Bobby and chengyongru
af582246f1
[Security] exec.allowPatterns shell-chain bypass allows unintended command execution
...
Closes #5306
2026-08-13 11:05:04 +08:00
yorkhellen and Xubin Ren
d3382d7e57
fix(exec): guard bare and named-user home paths
...
Co-authored-by: Xubin Ren <52506698+Re-bin@users.noreply.github.com >
2026-08-13 02:50:58 +09:00
Xubin Ren and shixi-li
76f629e925
fix(web): keep credential URLs out of failure logs
...
Co-authored-by: shixi-li <40780706+shixi-li@users.noreply.github.com >
2026-08-13 02:26:22 +09:00
Xubin Ren
5f916bbd3a
fix(web): keep credential redirects away from Jina
2026-08-13 02:26:22 +09:00
shixi-li and Xubin Ren
31a71d6cd5
fix(web): keep credential-bearing URLs away from the remote Jina reader
2026-08-13 02:26:22 +09:00
Xubin Ren and santhreal
01c7323d74
fix(exec): parse shell path boundaries safely
...
Co-authored-by: santhreal <64453045+santhreal@users.noreply.github.com >
2026-08-13 01:53:38 +09:00
Xubin Ren
001a7492c2
fix(exec): guard POSIX double-slash absolute paths
2026-08-13 01:53:38 +09:00
santhreal and Xubin Ren
6fc0807fbf
fix(tools): handle redirection and grouping delimiters in ExecTool path guard
2026-08-13 01:53:38 +09:00
chengyongru and GitHub
19997d20bb
refactor: move MCP lifecycle out of AgentLoop ( #5343 )
2026-08-12 17:51:04 +08:00
chengyongru and chengyongru
1656664a47
test(exec): isolate Windows platform mock
2026-08-12 14:37:27 +08:00
chengyongru and chengyongru
a6193932a0
fix(exec): clean up failed job assignment
2026-08-12 14:37:27 +08:00
chengyongru and chengyongru
bcf5d8a6ed
fix(exec): retain process trees after root exit
2026-08-12 14:37:27 +08:00
d64b84604c
fix(exec): terminate one-shot process trees on cleanup
...
Run one-shot commands in their own process tree and terminate all
descendants after timeout, cancellation, or unexpected failures.
Co-authored-by: TRAE CLI <noreply@bytedance.com >
2026-08-12 14:37:27 +08:00
Wesley Zhang and Xubin Ren
99e07e138e
fix(tools): reject non-finite number parameters
2026-08-12 02:25:20 +09:00
chengyongru and GitHub
d45c893f68
fix(webui): surface MCP runtime connection failures ( #5331 )
2026-08-11 23:52:02 +08:00
chengyongru and GitHub
8e77f3f8a4
feat(mcp): add browser OAuth for remote servers ( #5316 )
2026-08-10 23:44:37 +08:00
chengyongru and chengyongru
b3b0517611
fix(files): reject no-op edits
2026-08-10 21:39:00 +08:00
chengyongru and chengyongru
e620944150
fix(mcp): clean up failed HTTP connections
2026-08-10 13:15:04 +08:00
chengyongru and chengyongru
113e8d67ad
refactor: remove verified dead code
2026-08-08 21:10:34 +08:00
chengyongru and GitHub
ff6deda178
fix: modernize dependency recovery guidance ( #5282 )
2026-08-07 13:58:13 +08:00
chengyongru and GitHub
6e9ae5bd05
refactor(session): remove request-scoped access grants ( #5238 )
2026-08-05 10:18:46 +08:00
Xubin Ren
62d34b5eb7
refactor(session): tighten cross-session access
2026-08-04 12:14:51 +08:00
KDB and Xubin Ren
b1030ab131
fix(exec): preserve wait targets across response truncation
2026-08-01 19:40:36 +08:00
yu-xin-c and Xubin Ren
5e67fbf93e
fix(exec): bound buffered session output
2026-07-30 19:44:09 +08:00
Zhou and GitHub
5a28a6165c
fix(shell): preserve UTF-8 native input on PowerShell 5 ( #5160 )
...
Windows PowerShell 5.1 defaults $OutputEncoding to US-ASCII, corrupting non-ASCII strings piped to native commands. Set it from the console encoding only on legacy versions so PowerShell 7 keeps its defaults.
2026-07-29 21:47:01 +08:00
chengyongru and GitHub
757ad9c764
refactor: enforce BasedPyright strict type checking ( #5158 )
2026-07-29 21:37:11 +08:00
chengyongru and GitHub
393d429e0a
fix(ci): stabilize and speed up CI ( #5145 )
2026-07-28 22:55:59 +08:00
chengyongru and GitHub
12f828ea3d
fix(agent): read document attachments on demand ( #5122 )
2026-07-28 13:33:06 +08:00
chengyongru and GitHub
ef9e687f19
refactor(core): remove redundant runtime scaffolding ( #5127 )
2026-07-28 11:07:58 +08:00
chengyongru and chengyongru
39348dfafe
refactor(agent): remove dead lifecycle scaffolding
2026-07-27 12:00:06 +08:00
Xubin Ren
c1899e2cb4
fix(mcp): decode URI-encoded schema refs
2026-07-27 01:14:41 +08:00
amplifierplus and Xubin Ren
9aae7485d6
fix(mcp): normalize local schema refs
2026-07-27 01:14:41 +08:00
Xubin Ren
cf6ca13b6d
fix(exec): preserve bwrap workspace masking
2026-07-27 00:31:00 +08:00
yu-xin-c and Xubin Ren
22e61003f9
test(exec): make bwrap bind tests portable
2026-07-27 00:31:00 +08:00
yu-xin-c and Xubin Ren
01a11b3980
feat(exec): allow extra bwrap bind roots
2026-07-27 00:31:00 +08:00
AxelRay and GitHub
78f4c132d9
fix(exec): extract absolute paths after equals sign in shell guard ( #4594 )
2026-07-23 23:58:01 +08:00
KDB and chengyongru
648fc92673
fix(exec): retain stale sessions after cleanup failure
...
Only remove idle exec sessions after process termination succeeds so later cleanup and shutdown paths can retry failed kills.
2026-07-23 23:55:00 +08:00
chengyongru and GitHub
b189a37648
fix(agent): preserve agent-owned state in project workspaces ( #4945 )
2026-07-22 17:25:22 +08:00
chengyongru and chengyongru
80085085d9
fix(exec): retain failed owner session cleanup
2026-07-22 15:28:34 +08:00
yorkhellen and chengyongru
ebf1ef5cab
test(subagent): verify cascade exec termination on /stop
...
- terminate_by_owner kills matching sessions, skips others, handles
empty owner case
- cancel_by_session calls terminate_by_owner on the session key
2026-07-22 15:28:34 +08:00
amplifierplus and chengyongru
cdb2df4982
fix(files): reject oversized reads before loading
2026-07-21 15:02:27 +08:00
chengyongru and Xubin Ren
d5658dbc91
fix: preserve background operator in allowlist segments
...
Maintainer edit: keep a top-level trailing '&' in the segment being matched so background execution cannot be checked as if the ampersand were absent. Redirection forms like 2>&1 and &> remain untouched.
2026-07-21 13:50:24 +08:00
chengyongru and Xubin Ren
12c52c11d3
fix: treat single ampersand as shell segment
...
Maintainer edit: single '&' backgrounds the preceding command and starts another top-level shell segment, so allowPatterns must split it the same way as ';', '|', '&&', and '||'. Keep fd redirections such as 2>&1 and &> intact.
2026-07-21 13:50:24 +08:00
michaelxer and Xubin Ren
bbca32fea9
fix(security): validate each shell segment against exec.allowPatterns
...
Guard against shell-chain bypass where an attacker appends '&& malicious'
after an allowlisted prefix. The allowlist check now splits the command
on top-level chaining operators (&&, ||, ;, |) and requires every segment
to match at least one allowPattern independently.
Fixes #4521
2026-07-21 13:50:24 +08:00
KDB and Xubin Ren
8981995474
fix(exec): clean up sessions on shutdown
2026-07-21 13:48:51 +08:00
chengyongru and GitHub
462a0dfb0f
refactor(channels): make built-in channels self-contained ( #4908 )
...
* refactor(channels): own setup and instance contracts
* refactor(channels): isolate management contracts
* refactor(channels): normalize activation contracts
* fix(channels): enforce management contracts
* refactor(channels): finish setup ownership migration
* fix(channels): harden management contracts
* fix(channels): enforce lazy loading and runtime ownership
* fix(feishu): make multi-instance startup idempotent
* fix(webui): render channel setup contracts cleanly
* fix(feishu): stop websocket clients cleanly
* fix(channels): enforce persistence and activation gates
* fix(channels): preserve global feature action scope
* fix(channels): apply defaults for single plugins
* fix(channels): enforce management contract boundaries
* refactor(feishu): remove identity helper indirection
* fix(channels): preserve management setup contracts
* refactor(channels): generalize instance settings UI
* refactor(channels): package channel plugins with web UI metadata
* refactor(channels): make built-ins self-contained packages
* test(channels): colocate tests with channel packages
* fix(dingtalk): use official brand icon
* feat(channels): colocate webui translations
* docs(channels): clarify plugin ownership
* test(exec): remove output wait race
* refactor(channels): unify plugin descriptors
* fix(channels): enforce descriptor-owned contracts
* refactor(channels): finish package-owned plugin setup
* refactor(channels): use repository-owned packages only
* fix(channels): self-describe dependencies and runtime state
* fix(channels): warn about legacy entry points
2026-07-19 23:30:49 +08:00
adabarbulescu and Xubin Ren
d4f5abe004
fix: preserve real cancellation in MCP paths
2026-07-18 17:36:35 +08:00
yu-xin-c and Xubin Ren
07ad0bafa8
test(exec): relax wait-for timing on Windows
2026-07-18 17:35:56 +08:00
yu-xin-c and Xubin Ren
995cc44e89
fix(exec): isolate exec session managers
2026-07-18 17:35:56 +08:00
chengyongru and chengyongru
681edfa6f3
fix(providers): honor Codex proxy config consistently
2026-07-15 20:01:48 +08:00
Bobbyandchengyongru
yorkhellenandXubin Ren
shixi-liandXubin Ren
chengyongruandchengyongru
Wesley ZhangandXubin Ren
chengyongruandchengyongru
KDBandXubin Ren
yu-xin-candXubin Ren
ZhouandGitHub
amplifierplusandXubin Ren
AxelRayandGitHub
michaelxerandXubin Ren
adabarbulescuandXubin Ren