HelixML 2.12.34

What's Changed

• fix(api): close org-create user injection and cross-tenant repo listing by @chocobar in https://github.com/helixml/helix/pull/3379
• fix(frontend): make the login/register dialog input styling theme-aware by @chocobar in https://github.com/helixml/helix/pull/3372
• fix(api): authorize repository and projects in quick-create and clone by @chocobar in https://github.com/helixml/helix/pull/3380
• fix(api): restrict sandbox host registry to admins and runners by @chocobar in https://github.com/helixml/helix/pull/3381
• Keep users in the chat view after archiving the open task by @chocobar in https://github.com/helixml/helix/pull/3385
• fix(api): scope agent memory store queries to user and app by @chocobar in https://github.com/helixml/helix/pull/3384
• fix(api): stop returning API key secrets from key listings by @chocobar in https://github.com/helixml/helix/pull/3383
• Agent-driven multi-PR & multi-spec-task proposals by @lukemarsden in https://github.com/helixml/helix/pull/2382
• Add smoke test marker for spec task 003641 by @lukemarsden in https://github.com/helixml/helix/pull/3387
• Remove smoke test marker for spec task 003641 by @lukemarsden in https://github.com/helixml/helix/pull/3388
• feat(auth): waitlist OIDC sign-ins from outside allowed email domains by @lukemarsden in https://github.com/helixml/helix/pull/3389
• Add user filter to the chat sidebar's projects-and-tasks view by @chocobar in https://github.com/helixml/helix/pull/3386
• fix(frontend): keep chat user filter above projects by @chocobar in https://github.com/helixml/helix/pull/3391
• fix(frontend): reject task URLs with mismatched projects by @chocobar in https://github.com/helixml/helix/pull/3390
• feat(chat): render agent HTML visualizations inline in AgentChat by @nessie993 in https://github.com/helixml/helix/pull/3370
• fix(frontend): scroll the new-chat project picker with a long list by @nessie993 in https://github.com/helixml/helix/pull/3374
• Start sandbox Chrome on the first browser tool call by @lukemarsden in https://github.com/helixml/helix/pull/3393
• feat(sandbox): non-escalating rootless desktop isolation by @chocobar in https://github.com/helixml/helix/pull/3392
• build(desktop): install build-essential in the ubuntu desktop image by @lukemarsden in https://github.com/helixml/helix/pull/3395
• fix(sandbox): drop SYS_ADMIN from rootless desktops by @chocobar in https://github.com/helixml/helix/pull/3397
• fix(api): approve waitlisted users added to an org via project/repo access grants by @lukemarsden in https://github.com/helixml/helix/pull/3394
• fix(hydra): remove SYS_ADMIN from headless rootless containers by @chocobar in https://github.com/helixml/helix/pull/3398
• fix(frontend): wrap long lines in workspace file viewer by @chocobar in https://github.com/helixml/helix/pull/3396
• fix(hydra): recover rootless runtime on session restart by @chocobar in https://github.com/helixml/helix/pull/3401
• fix(webservice): expose project context for alerts by @chocobar in https://github.com/helixml/helix/pull/3399
• feat(hydra): warm rootless desktop Podman golden caches by @chocobar in https://github.com/helixml/helix/pull/3402
• fix(frontend): make admin settings panel usable on mobile viewports by @lukemarsden in https://github.com/helixml/helix/pull/3404
• feat(api): invite one email to several projects; copy invite link; fix unreadable row hover by @lukemarsden in https://github.com/helixml/helix/pull/3400
• Guard streaming against stale prefix overwrites and omitempty patch fields by @lukemarsden in https://github.com/helixml/helix/pull/3405
• fix(desktop): measure BuildKit cache mounts on disk by @lukemarsden in https://github.com/helixml/helix/pull/3406
• feat(desktop): set fresh clones' mtimes to their last commit time by @lukemarsden in https://github.com/helixml/helix/pull/3407
• fix(desktop): give directories deterministic mtimes too by @lukemarsden in https://github.com/helixml/helix/pull/3409
• feat(zed-build): add a 'fast' build profile for dev desktops and golden builds by @lukemarsden in https://github.com/helixml/helix/pull/3410
• fix(vhost): let custom domains actually verify over :80 by @lukemarsden in https://github.com/helixml/helix/pull/3411
• fix(desktop): scope rootless rollout and start on noexec tmpfs by @chocobar in https://github.com/helixml/helix/pull/3403
• fix(webservice): accept upstream HTTP errors during readiness by @chocobar in https://github.com/helixml/helix/pull/3412
• fix(api): use task actor credentials for PR metadata edits by @chocobar in https://github.com/helixml/helix/pull/3382
• fix(webservice): supersede stale deploys and fail missing sandboxes by @chocobar in https://github.com/helixml/helix/pull/3413

Full Changelog: https://github.com/helixml/helix/compare/2.12.33...2.12.34