mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-09-03 17:52:00 +03:00
Code Issues Packages Projects Releases Wiki Activity
3,926 Commits 44 Branches 19 Tags
edec29e9979029470dae6d5c28b211baa8f31285
Commit Graph
3 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
LHMQ878andXubin Ren a0e60116a3 fix(cli): stop leaking API keys to CLI app subprocesses 
Installed CLI apps were started with os.environ.copy(), so provider keys
from the parent process were visible to untrusted binaries. Use a minimal
allowlist env matching the shell tool.

Fixes #4783
 2026-08-12 02:57:48 +09:00
LHMQ878andXubin Ren ec3dfb21ba fix(cli): stop leaking API keys to CLI app subprocesses 
Installed CLI apps were started with os.environ.copy(), so provider keys
from the parent process were visible to untrusted binaries. Use a minimal
allowlist env matching the shell tool.

Fixes #4783
 2026-08-12 02:57:48 +09:00
LHMQ878andXubin Ren f5cf4dcd2c fix(providers): stop writing API keys into process os.environ 
OpenAICompatProvider already passes api_key into AsyncOpenAI. Mutating
shared os.environ leaked credentials across providers (gateway overwrite
and setdefault first-writer-wins).

Fixes #4784
 2026-08-12 02:35:40 +09:00