readConfig/readSettings/readJson across all CLI tool settings routes used
JSON.parse() but only caught ENOENT, re-throwing SyntaxError on any
corrupted or JSONC-formatted config file. The API would return 500, which
the UI misinterpreted as "tool not installed."
This patch:
- strips trailing commas before parsing (handles JSONC from opencode, etc.)
- returns null on any parse error instead of re-throwing, so the UI shows
"installed but not configured" (accurate) instead of "not installed"
- applies the same fix to all 8 affected routes: opencode, openclaw, kilo,
droid, cowork, copilot, claude, and cline
Co-authored-by: Cursor <cursoragent@cursor.com>
Restore Cowork feature while closing the RCE vector: drop user-defined
stdio commands so only hard-coded preset plugins (browsermcp) may spawn.
Custom MCP now accepts remote URL only. Routes stay gated to localhost.
Co-authored-by: Cursor <cursoragent@cursor.com>
## Features
- Add Blackbox provider with `bb` alias (#1143)
- Add Xiaomi token plan provider
- Enhance model select modal UX + modal traffic lights (#1111)
- Default Usage dashboard period to Today (#1141)
## Fixes
- Fix Cowork model selection and Windows CLI packaging (#1129)
- Update provider name retrieval for compatibility provider (#1135)
- Update JWT_SECRET handling
- BaseUrlSelect: add cloud endpoint option, custom URL local state, always
default to first option; new cliEndpointMatch helper; CLI tool cards refactor
- API: new /v1/audio/voices and /v1/models/info; /v1/models filters disabled
models, drop unused timestamp
- initializeApp: guard tunnel/tailscale auto-resume to once-per-process
- geminiHelper: ensureObjectType for schemas with properties but no type
- skills: minor SKILL.md tweaks (chat/embeddings/image/stt/tts/web-*)
