07-20 15:57:28 +05:30

migration

feat: TTS-only first run, platform-curated ASR, guided OS permissions, parakeet-mlx

2026-07-17 15:20:54 +05:30

playbooks

docs: backfill [0.3.9] batch bullets + add OSS sponsorship playbook (#931)

2026-07-03 17:30:43 +05:30

setup

Phase 1 Wave 2: per-OS install docs + Settings UI + error→docs deeplinks (#94)

2026-05-20 06:22:10 +05:30

specs

docs(specs): dictation flow program — local WhisperFlow-class dictation on Parakeet

2026-07-16 19:14:35 +05:30

superpowers

feat(update): move update pill into status bar + Updates panel (changelog/channel/history) (#240)

2026-06-02 08:53:36 +05:30

agentic-voice.md

docs(agentic): OmniVoice as a TTS/STT provider for pipecat/LiveKit (Wave 2.5) (#366)

2026-06-12 03:57:26 +05:30

api-auth.md

fix(security): #1213 review — the share PIN must not gate RCE-class admin

2026-07-20 22:57:31 +05:30

competitive-analysis.md

feat: TTS-only first run, platform-curated ASR, guided OS permissions, parakeet-mlx

2026-07-17 15:20:54 +05:30

css-to-tailwind-migration.md

docs: add the CSS → Tailwind v4 migration plan (#772)

2026-06-30 14:21:01 +05:30

data_preparation_advanced.md

chore: flatten project by moving all contents from submodule to root

2026-04-10 02:53:23 +05:30

data_preparation.md

chore: flatten project by moving all contents from submodule to root

2026-04-10 02:53:23 +05:30

DESKTOP_RELEASE.md

feat: TTS-only first run, platform-curated ASR, guided OS permissions, parakeet-mlx

2026-07-17 15:20:54 +05:30

desktop-build.md

feat: Scalar API docs, community health files, Quickstart cards (#41)

2026-05-04 10:57:37 +05:30

downloading-models.md

fix: first-run wizard version + mirror-unreachable rescue + lifecycle-aware backend reachability (#1094)

2026-07-12 11:05:00 +05:30

evaluation.md

chore: flatten project by moving all contents from submodule to root

2026-04-10 02:53:23 +05:30

expressive-speech.md

feat: TTS-only first run, platform-curated ASR, guided OS permissions, parakeet-mlx

2026-07-17 15:20:54 +05:30

features.yaml

feat: TTS-only first run, platform-curated ASR, guided OS permissions, parakeet-mlx

2026-07-17 15:20:54 +05:30

generation-parameters.md

fix: bot-review harvest (16 findings) + deterministic style/locale CI + reviewer configs

2026-07-20 09:47:41 +05:30

hardware-notes-tesla-t4.md

docs(agents): add verified Tesla T4 (16GB) inference notes (#1014)

2026-07-09 17:30:05 +05:30

lang_id_name_map.tsv

chore: flatten project by moving all contents from submodule to root

2026-04-10 02:53:23 +05:30

languages.md

chore: flatten project by moving all contents from submodule to root

2026-04-10 02:53:23 +05:30

logo-256.png

fix(ui): Fix segment row layout collapse, memory bugs, enterprise page, and UI enhancements

2026-04-27 00:21:47 +05:30

logo.png

fix(ui): Fix segment row layout collapse, memory bugs, enterprise page, and UI enhancements

2026-04-27 00:21:47 +05:30

logo.svg

fix(ui): Fix segment row layout collapse, memory bugs, enterprise page, and UI enhancements

2026-04-27 00:21:47 +05:30

macos-signing-verification.md

macOS: ad-hoc sign so users open without Terminal + signing/notarization verification (#290)

2026-06-11 13:26:04 +05:30

maintenance-pages-modularization.md

refactor(settings): modularize Settings page (1969→399 lines, all files under 500) (#758)

2026-06-30 03:34:51 +05:30

mcp.json

feat(mcp): MCP server v1 — mount on /mcp, per-agent voice binding, stdio shim (Wave 2.2) (#368)

2026-06-12 11:56:19 +05:30

mcp.md

feat(mcp): clone_voice tool — clone a new voice from reference audio (#1194)

2026-07-19 21:42:12 +02:00

performance.md

Merge remote-tracking branch 'origin/main' into fix/1191-tts-stranded-on-cpu

2026-07-20 15:56:11 +05:30

persona-format.md

docs(persona): document the .ovsvoice portable format (#29 slice D) (#464)

2026-06-14 18:04:59 +05:30

preview.png

refactor: codebase cleanup & root folder reorganization (#38)

2026-05-03 03:12:07 +05:30

RELEASING.md

chore(release): codify all deployment channels as release rules; preview always builds from main

2026-07-16 16:12:31 +05:30

remote-gpu.md

fix(security): #1213 review — the share PIN must not gate RCE-class admin

2026-07-20 22:57:31 +05:30

ROADMAP.md

chore: retire finished planning archives from the repo root (#1095)

2026-07-12 11:28:28 +05:30

screenshot-clone.png

feat: setup wizard, donate page, CI fixes, performance optimizations, and style extraction

2026-04-26 16:47:00 +05:30

screenshot-design.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-dub.png

docs(readme): charm + organization overhaul (Opal-style) — collapsibles + OpenAI-compatible API section (#945)

2026-07-04 20:36:34 +05:30

screenshot-engines.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-gallery.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-launchpad.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-libraryprojects.png

feat: setup wizard, donate page, CI fixes, performance optimizations, and style extraction

2026-04-26 16:47:00 +05:30

screenshot-logs.png

feat: setup wizard, donate page, CI fixes, performance optimizations, and style extraction

2026-04-26 16:47:00 +05:30

screenshot-openapi.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-settings.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-studio.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

screenshot-updates.png

docs(readme): Opal-style restyle + fresh v0.3.9 screenshots (#937)

2026-07-04 18:38:47 +05:30

shadcn-migration.md

feat(ui): back Input/Select/Textarea/Slider with shadcn (prop APIs preserved) (#798)

2026-06-30 21:28:47 +05:30

sharing.md

fix(tailscale): HTTP serve fallback when tailnet lacks HTTPS certs + parallel dev launch (#161)

2026-05-30 12:25:38 +05:30

STRUCTURE.md

chore: retire finished planning archives from the repo root (#1095)

2026-07-12 11:28:28 +05:30

training.md

chore: flatten project by moving all contents from submodule to root

2026-04-10 02:53:23 +05:30

update-channels.md

chore(release): codify all deployment channels as release rules; preview always builds from main

2026-07-16 16:12:31 +05:30

voice-design.md

feat: TTS-only first run, platform-curated ASR, guided OS permissions, parakeet-mlx

2026-07-17 15:20:54 +05:30