michaelxerandXubin Ren bbca32fea9 fix(security): validate each shell segment against exec.allowPatterns ...

Guard against shell-chain bypass where an attacker appends '&& malicious'
after an allowlisted prefix. The allowlist check now splits the command
on top-level chaining operators (&&, ||, ;, |) and requires every segment
to match at least one allowPattern independently.

Fixes #4521

2026-07-21 13:50:24 +08:00

..

agent

fix(exec): clean up sessions on shutdown

2026-07-21 13:48:51 +08:00

bus

fix(bus): preserve legacy outbound metadata events

2026-07-01 20:17:00 +08:00

channels

fix: stop masking runtime failures

2026-07-21 11:44:52 +08:00

cli

fix(exec): clean up sessions on shutdown

2026-07-21 13:48:51 +08:00

cli_apps

fix(cli-apps): decode subprocess output as UTF-8

2026-07-19 16:05:26 +08:00

command

fix(prompts): handle undecodable overrides

2026-07-15 01:19:48 +08:00

config

fix: stop masking runtime failures

2026-07-21 11:44:52 +08:00

cron

fix(cron): also coerce null createdAtMs/updatedAtMs on load

2026-07-21 13:45:02 +08:00

gateway

feat(webui): add guided setup flows

2026-07-13 13:11:46 +08:00

pairing

feat(webui): add guided setup flows

2026-07-13 13:11:46 +08:00

providers

feat: support Kimi K3

2026-07-18 17:38:32 +08:00

security

feat(webui): add guided setup flows

2026-07-13 13:11:46 +08:00

session

fix: stop masking runtime failures

2026-07-21 11:44:52 +08:00

tools

fix(security): validate each shell segment against exec.allowPatterns

2026-07-21 13:50:24 +08:00

triggers

fix(triggers): require channel enablement predicate

2026-07-19 22:33:29 +08:00

utils

fix: stop masking runtime failures

2026-07-21 11:44:52 +08:00

webui

fix: stop masking runtime failures

2026-07-21 11:44:52 +08:00

test_api_attachment.py

fix: require api auth in server factory

2026-07-08 12:16:12 +08:00

test_api_stream.py

fix: require api auth in server factory

2026-07-08 12:16:12 +08:00

test_build_status.py

fix(status): correct context percentage calculation and sync consolidator

2026-04-16 20:30:39 +08:00

test_context_documents.py

fix: two bugs in document extraction pipeline

2026-04-14 13:15:04 +00:00

test_docker.sh

fix: keep onboard cli defaults unchanged

2026-06-22 13:04:05 +08:00

test_document_parsing.py

feat(webui): add guided setup flows

2026-07-13 13:11:46 +08:00

test_file_tool_toggle.py

fix: preserve file tool toggle for subagents

2026-06-15 02:55:18 +08:00

test_nanobot_facade.py

fix(session): cap messages at persistence boundary

2026-07-21 13:47:18 +08:00

test_openai_api.py

fix: stop masking runtime failures

2026-07-21 11:44:52 +08:00

test_package_version.py

test: speed up CI and harden the suite

2026-07-15 00:18:37 +08:00

test_tool_contextvars.py

refactor(agent): capture subagent runtime before spawn

2026-07-10 17:54:34 +08:00

test_truncate_text_shadowing.py

fix(agent): avoid truncate_text name shadowing

2026-04-10 17:36:31 +08:00