Repository navigation
Tags: koala73/worldmonitor
Tags
fix(pricing): say API Starter includes the Pro dashboard and is inter… …nal-only commercial use (#9964) * fix(pricing): say API Starter includes the Pro dashboard and is internal-only commercial use API Starter (tier 2) unlocks every Pro gate, but the EULA and Terms said it had no dashboard seat, and its plan card read "Commercial license — for your organization", which buyers read as unrestricted commercial use. Neither matched the product, and API Business's customer-facing right was not spelled out on its card. - EULA, Terms (and the zh EULA): API Starter includes one dashboard seat for the named subscriber under the plan's commercial scope, internal use only. Legal version bumped to 2026-11-01 with digests and PDFs regenerated. - /pro cards: API Starter lists "Full Pro dashboard included (1 named user)" and "Commercial use — internal only, not customer-facing"; API Business reads "Commercial use — in your customer-facing products". Translated into all pro locales, with a quality pass on hu, hr, bg, th, de, ru, sv, it, pt, vi, sw, cs and ko. - Dashboard Settings → API Keys gate names what API Starter adds over Pro and that customer-facing products need API Business. - docs/pricing.mdx, public facts and generated catalog follow the catalog. - tests/pricing-seat-copy now pins the seat and the internal-only label. * fix(i18n): translate the Thai API Starter SDK line the translator left in English * fix(pricing): pin the API Starter dashboard seat line; keep the live-MCP qualifier in hr, fix bg/cs * docs(pricing): name the API Starter dashboard seat in pricing.md and the Chinese Terms
fix(sdk): never send the API key to a redirect target; release SDKs 0… ….1.2 / CLI 0.2.1 (#9580) * fix(sdk): never send the API key to a redirect target; release 0.1.2 / CLI 0.2.1 Go net/http, Python urllib and Node fetch follow redirects and forward custom headers, so a 3xx from a configured endpoint handed X-WorldMonitor-Key (or the TUI session token) to whatever host the Location named. Reproduced against a local 307 to another host: Go (MCP and REST), Python (REST) and the CLI (MCP) delivered the key. - Go: do() runs on a copy of HTTPClient with CheckRedirect = ErrUseLastResponse; the 3xx surfaces as APIError. - Python: default transport uses an opener whose redirect handler refuses; the 3xx surfaces as APIError. - CLI/TUI: MCP, REST and TUI requests use redirect: 'manual'. `list` follows the spec URL's apex->www redirect by hand and keeps the key only while the origin is unchanged. TUI base-URL trim no longer uses a backtracking regex. - Ruby (Net::HTTP) and Rust already refused redirects; Ruby gains the same regression test. Bumps Go/Python/Ruby to 0.1.2 and the CLI to 0.2.1. The Go, Python and Ruby releases also ship the unreleased changes since 0.1.1. * fix(sdk): build the Python opener per request; cancel spec redirect bodies Review follow-ups on #9580: the import-time opener captured proxy env vars too early (regression test added), fetchSpec now cancels each intermediate redirect body, and the Python test server redirects to a fixed path (CodeQL response-splitting alert).
fix(sdk): never send the API key to a redirect target; release SDKs 0… ….1.2 / CLI 0.2.1 (#9580) * fix(sdk): never send the API key to a redirect target; release 0.1.2 / CLI 0.2.1 Go net/http, Python urllib and Node fetch follow redirects and forward custom headers, so a 3xx from a configured endpoint handed X-WorldMonitor-Key (or the TUI session token) to whatever host the Location named. Reproduced against a local 307 to another host: Go (MCP and REST), Python (REST) and the CLI (MCP) delivered the key. - Go: do() runs on a copy of HTTPClient with CheckRedirect = ErrUseLastResponse; the 3xx surfaces as APIError. - Python: default transport uses an opener whose redirect handler refuses; the 3xx surfaces as APIError. - CLI/TUI: MCP, REST and TUI requests use redirect: 'manual'. `list` follows the spec URL's apex->www redirect by hand and keeps the key only while the origin is unchanged. TUI base-URL trim no longer uses a backtracking regex. - Ruby (Net::HTTP) and Rust already refused redirects; Ruby gains the same regression test. Bumps Go/Python/Ruby to 0.1.2 and the CLI to 0.2.1. The Go, Python and Ruby releases also ship the unreleased changes since 0.1.1. * fix(sdk): build the Python opener per request; cancel spec redirect bodies Review follow-ups on #9580: the import-time opener captured proxy env vars too early (regression test added), fetchSpec now cancels each intermediate redirect body, and the Python test server redirects to a fixed path (CodeQL response-splitting alert).
fix(sdk): never send the API key to a redirect target; release SDKs 0… ….1.2 / CLI 0.2.1 (#9580) * fix(sdk): never send the API key to a redirect target; release 0.1.2 / CLI 0.2.1 Go net/http, Python urllib and Node fetch follow redirects and forward custom headers, so a 3xx from a configured endpoint handed X-WorldMonitor-Key (or the TUI session token) to whatever host the Location named. Reproduced against a local 307 to another host: Go (MCP and REST), Python (REST) and the CLI (MCP) delivered the key. - Go: do() runs on a copy of HTTPClient with CheckRedirect = ErrUseLastResponse; the 3xx surfaces as APIError. - Python: default transport uses an opener whose redirect handler refuses; the 3xx surfaces as APIError. - CLI/TUI: MCP, REST and TUI requests use redirect: 'manual'. `list` follows the spec URL's apex->www redirect by hand and keeps the key only while the origin is unchanged. TUI base-URL trim no longer uses a backtracking regex. - Ruby (Net::HTTP) and Rust already refused redirects; Ruby gains the same regression test. Bumps Go/Python/Ruby to 0.1.2 and the CLI to 0.2.1. The Go, Python and Ruby releases also ship the unreleased changes since 0.1.1. * fix(sdk): build the Python opener per request; cancel spec redirect bodies Review follow-ups on #9580: the import-time opener captured proxy env vars too early (regression test added), fetchSpec now cancels each intermediate redirect body, and the Python test server redirects to a fixed path (CodeQL response-splitting alert).
fix(sdk): never send the API key to a redirect target; release SDKs 0… ….1.2 / CLI 0.2.1 (#9580) * fix(sdk): never send the API key to a redirect target; release 0.1.2 / CLI 0.2.1 Go net/http, Python urllib and Node fetch follow redirects and forward custom headers, so a 3xx from a configured endpoint handed X-WorldMonitor-Key (or the TUI session token) to whatever host the Location named. Reproduced against a local 307 to another host: Go (MCP and REST), Python (REST) and the CLI (MCP) delivered the key. - Go: do() runs on a copy of HTTPClient with CheckRedirect = ErrUseLastResponse; the 3xx surfaces as APIError. - Python: default transport uses an opener whose redirect handler refuses; the 3xx surfaces as APIError. - CLI/TUI: MCP, REST and TUI requests use redirect: 'manual'. `list` follows the spec URL's apex->www redirect by hand and keeps the key only while the origin is unchanged. TUI base-URL trim no longer uses a backtracking regex. - Ruby (Net::HTTP) and Rust already refused redirects; Ruby gains the same regression test. Bumps Go/Python/Ruby to 0.1.2 and the CLI to 0.2.1. The Go, Python and Ruby releases also ship the unreleased changes since 0.1.1. * fix(sdk): build the Python opener per request; cancel spec redirect bodies Review follow-ups on #9580: the import-time opener captured proxy env vars too early (regression test added), fetchSpec now cancels each intermediate redirect body, and the Python test server redirects to a fixed path (CodeQL response-splitting alert).
PreviousNext