builderz-labs/mission-control v1.3.0

v1.3.0 — Security Hardening, Claude Sessions & Webhook Retry

on GitHub

What's Changed

Local Claude Code Session Tracking

• Auto-discovers and tracks local Claude Code sessions by scanning ~/.claude/projects/
• Extracts token usage, model info, message counts, cost estimates, and active status from JSONL transcripts
• Background scanner runs every 60s via the scheduler
• GET /api/claude/sessions with filtering (?active=1, ?project=slug), pagination, and aggregate stats
• POST /api/claude/sessions to trigger manual scans
• Configure with MC_CLAUDE_HOME env var (defaults to ~/.claude)

Webhook Retry System

• Exponential backoff with circuit breaker for failed webhook deliveries
• POST /api/webhooks/retry for manual retry of failed deliveries
• GET /api/webhooks/verify-docs for signature verification documentation
• Automatic retry processing via background scheduler

Security Hardening

• Fixed timing-safe comparison bugs in webhook signature verification and auth token validation
• Hardened rate limiter IP extraction — uses rightmost untrusted IP from X-Forwarded-For chain
• Added MC_TRUSTED_PROXIES env var for explicit proxy trust configuration
• Increased password minimum to 12 characters with Zod + runtime validation
• Added Zod validation on PUT /api/tasks bulk status updates

Quality & DX

• All 31 API routes now use structured pino logger (replaced all console.error/console.warn)
• Docker HEALTHCHECK directive added
• Vitest coverage config with v8 provider and 60% thresholds
• Cron job deduplication on read + duplicate prevention on write
• Cron file I/O converted from sync to async
• Jittered WebSocket reconnect backoff (prevents thundering-herd)
• Feed item ID collision fix in live feed

Bug Fixes

• Model display: getModelInfo() always returned haiku for unrecognized models (credit @TGLTommy)
• Feed item key collisions between logs and activities (credit @doanbactam)
• Cron job duplicates in the management panel (credit @doanbactam)

Quality Gates

Contributors

• @TGLTommy — model display bug fix (#67)
• @doanbactam — feed ID fix, jittered reconnect, cron deduplication (#57)
• @rezero-household — WebSocket auth fix (#54), memory dir docs (#55)

Full Changelog: v1.2.0...v1.3.0