shen0122 and chengyongru
4de728a555
fix(anthropic): treat stream idle timeout as inactivity only, not total time
2026-08-14 23:18:13 +08:00
dajiaohuang and chengyongru
057c5e849b
fix(session): restore state when file-cap archive fails
2026-08-14 11:22:22 +08:00
chengyongru and GitHub
e226242dfc
fix(session): serialize canonical file access ( #5383 )
2026-08-14 10:32:17 +08:00
Xubin Ren
e3d1819a2b
fix(webui): isolate folder picker environment
2026-08-14 04:03:54 +09:00
Xubin Ren
9703656b25
test(webui): make folder picker tests portable
2026-08-14 04:03:54 +09:00
Xubin Ren
26c9687b80
feat(webui): add native workspace folder picker
2026-08-14 04:03:54 +09:00
Xubin Ren
335808e525
fix(webui): bound restored session previews
2026-08-14 03:46:01 +09:00
Xubin Ren
fd7eb8e046
fix(webui): restore transcript-only session history
2026-08-14 03:46:01 +09:00
Bobby and chengyongru
af582246f1
[Security] exec.allowPatterns shell-chain bypass allows unintended command execution
...
Closes #5306
2026-08-13 11:05:04 +08:00
arcdrake22 and Xubin Ren
0c684c5a99
fix(gemini): preserve imported tool history across model switches
...
Co-authored-by: Xubin Ren <52506698+Re-bin@users.noreply.github.com >
2026-08-13 03:07:37 +09:00
yorkhellen and Xubin Ren
d3382d7e57
fix(exec): guard bare and named-user home paths
...
Co-authored-by: Xubin Ren <52506698+Re-bin@users.noreply.github.com >
2026-08-13 02:50:58 +09:00
Xubin Ren and shixi-li
76f629e925
fix(web): keep credential URLs out of failure logs
...
Co-authored-by: shixi-li <40780706+shixi-li@users.noreply.github.com >
2026-08-13 02:26:22 +09:00
Xubin Ren
5f916bbd3a
fix(web): keep credential redirects away from Jina
2026-08-13 02:26:22 +09:00
shixi-li and Xubin Ren
31a71d6cd5
fix(web): keep credential-bearing URLs away from the remote Jina reader
2026-08-13 02:26:22 +09:00
chengyongru and chengyongru
edec29e997
feat(providers): support DeepSeek V4 Pro Responses
2026-08-13 01:02:41 +08:00
Xubin Ren and santhreal
01c7323d74
fix(exec): parse shell path boundaries safely
...
Co-authored-by: santhreal <64453045+santhreal@users.noreply.github.com >
2026-08-13 01:53:38 +09:00
Xubin Ren
001a7492c2
fix(exec): guard POSIX double-slash absolute paths
2026-08-13 01:53:38 +09:00
santhreal and Xubin Ren
6fc0807fbf
fix(tools): handle redirection and grouping delimiters in ExecTool path guard
2026-08-13 01:53:38 +09:00
Xubin Ren and lmzopq
cd7480945b
fix(session): preserve history across storage relocation
...
Co-authored-by: lmzopq <1646888+lmzopq@users.noreply.github.com >
2026-08-13 01:41:10 +09:00
Xubin Ren
d2cbe6536e
fix(session): reject symlinked legacy session migration
2026-08-13 01:41:10 +09:00
李明振 and Xubin Ren
b34f1bd0e8
fix(session): store session history outside the agent workspace
...
Session files lived under <workspace>/sessions/ (since #713 ), which is the
on-disk scope of the agent's filesystem tools. With restrict_to_workspace
enabled, an agent could read_file / list_dir every session transcript —
including other users' or channels' conversations — bypassing the scoped
sessions.py access layer entirely.
Move session storage to ~/.nanobot/sessions/<sha256-of-resolved-workspace>[:16]/,
outside the workspace. Per-workspace isolation (the goal of #713 ) is preserved
via a hash of the resolved workspace path, so different workspaces keep
independent session stores. A one-shot, idempotent migration moves legacy
in-workspace *.jsonl files into the new location at store init.
Scope note: this protects sessions whenever restrict_to_workspace=true. The
default restrict_to_workspace=false leaves read_file unrestricted in general
(not only sessions) and is a separate concern.
Refs #5278
2026-08-13 01:41:10 +09:00
Xubin Ren
edaef4e4f5
fix(cli): isolate management subprocess environments
2026-08-12 21:09:29 +09:00
chengyongru and chengyongru
e455a2b7fa
feat(webui): add MCP management dialog
2026-08-12 18:28:23 +08:00
chengyongru and GitHub
19997d20bb
refactor: move MCP lifecycle out of AgentLoop ( #5343 )
2026-08-12 17:51:04 +08:00
chengyongru and GitHub
4b5319b760
feat(webui): add tabbed pane workbench ( #5322 )
2026-08-12 14:45:12 +08:00
chengyongru and chengyongru
1656664a47
test(exec): isolate Windows platform mock
2026-08-12 14:37:27 +08:00
chengyongru and chengyongru
a6193932a0
fix(exec): clean up failed job assignment
2026-08-12 14:37:27 +08:00
chengyongru and chengyongru
bcf5d8a6ed
fix(exec): retain process trees after root exit
2026-08-12 14:37:27 +08:00
d64b84604c
fix(exec): terminate one-shot process trees on cleanup
...
Run one-shot commands in their own process tree and terminate all
descendants after timeout, cancellation, or unexpected failures.
Co-authored-by: TRAE CLI <noreply@bytedance.com >
2026-08-12 14:37:27 +08:00
Xubin Ren
abfcdd481a
fix(cli): validate Windows subprocess environment
2026-08-12 02:57:48 +09:00
LHMQ878 and Xubin Ren
ec3dfb21ba
fix(cli): stop leaking API keys to CLI app subprocesses
...
Installed CLI apps were started with os.environ.copy(), so provider keys
from the parent process were visible to untrusted binaries. Use a minimal
allowlist env matching the shell tool.
Fixes #4783
2026-08-12 02:57:48 +09:00
Xubin Ren
72d3ce6b23
fix(skills): make PNG weather example Windows-safe
2026-08-12 02:48:03 +09:00
Kail Tian and Xubin Ren
b14ac4c401
fix(skills): make weather workflow Windows-safe
2026-08-12 02:48:03 +09:00
LHMQ878 and Xubin Ren
f5cf4dcd2c
fix(providers): stop writing API keys into process os.environ
...
OpenAICompatProvider already passes api_key into AsyncOpenAI. Mutating
shared os.environ leaked credentials across providers (gateway overwrite
and setdefault first-writer-wins).
Fixes #4784
2026-08-12 02:35:40 +09:00
Wesley Zhang and Xubin Ren
99e07e138e
fix(tools): reject non-finite number parameters
2026-08-12 02:25:20 +09:00
chengyongru and GitHub
d45c893f68
fix(webui): surface MCP runtime connection failures ( #5331 )
2026-08-11 23:52:02 +08:00
Xubin Ren
247c474e64
perf(plugins): cache verified skill roots
2026-08-11 20:16:24 +09:00
Xubin Ren
a2979c3a4b
fix(plugins): harden activation boundaries
2026-08-11 20:16:24 +09:00
Xubin Ren
d5e0df6963
feat(plugins): integrate portable Agent Plugins
2026-08-11 20:16:24 +09:00
chengyongru and GitHub
57d81bc1cd
fix(providers): preserve nanobot tools with OpenRouter server tools ( #5335 )
...
* fix(providers): preserve functions with extra body tools
* docs(providers): clarify extra body tool merging
2026-08-11 18:23:27 +08:00
chengyongru and GitHub
52e0a6a1e3
refactor(webui): split settings backend by domain ( #5323 )
2026-08-11 11:23:27 +08:00
chengyongru and GitHub
8e77f3f8a4
feat(mcp): add browser OAuth for remote servers ( #5316 )
2026-08-10 23:44:37 +08:00
chengyongru and chengyongru
b3b0517611
fix(files): reject no-op edits
2026-08-10 21:39:00 +08:00
chengyongru and GitHub
c281e090d0
refactor(webui): make gateway own settings services ( #5321 )
2026-08-10 18:10:55 +08:00
chengyongru and GitHub
85a452e5c7
refactor(agent): replace reflective runtime state access ( #5319 )
2026-08-10 16:44:26 +08:00
chengyongru and chengyongru
05d73803e7
refactor(webui): extract event projection helpers
2026-08-10 16:24:07 +08:00
chengyongru and chengyongru
5d733b1c7c
fix(webui): move mutations to authenticated websocket requests
2026-08-10 16:23:47 +08:00
chengyongru and chengyongru
e620944150
fix(mcp): clean up failed HTTP connections
2026-08-10 13:15:04 +08:00
chengyongru and GitHub
55ecda275d
test: strengthen user-path coverage and CI gates ( #5308 )
2026-08-09 21:37:06 +08:00
Xubin Ren
c410ea444c
fix(agent): stop session-owned exec processes
2026-08-08 23:20:59 +08:00
shen0122andchengyongru
dajiaohuangandchengyongru
Xubin Ren
Bobbyandchengyongru
arcdrake22andXubin Ren
yorkhellenandXubin Ren
shixi-liandXubin Ren
chengyongruandchengyongru
李明振andXubin Ren
chengyongruandchengyongru
LHMQ878andXubin Ren
Kail TianandXubin Ren
Wesley ZhangandXubin Ren