v2.4.2

Security

• Resource Names: Validate config-backed resource names (skills, plugins, agents, auth profiles) before file reads/writes/deletes. Rejects path traversal attempts (../escape) and malformed restore payloads (#51).

Added

• i18n: Internationalization support with Chinese translation + OMO agents (#21).
• Provider Config: Provider-based config management system (#29).
• Custom Provider Models: Client-side editor for custom provider model lists.

Fixed

• Skills Path: Use skills/ (plural) for skill directory paths (#43).
• Sidebar: Prevent greedy active state for nested routes (#45).
• Server Startup: Block duplicate server startup with lock file (#37).
• Logs: Show recent log entries immediately on /logs (#38).
• Usage Stats: Restore /usage stats with SQLite source and JSON fallback (#36). Guard node:sqlite require for Node <22.5.
• Server Packaging: Ensure server package includes all dependencies; declare jsonc-parser as runtime dependency (#41). Use npm workspaces instead of nested postinstall.
• Hosted Backend: Support hosted frontend with local backend access via loopback address space annotations. Route local backend API calls through fetch.

Changed

• Backend Requirement: Minimum backend version 2.4.2.
• Server Package: Renamed to opencode-studio-server.
• Docs: Added AI contribution disclosure policy. Split Chinese README into README_CN.md.

---

Full Changelog: v2.3.0...v2.4.2