GT AI OS Community Edition v2.0.33

Security hardening release addressing CodeQL and Dependabot alerts:

- Fix stack trace exposure in error responses
- Add SSRF protection with DNS resolution checking
- Implement proper URL hostname validation (replaces substring matching)
- Add centralized path sanitization to prevent path traversal
- Fix ReDoS vulnerability in email validation regex
- Improve HTML sanitization in validation utilities
- Fix capability wildcard matching in auth utilities
- Update glob dependency to address CVE
- Add CodeQL suppression comments for verified false positives

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/tenant-app/src/services/user.ts

@@ -0,0 +1,82 @@
+/**
+ * GT 2.0 User Service
+ *
+ * API client for user preferences and favorite agents management.
+ */
+
+import { api } from './api';
+
+export interface UserPreferences {
+  favorite_agent_ids?: string[];
+  [key: string]: any;
+}
+
+export interface FavoriteAgentsResponse {
+  favorite_agent_ids: string[];
+}
+
+export interface CustomCategory {
+  name: string;
+  description: string;
+  created_at?: string;
+}
+
+export interface CustomCategoriesResponse {
+  categories: CustomCategory[];
+}
+
+/**
+ * Get current user's preferences
+ */
+export async function getUserPreferences() {
+  return api.get<{ preferences: UserPreferences }>('/api/v1/users/me/preferences');
+}
+
+/**
+ * Update current user's preferences (merges with existing)
+ */
+export async function updateUserPreferences(preferences: UserPreferences) {
+  return api.put('/api/v1/users/me/preferences', { preferences });
+}
+
+/**
+ * Get current user's favorited agent IDs
+ */
+export async function getFavoriteAgents() {
+  return api.get<FavoriteAgentsResponse>('/api/v1/users/me/favorite-agents');
+}
+
+/**
+ * Update current user's favorite agent IDs (replaces entire list)
+ */
+export async function updateFavoriteAgents(agent_ids: string[]) {
+  return api.put('/api/v1/users/me/favorite-agents', { agent_ids });
+}
+
+/**
+ * Add a single agent to user's favorites
+ */
+export async function addFavoriteAgent(agent_id: string) {
+  return api.post('/api/v1/users/me/favorite-agents/add', { agent_id });
+}
+
+/**
+ * Remove a single agent from user's favorites
+ */
+export async function removeFavoriteAgent(agent_id: string) {
+  return api.post('/api/v1/users/me/favorite-agents/remove', { agent_id });
+}
+
+/**
+ * Get current user's custom agent categories
+ */
+export async function getCustomCategories() {
+  return api.get<CustomCategoriesResponse>('/api/v1/users/me/custom-categories');
+}
+
+/**
+ * Update current user's custom agent categories (replaces entire list)
+ */
+export async function saveCustomCategories(categories: CustomCategory[]) {
+  return api.put('/api/v1/users/me/custom-categories', { categories });
+}