dev_agentandClaude Opus 5.5
38b9e5a06e
Restrict the decoded key and token to a URL-safe ASCII alphabet so the 16-character minimum and the four-character masked tail measure the same thing; a token of a few multi-byte characters could otherwise be shown in full (MQ-165-01). Validate the raw query as exactly key=…&token=…, refusing empty segments, a second "?", reordered, extra or repeated parameters (MQ-165-02). Drop configured and updated_at from the settings response so it is the four-field contract: space_label, url_masked, last_test_at, last_test_status; url_masked is null exactly when nothing is stored (MQ-165-03). Task: 919e9422-3a41-4f1f-8967-77da17f5f9f3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>