Skip to content

Avibe

v2.3.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agent agent-os ai ai-agents chatops claude
+11 more
claude-code codex devtools discord-bot lark-bot llm local-first opencode slack-bot vibe-coding wechat

Affected surfaces

auth rbac

Summary

AI summary

Added Vibe Cloud managed remote access with UI flow, introduced a screenshot CLI command, and hardened remote‑access security.

Full changelog

v2.3.0

Highlights

  • You can now set up Vibe Cloud managed remote access, with guided setup in the UI, runtime status reporting, and a sign-out flow for remote sessions (#226, #238, #243, #266).
  • You can now take screenshots from the CLI with a new screenshot command, including follow-up fixes for output handling and filename collisions (#234).
  • The UI has been redesigned across the setup wizard, dashboard, and settings, with better platform configuration flows, improved dark-mode contrast, and multiple polish fixes that make setup and daily use smoother (#250, #254).
  • Fixed a range of remote access and integration issues, including Docker local UI host regressions, Windows Claude resume discovery, Slack link rendering, and more reliable proxy support across IM platforms (#231, #239, #253, #261).

Changes

Added

  • Add Vibe Cloud managed remote access provider and pairing flow (#226).
  • Add a guided remote access setup experience in the UI (#238).
  • Add remote runtime status reporting (#243).
  • Add a new screenshot CLI command (#234).
  • Add an npm avibe entrypoint for CLI distribution (#244).
  • Add a sign-out flow for remote-access sessions in the UI (#266).
  • Add a unified proxy_url configuration across Slack, Discord, Telegram, Lark, and WeChat (#253).
  • Add a collapsible proxy URL field across IM platform setup flows (#254).
  • Add SOCKS proxy support for Telegram and Feishu/Lark integrations (#228).

Changed

  • Redesign the setup wizard, dashboard, and settings UI (#250).
  • Migrate state storage to SQLite for settings, sessions, and service startup migrations (#237).
  • Extend remote-access tunnel session lifetime and renew cookies at half TTL for longer-lived sessions (#256).
  • Unify user-facing copy from “code” to “data” in local-first messaging (#276).
  • Improve npm/CLI distribution support, including command shims and Windows handling (#244, #249).
  • Consolidate shared UI primitives and buttons as internal UI cleanup (#275, #277).

Fixed

  • Fix IM notifications to use Unicode emoji (#224).
  • Fix Claude native resume discovery on Windows and preserve project scoping behavior (#231).
  • Fix default Sentry error volume limiting and related rate-cache handling (#232).
  • Fix Claude remote interactive tools to be disallowed and auto-approve bypass tool permissions to work correctly (#233, #265).
  • Fix remote pairing to send the UI origin and pair tunnels to the correct loopback origin (#236, #242).
  • Fix a regression so Docker local UI hosts are allowed again, with tighter trust checks (#239).
  • Fix tunnel origin parsing and accept escaped OAuth callback state during remote auth flows (#247, #248).
  • Fix the UI to bind to wildcard addresses when tunnel mode is enabled (#252).
  • Fix scheduled task supervision so watch_store is respawned if it dies (#257).
  • Fix remote-access cookie renewal to skip rejected requests (#258).
  • Fix sidebar popup stacking, language listbox alignment, account menu alignment, settings tab styling, and toggle behavior/contrast in the UI (#259, #269, #270, #271, #274).
  • Fix Slack messages so links stay clickable without unwanted previews (#261).
  • Fix broken app-server transports used by Codex flows (#264).
  • Fix storage imports to skip bad discovered chat data instead of failing the whole import (#267).
  • Fix UI rendering churn by stopping wizard step rows from remounting on every render (#255).

Security

  • Harden remote-access validation, routing, host checks, callback redirects, secret redaction, and failure handling to fail closed in more cases (#226 and follow-up commits).
  • Redact proxy URLs in logs and close a Discord SOCKS auth bypass in IM proxy handling (#253).

Full Changelog: https://github.com/cyhhao/vibe-remote/compare/v2.2.14...v2.3.0


v2.3.0

Highlights

  • 你现在可以使用 Vibe Cloud 托管远程访问,并在 UI 中完成引导式配置、查看运行状态,还能主动退出远程登录会话(#226、#238、#243、#266)。
  • CLI 新增了 screenshot 命令,现在可以直接通过命令行截图;同时还修复了输出失败和文件名冲突等问题(#234)。
  • 本次对 安装向导、仪表盘和设置页进行了整体重设计,平台配置流程更顺手,深色模式对比度更好,日常使用体验更流畅(#250、#254)。
  • 修复了多项影响实际使用的问题,包括 Docker 本地 UI 主机回归、Windows 上 Claude 恢复会话发现失败、Slack 链接显示异常,以及多 IM 平台代理支持不一致等(#231、#239、#253、#261)。

Changes

Added

  • 新增 Vibe Cloud 托管远程访问提供方及配对流程(#226)。
  • 新增远程访问引导式配置流程(#238)。
  • 新增远程运行状态上报(#243)。
  • 新增 screenshot CLI 截图命令(#234)。
  • 新增 npm avibe 入口,便于 CLI 分发(#244)。
  • 新增远程访问会话的 UI 退出登录流程(#266)。
  • 新增 Slack、Discord、Telegram、Lark、WeChat 统一的 proxy_url 配置(#253)。
  • 新增各 IM 平台可折叠的代理 URL 配置项(#254)。
  • 新增 Telegram 与 Feishu/Lark 的 SOCKS 代理支持(#228)。

Changed

  • 重设计安装向导、仪表盘与设置界面(#250)。
  • 将状态存储迁移到 SQLite,并在服务启动时执行迁移,覆盖 settings、sessions 等存储(#237)。
  • 延长远程访问隧道会话时长,并在半个 TTL 时自动续期 Cookie,提升长时间会话稳定性(#256)。
  • 统一本地优先相关文案,将面向用户的 “code” 表述调整为 “data”(#276)。
  • 改进 npm/CLI 分发支持,包括命令 shim 和 Windows 兼容处理(#244、#249)。
  • 整理并统一共享 UI 基础组件与按钮实现,作为内部界面清理(#275、#277)。

Fixed

  • 修复 IM 通知中 emoji 显示方式,改为使用 Unicode emoji(#224)。
  • 修复 Windows 上 Claude 原生 resume 发现失败的问题,并保留按项目作用域恢复的行为(#231)。
  • 修复 Sentry 默认错误上报量限制及相关速率缓存处理问题(#232)。
  • 修复 Claude 远程交互式工具未被正确禁用的问题,并修复 bypass 工具权限自动批准逻辑(#233、#265)。
  • 修复远程配对时未发送 UI origin,以及隧道未绑定到正确 loopback origin 的问题(#236、#242)。
  • 修复 Docker 本地 UI host 回归问题,重新允许本地访问,同时补强信任校验(#239)。
  • 修复远程隧道 origin 日志解析问题,并支持处理转义后的 OAuth callback state(#247、#248)。
  • 修复启用 tunnel 时 UI 未绑定到通配地址的问题(#252)。
  • 修复定时任务监督逻辑,在 watch_store 协程异常退出后自动拉起(#257)。
  • 修复远程访问在请求被拒绝时仍尝试续期 Cookie 的问题(#258)。
  • 修复 UI 中侧边栏弹层层级、语言列表框对齐、账户菜单对齐、设置页标签样式,以及开关组件语义与深色模式对比度等问题(#259、#269、#270、#271、#274)。
  • 修复 Slack 消息中的链接预览问题,保持链接可点击(#261)。
  • 修复 Codex 相关流程中的 app-server transport 损坏问题(#264)。
  • 修复存储导入时遇到损坏的聊天发现数据会整体失败的问题,现会跳过坏数据继续导入(#267)。
  • 修复安装向导步骤行在每次渲染时重复 remount 导致的界面抖动问题(#255)。

Security

  • 加强远程访问在校验、路由、主机检查、回调跳转、敏感信息脱敏和异常处理上的防护,在更多场景下默认“失败即拒绝”(#226 及后续相关提交)。
  • 修复 IM 代理处理中的 Discord SOCKS 认证绕过问题,并避免在日志中泄露代理 URL(#253)。

Full Changelog: https://github.com/cyhhao/vibe-remote/compare/v2.2.14...v2.3.0

Breaking Changes

  • Migrated state storage to SQLite for settings, sessions, and service startup migrations (#237).

Security Fixes

  • Harden remote‑access validation, routing, host checks, callback redirects, secret redaction, and failure handling to fail closed in more cases (#226 and follow‑up commits).
  • Discord SOCKS auth bypass fixed and proxy URLs now redacted in logs (#253).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Avibe

Get notified when new releases ship.

Sign up free

About Avibe

All releases →

Related context

Beta — feedback welcome: [email protected]