Back to Changelog
Panel Backend
v1.0.529
OpsAI multi-provider support and critical privilege-escalation fixes.
New Feature
1- OpsAI multi-provider support: Claude Code, Codex CLI, Gemini CLI, and Cursor Agent, with a provider picker, background install job, per-provider login (interactive or API key), permission modes, and Telegram safe mode.
Improvements
2- External API specification is now generated from code: accurate response shapes, code-derived scopes (32 mismatches corrected), enums and defaults, ID provenance, and closure-based handlers.
- SMB/NFS shares now use safe defaults.
Bug Fixes
5- External API error messages were returned as raw i18n keys instead of translated text; they are now translated. 23 missing External API message keys were added.
- Retrying a failed provider install no longer reports an already-installed provider as failed.
- Fixed a terminal repaint issue after reattach that caused column jitter.
- WordPress import address repair is now applied at startup (previously the repair existed but was not run).
- Fixed a seed ordering issue that could break migrations on fresh installs.
Security Fixes
3- Fixed a shell injection vulnerability in the granular restore path that could lead to root remote code execution.
- Fixed a caller-check bypass in the sshfull cgroup shell that could lead to root privilege escalation.
- Fixed a symlink escape in Docker bind-mount validation.