yorkhellen 13dec9d2c2 fix(security): normalize IPv6-mapped IPv4 addresses in SSRF checks ...

::ffff:127.0.0.1 and ::ffff:169.254.169.254 are IPv6Address objects
that match neither the IPv4 blocklists (127.0.0.0/8, 169.254.0.0/16)
nor the IPv6 ones (::1/128), allowing SSRF bypass via DNS responses
that return IPv6-mapped IPv4 addresses.

Add _normalize_addr() to convert ipv4_mapped IPv6 addresses to their
IPv4 form before blocklist/allowlist matching.

2026-05-30 15:34:49 +08:00

..

agent

feat(apps): add extension registry source

2026-05-29 17:26:58 +08:00

channels

fix(matrix): reject boolean media sizes

2026-05-30 15:34:19 +08:00

cli

feat(webui): add project workspaces and access controls (#4007)

2026-05-29 03:42:53 +08:00

cli_apps

fix(apps): recover stale npm installs

2026-05-29 17:26:58 +08:00

command

feat(goal): /goal command & long-running tasks (long_task)

2026-05-16 01:14:11 +08:00

config

feat(webui): add project workspaces and access controls (#4007)

2026-05-29 03:42:53 +08:00

cron

feat(tools): introduce plugin-based tool discovery and runtime context protocol

2026-05-12 11:28:20 +08:00

pairing

docs(pairing): address reviewer comments — comments, error msg, __all__ test

2026-05-15 15:46:44 +08:00

providers

fix(providers): surface clear arrearage warning on quota/billing errors (#3006)

2026-05-29 15:31:17 +08:00

security

fix(security): normalize IPv6-mapped IPv4 addresses in SSRF checks

2026-05-30 15:34:49 +08:00

session

fix(agent): align LLM wall timeout with sustained goals for main + subagents

2026-05-16 16:33:49 +08:00

tools

fix(exec): bypass cmd.exe for multi-line python -c commands on Windows

2026-05-30 01:02:40 +08:00

utils

fix(webui): persist markdown video previews

2026-05-29 17:26:58 +08:00

webui

feat(webui): add context window setting

2026-05-29 13:09:08 +08:00

test_api_attachment.py

fix: two bugs in document extraction pipeline

2026-04-14 13:15:04 +00:00

test_api_stream.py

Fix API stream lifecycle for tool-backed requests

2026-05-01 19:42:52 +08:00

test_build_status.py

fix(status): correct context percentage calculation and sync consolidator

2026-04-16 20:30:39 +08:00

test_context_documents.py

fix: two bugs in document extraction pipeline

2026-04-14 13:15:04 +00:00

test_docker.sh

docs: add core agent line count script and update README with real-time stats

2026-02-06 07:28:39 +00:00

test_document_parsing.py

fix(utils): recurse into PPTX groups and tables when extracting text (#3250)

2026-04-18 12:30:42 +08:00

test_msteams.py

fix(msteams): trust official Teams service hosts

2026-05-29 16:46:46 +08:00

test_nanobot_facade.py

refactor(tools): remove GlobTool

2026-05-15 17:19:00 +08:00

test_openai_api.py

feat(api): add SSE streaming for /v1/chat/completions Wire up the existing on_stream/on_stream_end callbacks from process_direct() to emit OpenAI-compatible SSE chunks when stream=true. Non-streaming path is untouched.

2026-04-17 01:54:49 +08:00

test_package_version.py

fix(version): fall back to pyproject in source checkouts

2026-04-08 23:47:36 +08:00

test_tool_contextvars.py

feat(webui): add project workspaces and access controls (#4007)

2026-05-29 03:42:53 +08:00

test_truncate_text_shadowing.py

fix(agent): avoid truncate_text name shadowing

2026-04-10 17:36:31 +08:00