Repository navigation

fix: 80 validated findings from the 2026-10-12 bug hunt - #317

Merged

jkyberneees merged 125 commits into

mainfrom

fix/bughunt-2026-10-12

Oct 12, 2026

Merged

fix: 80 validated findings from the 2026-10-12 bug hunt#317
jkyberneees merged 125 commits into
mainfrom
fix/bughunt-2026-10-12

Commits on Oct 12, 2026
- fix(loop): batch card classifies diff paths and request URLs like the tools do
  
  jkyberneees
  and
  claude
  committed
  b684bbb
- fix(loop): check_replace advances the check epoch
  
  jkyberneees
  and
  claude
  committed
  a8de13b
- fix(loop): args_summary argv0 keeps substituted assignment values whole
  
  jkyberneees
  and
  claude
  committed
  e6278d4
- fix(loop): mutating bg_start commands enter the reconciliation ledger
  
  jkyberneees
  and
  claude
  committed
  35146d1
- docs(security): batch card classification of diff, http_request and browser URLs
  
  jkyberneees
  and
  claude
  committed
  ee89751
- fix(loop): argv0 word splitting skips whole nested substitutions
  
  jkyberneees
  and
  claude
  committed
  cf9385b
- fix(loop): browser snapshot is safe on the batch card
  
  jkyberneees
  and
  claude
  committed
  d3ef85f
- fix(loop): transcribe batch card includes provider upload egress
  
  jkyberneees
  and
  claude
  committed
  7a4c741
- fix(mcpclient): enforce small stdio max_response_bytes exactly
  
  jkyberneees
  and
  claude
  committed
  0fabcee
- fix(mcpclient): fail fast once the stdio reader has exited
  
  jkyberneees
  and
  claude
  committed
  3825a4d
- fix(mcpclient): keep artifact metadata when multi-item results are truncated
  
  jkyberneees
  and
  claude
  committed
  f69c99d
- fix(mcpclient): reject tools/list responses with duplicate tool names
  
  jkyberneees
  and
  claude
  committed
  254420d
- fix(mcp): keep only regex-shaped pattern keywords in the provider schema
  
  jkyberneees
  and
  claude
  committed
  5460d0e
- fix(agent): refuse non-regular AGENTS.md and bound the read
  
  jkyberneees
  and
  claude
  committed
  3dc7184
- fix(llmclient): persist and replay every signed thinking block
  
  jkyberneees
  and
  claude
  committed
  1e71bf4
- fix(session): drop signed thinking when redaction alters its text
  
  jkyberneees
  and
  claude
  committed
  7b12b79
- fix(mcp): lift word-like patterns out of the provider schema
  
  jkyberneees
  and
  claude
  committed
  9080ef3
- fix(serve): approval answers are one-shot so a dropped second answer is never acknowledged
  
  jkyberneees
  and
  claude
  committed
  f87155b
- fix(serve): reject unknown or unauthenticated sessions before taking the execution lock
  
  jkyberneees
  and
  claude
  committed
  775783f
- fix(serve): shorten backs up to a rune boundary so titles and task labels stay valid UTF-8
  
  jkyberneees
  and
  claude
  committed
  abf0f44
- fix(serve): markdown export renders task, model and tool names inline-safe
  
  jkyberneees
  and
  claude
  committed
  bd8d9eb
- fix(serve): rate-limit rejected lookups on every session-scoped endpoint
  
  jkyberneees
  and
  claude
  committed
  257808b
- fix(serve): session listing fallback returns only allowlisted metadata
  
  jkyberneees
  and
  claude
  committed
  05efa22
- fix(resource): @-file references refuse trust anchors and credential files
  
  jkyberneees
  and
  claude
  committed
  4fd4238
- fix(resource): @-file autocomplete does not list protected paths
  
  jkyberneees
  and
  claude
  committed
  c119eed
- fix(serve): POST /api/prompt bad-token rejection burns the session lookup budget
  
  jkyberneees
  and
  claude
  committed
  2a60226
- fix(config): compare full MCP transport identity before inheriting auto_approve
  
  jkyberneees
  and
  claude
  committed
  a415d87
- fix(agent): strip quoted/listed pillar imitations and close open fences before the pillar
  
  jkyberneees
  and
  claude
  committed
  0817810
- fix(config): project max_concurrency may only lower the sub-agent limiter
  
  jkyberneees
  and
  claude
  committed
  2d8d603
- fix(skills): record project skill promotion under the frontmatter name
  
  jkyberneees
  and
  claude
  committed
  eeb536d
- fix(subagent): never follow staged symlinks when relocating artifacts
  
  jkyberneees
  and
  claude
  committed
  8fb7206
- fix(subagent): scope artifact registry and artifact_read to the owning session
  
  jkyberneees
  and
  claude
  committed
  76bc256
- fix(subagent): children of a sandboxed parent must sandbox themselves
  
  jkyberneees
  and
  claude
  committed
  35d3ac2
- fix(config): never expand host env vars in the untrusted project config
  
  jkyberneees
  and
  claude
  committed
  5c48633
- test(config): cover MCP transport identity comparison
  
  jkyberneees
  and
  claude
  committed
  14ac8ab
- fix(agent): strip numbered-list prefixed pillar heading imitations
  
  jkyberneees
  and
  claude
  committed
  c8c7c8c
- docs(config): project config is not subject to ${VAR} substitution
  
  jkyberneees
  and
  claude
  committed
  37e07ad
- fix(config): a project MCP entry cannot re-enable an operator-disabled server
  
  jkyberneees
  and
  claude
  committed
  0f6c329
- fix(redact): cover bare token/secret/pass keys, arrow/flag/netrc/XML separators, token-scheme Authorization, Docker config auth
  
  jkyberneees
  and
  claude
  committed
  af67f03
- fix(audit,untrusted,unreadscan): one-directional source match, escaped audit --list, look-alike tag neutralising, assignment blobs
  
  jkyberneees
  and
  claude
  committed
  4fc0af0
- fix(redact): require secret-like values for bare keys; XML attributes/CDATA, camelCase keys, more flags and schemes
  
  jkyberneees
  and
  claude
  committed
  fb04c4c
- fix(loop): linear, name-specific untrusted tag look-alike neutralising
  
  jkyberneees
  and
  claude
  committed
  3cf7af8
- fix(session_search): scope Telegram session_search to the calling chat; find scans all sessions
  
  jkyberneees
  and
  claude
  committed
  28bd25f
- fix(memory): list_quarantine and list_pending_review taint the session episode
  
  jkyberneees
  and
  claude
  committed
  ed08764
- fix(audit): redact the whole body before extracting audit resources
  
  jkyberneees
  and
  claude
  committed
  eef1a56
- fix(session): redact Buffer on save; remove run lock files with their session
  
  jkyberneees
  and
  claude
  committed
  a1c534d
- fix(memory): redact secrets in buffer, episodes, facts and atoms
  
  jkyberneees
  and
  claude
  committed
  93bf9be
- fix(session): AcquireExecution verifies the locked file is still the path's inode
  
  jkyberneees
  and
  claude
  committed
  fc4d740
- fix(ssrf): classify URL hosts after UTS-46 mapping before the policy gate
  
  jkyberneees
  and
  claude
  committed
  3687248
- fix(danger): fold ~/.odek trust-anchor names like case-insensitive filesystems
  
  jkyberneees
  and
  claude
  committed
  91cf478
- fix(file_tool): block Unicode case-fold aliases of ~/.odek trust anchors
  
  jkyberneees
  and
  claude
  committed
  67b3563
- fix(http_request): drop credential headers on cross-host redirects
  
  jkyberneees
  and
  claude
  committed
  b89116e
- fix(transcribe): wrap the plain-text whisper fallback and stderr as untrusted
  
  jkyberneees
  and
  claude
  committed
  1e7f351
- fix(transcribe): cap whisper and llama-mtmd stdout while reading it
  
  jkyberneees
  and
  claude
  committed
  3e60244
- fix(speech): settle the budget reservation taken for the request timeout
  
  jkyberneees
  and
  claude
  committed
  550bc8c
- fix(bg): evaluate the bg_start approval gate against the session read ledger
  
  jkyberneees
  and
  claude
  committed
  0933c53
- fix(bg): redact the command head in job-exit notices
  
  jkyberneees
  and
  claude
  committed
  3f8bb9c
- fix(telegram): redact commands in the /jobs chat listing
  
  jkyberneees
  and
  claude
  committed
  7322422
- fix(search_files): wrap skipped entries as untrusted
  
  jkyberneees
  and
  claude
  committed
  a369ef1
- fix(browser): cap title, element text and link URL size per snapshot
  
  jkyberneees
  and
  claude
  committed
  a2bc68f
- docs(security): document IDN host mapping and redirect credential stripping
  
  jkyberneees
  and
  claude
  committed
  b8aa541
- fix(danger): fold case consistently in home, credential and persistence path checks
  
  jkyberneees
  and
  claude
  committed
  d322413
- fix(file_tool): compare the ~/.odek prefix with a fold-aware, length-safe check
  
  jkyberneees
  and
  claude
  committed
  1fcaf2d
- fix(http_request): also drop credential headers on an https to http downgrade
  
  jkyberneees
  and
  claude
  committed
  4253f34
- fix(transcribe): bound the capped runner's wait and make the alloc test race-robust
  
  jkyberneees
  and
  claude
  committed
  5504eb7
- fix(speech): charge estimated usage when settling the speech budget grant
  
  jkyberneees
  and
  claude
  committed
  bb91d6a
- fix(telegram): media uploads always need an explicit per-call approval
  
  jkyberneees
  and
  claude
  committed
  905e5ac
- fix(telegram): escape mid-answer MEDIA lines like any other text
  
  jkyberneees
  and
  claude
  committed
  4374311
- fix(telegram): emit an escaped horizontal rule for separator lines
  
  jkyberneees
  and
  claude
  committed
  c5d0ce2
- fix(telegram): close a code fence left open at end of the answer
  
  jkyberneees
  and
  claude
  committed
  8c85c5c
- fix(telegram): fallback endpoints get a fresh copy of the request body
  
  jkyberneees
  and
  claude
  committed
  5d9050a
- fix(telegram): a MEDIA-prefixed answer sends the file and then the text
  
  jkyberneees
  and
  claude
  committed
  6822535
- fix(telegram): media uploads honour parse mode and buttons, string fields verbatim
  
  jkyberneees
  and
  claude
  committed
  b40c12f
- fix(telegram): deliver the task-cancelled notice (escaped, with plain-text retry)
  
  jkyberneees
  and
  claude
  committed
  03d5683
- fix(telegram): escape parentheses in the daily-budget warning
  
  jkyberneees
  and
  claude
  committed
  5d38813
- fix(telegram): send clarify questions as escaped MarkdownV2
  
  jkyberneees
  and
  claude
  committed
  b84f6b9
- fix(schedule): releasing the schedule lock clears the holder PID
  
  jkyberneees
  and
  claude
  committed
  8f35cce
- fix(schedule): display fire times in the scheduler's default timezone
  
  jkyberneees
  and
  claude
  committed
  6788ded
- fix(telegram): /plan_resume injects the plan inside the untrusted wrapper and taints the session
  
  jkyberneees
  and
  claude
  committed
  fbeabb1
- fix(schedule): a scheduled turn recorded into a chat inherits the run's taint
  
  jkyberneees
  and
  claude
  committed
  02a9ced
- docs(telegram): upload approval, MEDIA handling, plan resume and schedule taint/timezone
  
  jkyberneees
  and
  claude
  committed
  9f462f6
- test(telegram): cover episode-taint marking, media params and open-fence closing
  
  jkyberneees
  and
  claude
  committed
  1a4d8fd
- fix(telegram): guard the clarify prompt message ID against the answer callback
  
  jkyberneees
  and
  claude
  committed
  961ba23
- test(schedule): timezone view test no longer mutates time.Local
  
  jkyberneees
  and
  claude
  committed
  62a3e6d
- fix(telegram): split long lines without leaving entities open
  
  jkyberneees
  and
  claude
  committed
  d713996
- fix(telegram): retry only markup rejections, as stripped plain text
  
  jkyberneees
  and
  claude
  committed
  c86ba3a
- fix(schedule): contended lock message never shows an empty PID
  
  jkyberneees
  and
  claude
  committed
  c5b81c7
- test(resource): case-fold alias of a trust anchor fails instead of skipping
  
  jkyberneees
  and
  claude
  committed
  a594cb8
- test(danger): pin HOME in the path-classification helper
  
  jkyberneees
  and
  claude
  committed
  b6152fb
- fix(danger): classify substitutions in arithmetic and subscript operands
  
  jkyberneees
  and
  claude
  committed
  4d7e747
- fix(danger): resolve parameter default expansions in classification and denylist
  
  jkyberneees
  and
  claude
  committed
  a9fdbc9
- fix(danger): classify jq/ps/export -p environment disclosure as system_write
  
  jkyberneees
  and
  claude
  committed
  6a0eced
- fix(danger): escalate pkill/killall catch-all patterns to system_write
  
  jkyberneees
  and
  claude
  committed
  fd3bb3a
- fix(danger): classify gpg program options as code_execution and key deletion as system_write
  
  jkyberneees
  and
  claude
  committed
  f462a4e
- fix(danger): path-classify sqlite ATTACH DATABASE targets
  
  jkyberneees
  and
  claude
  committed
  4801424
- fix(danger): scan trap action strings against the denylist
  
  jkyberneees
  and
  claude
  committed
  470f98d
- fix(danger): gate unread scripts behind fused value options, BASH_ENV/ENV and sqlite3 -init
  
  jkyberneees
  and
  claude
  committed
  2677fce
- fix(danger): escape zero-width nonspacing marks in approval prompts
  
  jkyberneees
  and
  claude
  committed
  b2dba12
- fix(danger): see fused printf -vNAME subscript substitutions
  
  jkyberneees
  and
  claude
  committed
  ddd030b
- fix(danger): classify awk ENVIRON, yq env, and bare readonly -p as environment dumps
  
  jkyberneees
  and
  claude
  committed
  fa26221
- fix(danger): treat near-universal pkill patterns and root-owned targets as broadcast
  
  jkyberneees
  and
  claude
  committed
  20a45a6
- fix(danger): let exact gpg option names win over abbreviation and gate non-default homes
  
  jkyberneees
  and
  claude
  committed
  ed437f2
- fix(danger): classify code carried by shell env assignments and gate gawk -E
  
  jkyberneees
  and
  claude
  committed
  9eaf5d9
- fix(danger): escape U+180F, braille blank and object replacement in prompts
  
  jkyberneees
  and
  claude
  committed
  0ce016e
- test(danger): pin review follow-ups, drop dated helper names, set HOME in fuzz targets
  
  jkyberneees
  and
  claude
  committed
  d66686d
- docs(security): describe env-assignment code, gpg homedir and env-dump additions
  
  jkyberneees
  and
  claude
  committed
  f4effc8
- fix(resource): gate @-references on sensitivity, not system-prefix rank
  
  jkyberneees
  and
  claude
  committed
  8f074eb
- fix(danger): map URL hosts through UTS-46 in ClassifyURL
  
  jkyberneees
  and
  claude
  committed
  2a8d8ab
- fix(redact): stop redacting working directories and test names
  
  jkyberneees
  and
  claude
  committed
  52b0620
- fix(schedule): resolve the default timezone once per command
  
  jkyberneees
  and
  claude
  committed
  1e555f7
- fix(redact): scope path and test-name rejection to the pwd and pass keys
  
  jkyberneees
  and
  claude
  committed
  81f730a
- fix(danger): root-scoped, fold-aware sensitive-path predicate
  
  jkyberneees
  and
  claude
  committed
  2c449b4
- fix(redact): require credential shape for bare token/secret/pass values
  
  jkyberneees
  and
  claude
  committed
  d384a0c
- fix(danger): share the home credential table between ClassifyPath and @-reference gate
  
  jkyberneees
  and
  claude
  committed
  839b14d
- fix(danger): classify PROMPT_COMMAND/PS/BASH_FUNC values at assignment
  
  jkyberneees
  and
  claude
  committed
  c9e5eeb
- fix(danger): detect match-everything pkill patterns by sampling realistic processes
  
  jkyberneees
  and
  claude
  committed
  24ee12f
- fix(danger): match key-file name hints as exact names or strong tokens
  
  jkyberneees
  and
  claude
  committed
  d2b272e
- fix(serve): give rejected /api/jobs polls their own rate-limit bucket
  
  jkyberneees
  and
  claude
  committed
  7e94fa9
- docs: @-reference protected paths, bare-key redaction value checks, new source files
  
  jkyberneees
  and
  claude
  committed
  1a95314
- test: pin subagent concurrency clamp and plan-resume taint at their own layer
  
  jkyberneees
  and
  claude
  committed
  6e460d4
- fix(danger): match home credential entries on path components for @-references
  
  jkyberneees
  and
  claude
  committed
  396ceb2
- fix(danger): classify printf -v and read/mapfile assignments to code variables
  
  jkyberneees
  and
  claude
  committed
  bf88604
- fix(redact): redact unseparated alphanumeric bare-key values, keep word-segment paths
  
  jkyberneees
  and
  claude
  committed
  35aba27
- chore(lint): drop unused artifactIDList; simplify sqlite ATTACH alias check
  
  jkyberneees
  and
  claude
  committed
  e54fcf0
- test: make the git-default and neutraliser-linearity checks environment-independent
  
  jkyberneees
  and
  claude
  committed
  e64b679

Commits

Commits on Oct 12, 2026