release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server_multi.py

@@ -430,19 +430,14 @@ def create_dynamic_tool(
                     )
                 )
 
-    param_names = [p.name for p in params]
-    param_str = ", ".join(param_names)
+    # Create wrapper using closure (no exec)
+    async def dynamic_wrapper(**kwargs):
+        return await handler(**kwargs)
 
-    func_code = f"""
-async def {name}({param_str}):
-    '''{description}'''
-    kwargs = {{{', '.join(f'"{p}": {p}' for p in param_names)}}}
-    return await handler(**kwargs)
-"""
-
-    local_vars = {"handler": handler}
-    exec(func_code, local_vars)
-    dynamic_wrapper = local_vars[name]
+    dynamic_wrapper.__name__ = name
+    dynamic_wrapper.__qualname__ = name
+    dynamic_wrapper.__doc__ = description
+    dynamic_wrapper.__signature__ = inspect.Signature(params)
     annotations["return"] = str
     dynamic_wrapper.__annotations__ = annotations