Merge branch 'main' into blove/basecamp-homepage-design-34a935

Author: blove

CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.0.63 (2026-08-31)
+
+### 🚀 Features
+
+- move all packages to MIT ([#881](https://github.com/cacheplane/angular-agent-framework/pull/881))
+- **examples/chat:** announce the research subagent's stream identity ([#874](https://github.com/cacheplane/angular-agent-framework/pull/874))
+- **website:** unify all fonts onto the next/font variables ([#876](https://github.com/cacheplane/angular-agent-framework/pull/876))
+- **website:** redesign pricing and licensing journey ([#875](https://github.com/cacheplane/angular-agent-framework/pull/875))
+
+### 🩹 Fixes
+
+- **proxy:** remove unauthenticated _proxy_debug disclosure endpoint ([#882](https://github.com/cacheplane/angular-agent-framework/pull/882))
+- **website:** AnnouncementToast mobile presentation and a11y ([#877](https://github.com/cacheplane/angular-agent-framework/pull/877))
+- **website:** fit meta descriptions to the search-snippet budget ([#880](https://github.com/cacheplane/angular-agent-framework/pull/880), [#826](https://github.com/cacheplane/angular-agent-framework/issues/826))
+
 ## 0.0.62 (2026-08-30)
 
 ### 🚀 Features

libs/a2ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadplane/a2ui",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "license": "MIT",
   "repository": {
     "type": "git",

libs/ag-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadplane/ag-ui",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "description": "AG-UI protocol adapter for @threadplane/chat — works with any AG-UI-compatible backend.",
   "keywords": [
     "angular",

libs/chat/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadplane/chat",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "exports": {
     "./chat.css": "./chat.css",
     "./themes/default-dark.css": "./themes/default-dark.css",

libs/langgraph/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadplane/langgraph",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "description": "LangGraph adapter for @threadplane/chat — Angular bindings for LangGraph Platform.",
   "keywords": [
     "angular",

libs/render/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadplane/render",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "peerDependencies": {
     "@angular/core": "^20.0.0 || ^21.0.0",
     "@angular/common": "^20.0.0 || ^21.0.0",

libs/telemetry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadplane/telemetry",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

nx.json

@@ -71,7 +71,7 @@
       "workspaceChangelog": {
         "createRelease": "github",
         "renderOptions": {
-          "authors": true,
+          "authors": false,
           "commitReferences": true,
           "versionTitleDate": true
         }

package-lock.json

@@ -150,6 +150,30 @@ describe('createProxyHandler', () => {
     expect(res._status).toBe(200);
   });
 
+  // Regression: `/_proxy_debug` was an unauthenticated early-return that
+  // disclosed a prefix of LANGSMITH_API_KEY, the upstream deployment URL, and
+  // environment facts to any caller. It sat above the origin/rate-limit gates,
+  // and the origin allowlist only rejects when an Origin header is present, so
+  // a plain curl reached it on production. It must stay a normal proxied path.
+  it('does not answer /_proxy_debug locally or disclose key material', async () => {
+    const fetchMock = vi.spyOn(global, 'fetch').mockResolvedValue(
+      new Response('{"detail":"Not Found"}', { status: 404, headers: { 'content-type': 'application/json' } }),
+    );
+    const handler = createProxyHandler({ backendUrl: DEFAULT_BACKEND });
+    const res = makeRes();
+    await handler({ method: 'GET', headers: { host: 'demo.threadplane.ai' }, url: '/api/_proxy_debug', query: {} } as never, res as never);
+
+    // Forwarded upstream like any other path rather than short-circuited here.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0]![0]).toBe(`${DEFAULT_BACKEND}/_proxy_debug`);
+
+    // Nothing the proxy itself wrote may carry the key or its prefix.
+    const written = JSON.stringify([res.json.mock.calls, res.send.mock.calls, res.write.mock.calls]);
+    expect(written).not.toContain('test-key-123');
+    expect(written).not.toContain('test-key-1');
+    expect(written).not.toContain('apiKeyPrefix');
+  });
+
   it('strips the catch-all query param but keeps real query params', async () => {
     const fetchMock = vi.spyOn(global, 'fetch').mockResolvedValue(
       new Response('{}', { status: 200, headers: { 'content-type': 'application/json' } }),