Repository navigation

fix: 69 validated findings from the second 2026-10-12 bug hunt - #318

Merged

jkyberneees merged 111 commits into

mainfrom

fix/bughunt-2026-10-12b

Oct 12, 2026

Merged

fix: 69 validated findings from the second 2026-10-12 bug hunt#318
jkyberneees merged 111 commits into
mainfrom
fix/bughunt-2026-10-12b

Commits on Oct 12, 2026
- fix(loop): neutralise padded, modifier-separated and look-alike-bracket forged tags
  
  jkyberneees
  and
  claude
  committed
  286f27a
- fix(loop): argv0 skips array and append assignments
  
  jkyberneees
  and
  claude
  committed
  57be8bb
- fix(loop): safe tools no longer withhold batch trust; compaction cut on rune boundary
  
  jkyberneees
  and
  claude
  committed
  ff08b42
- fix(loop): argv0 skips subscripted assignments
  
  jkyberneees
  and
  claude
  committed
  834222d
- fix(loop): neutralise enclosed-letter, Armenian/Cherokee and bracket look-alikes; keep spaced prose
  
  jkyberneees
  and
  claude
  committed
  4532579
- fix(http_request): strip credentials on every https-to-http hop
  
  jkyberneees
  and
  claude
  committed
  4e11717
- fix(transcribe): never pass a protocol-shaped path to ffmpeg
  
  jkyberneees
  and
  claude
  committed
  b494046
- fix(speak): write audio atomically so artifact symlinks are replaced not followed
  
  jkyberneees
  and
  claude
  committed
  4ff2679
- fix(browser): wrap body-read error text as untrusted
  
  jkyberneees
  and
  claude
  committed
  3d17f32
- fix(list_tools): redact values after auth/pass/cookie-style MCP flags
  
  jkyberneees
  and
  claude
  committed
  e01a523
- fix(transcribe): restrict ffmpeg to file protocol and audio/video containers
  
  jkyberneees
  and
  claude
  committed
  757542f
- fix(list_tools): do not over-mask MCP switches that only mention a credential word
  
  jkyberneees
  and
  claude
  committed
  60712c8
- fix(speak): refuse a symlinked or non-directory artifacts root
  
  jkyberneees
  and
  claude
  committed
  984b271
- fix(mcp): keep only structural pattern/format/$ref in the provider schema
  
  jkyberneees
  and
  claude
  committed
  0b5eeb9
- fix(subagent): digest denial reasons in subagent_denied events
  
  jkyberneees
  and
  claude
  committed
  25fbc39
- fix(mcp): approval prompt shows the full description the model receives
  
  jkyberneees
  and
  claude
  committed
  802cbe9
- fix(mcpclient): bounded tools/list pagination, 64-char tool names, HTTP Close aborts calls
  
  jkyberneees
  and
  claude
  committed
  85826ee
- fix(agent): open AGENTS.md with O_NOFOLLOW
  
  jkyberneees
  and
  claude
  committed
  22112ef
- test: regression tests for the runtime-area findings
  
  jkyberneees
  and
  claude
  committed
  5c3049d
- fix(mcpclient): keep the __ separator in shortened tool names; stop on repeated cursor
  
  jkyberneees
  and
  claude
  committed
  58a5444
- fix(mcp): tighten schema pattern and enum prose rules
  
  jkyberneees
  and
  claude
  committed
  36b0f9b
- fix(telegram): outbound media rejects credential-shaped files
  
  jkyberneees
  and
  claude
  committed
  945592d
- fix(telegram): balance entities on every prose split path
  
  jkyberneees
  and
  claude
  committed
  329d6f2
- fix(telegram): plain-text fallback keeps code content
  
  jkyberneees
  and
  claude
  committed
  207a40a
- fix(telegram): convert CommonMark **bold** to MarkdownV2 bold
  
  jkyberneees
  and
  claude
  committed
  e8ff399
- fix(telegram): bot client timeout covers the longest long-poll
  
  jkyberneees
  and
  claude
  committed
  8cadec3
- fix(telegram): refuse uploads over the Bot API size limit before reading
  
  jkyberneees
  and
  claude
  committed
  c9a4713
- fix(schedule): scheduled Telegram delivery uses the stripped plain fallback
  
  jkyberneees
  and
  claude
  committed
  65b8936
- fix(telegram): daily token budget fails closed and keys on the UTC date
  
  jkyberneees
  and
  claude
  committed
  7a121d1
- fix(telegram): /plan_view cuts on a rune boundary; /plan_resume honours the chat lock
  
  jkyberneees
  and
  claude
  committed
  3848a81
- docs(telegram): media credential model, budget, upload and client timeout behavior
  
  jkyberneees
  and
  claude
  committed
  0bbf1e1
- test(telegram): cover StripMarkdown code handling and entity-balanced cuts
  
  jkyberneees
  and
  claude
  committed
  fecd90f
- refactor(telegram): keep each doc comment on its own function
  
  jkyberneees
  and
  claude
  committed
  089c8a9
- fix(telegram): daily budget counter is written atomically; empty counter is zero usage
  
  jkyberneees
  and
  claude
  committed
  c52cc3b
- fix(telegram): media directory-name credential rules skip ordinary media files
  
  jkyberneees
  and
  claude
  committed
  eac4280
- fix(telegram): crossed emphasis never yields crossed MarkdownV2 entities
  
  jkyberneees
  and
  claude
  committed
  01d5bf9
- fix(session): redact tool-call arguments with key context
  
  jkyberneees
  and
  claude
  committed
  84ad33e
- fix(session): redact system records on every save
  
  jkyberneees
  and
  claude
  committed
  9dd6956
- fix(session): reads under ~/.odek taint the episode
  
  jkyberneees
  and
  claude
  committed
  e4fded3
- fix(memory): redact buffer lines before truncating
  
  jkyberneees
  and
  claude
  committed
  063c49c
- fix(memory): consolidation keeps a pin from any group member
  
  jkyberneees
  and
  claude
  committed
  f2c7284
- fix(memory): sanitize pending-review ID and field on display
  
  jkyberneees
  and
  claude
  committed
  d89f74a
- fix(memory): write the episode index before its summary file
  
  jkyberneees
  and
  claude
  committed
  e0d0b0d
- test(memory): regression tests for the memory-area findings
  
  jkyberneees
  and
  claude
  committed
  5b0502f
- fix(session): make tool-argument key-context redaction precise
  
  jkyberneees
  and
  claude
  committed
  0f913f1
- fix(serve): audit the first turn of a new session and drop audit writes after delete
  
  jkyberneees
  and
  claude
  committed
  15d4cb5
- fix(serve): retire pending approvals before announcing expiry or cancel
  
  jkyberneees
  and
  claude
  committed
  96d08bc
- fix(serve): throttle WebSocket session lookup rejections and close approver on disconnect
  
  jkyberneees
  and
  claude
  committed
  aa239fd
- fix(serve): order audit writes against Delete and bound the pre-session ingest buffer
  
  jkyberneees
  and
  claude
  committed
  13d8f6f
- fix(serve): honor an approval or clarify answer accepted at the timeout instant
  
  jkyberneees
  and
  claude
  committed
  ff1b7a1
- fix(serve): rate limit @sess: rejections inside headless runs
  
  jkyberneees
  and
  claude
  committed
  1da183e
- fix(subagent): staging root and task dir never followed through symlinks
  
  jkyberneees
  and
  claude
  committed
  3c3b18b
- fix(subagent): children inherit the parent's tool filter, sandbox posture and approvals
  
  jkyberneees
  and
  claude
  committed
  896a759
- fix(config): bare $VAR in project sandbox_env is flagged as host interpolation
  
  jkyberneees
  and
  claude
  committed
  54a01a0
- fix(agent): CommonMark fence tracking for pillar stripping and fence closing
  
  jkyberneees
  and
  claude
  committed
  af2fe0e
- fix(config): project config may only lower max_tool_parallel and skills load limits
  
  jkyberneees
  and
  claude
  committed
  1f941d1
- fix(skills): skill promote refuses symlinked SKILL.md and skill dirs
  
  jkyberneees
  and
  claude
  committed
  b476f98
- fix(subagent): cap staging copy at the artifact budget and drop partial copies
  
  jkyberneees
  and
  claude
  committed
  494e5fc
- fix(subagent): forward only directory- and content-bound approvals to children
  
  jkyberneees
  and
  claude
  committed
  f1a01af
- fix(agent): fence tracker follows list-item containers
  
  jkyberneees
  and
  claude
  committed
  2121396
- fix(redact): one literal-value check for credential-named assignments
  
  jkyberneees
  and
  claude
  committed
  dab6ea4
- fix(render): escape the same zero-width marks as approval prompts
  
  jkyberneees
  and
  claude
  committed
  8fa0310
- fix(audit): escape bidi, C1 and zero-width characters in 'odek audit <id>' output
  
  jkyberneees
  and
  claude
  committed
  310da75
- fix(unreadscan): decode line-wrapped base64 and bound candidates by bytes
  
  jkyberneees
  and
  claude
  committed
  fcddd46
- fix(redact): linear-time credential redaction with bounded values
  
  jkyberneees
  and
  claude
  committed
  fe955b3
- fix(redact): leave the closing quote of an enclosing JSON string outside an unquoted value
  
  jkyberneees
  and
  claude
  committed
  6295229
- fix(unreadscan): dedupe decodes and scan every decode head before remainders
  
  jkyberneees
  and
  claude
  committed
  d2cf05d
- fix(danger): classify substitutions in quoted arithmetic and substring operands
  
  jkyberneees
  and
  claude
  committed
  f82e636
- fix(danger): match wildcard operands against credential and trust-anchor paths
  
  jkyberneees
  and
  claude
  committed
  c808efd
- fix(danger): gate HOME/XDG_CONFIG_HOME overrides in front of startup-file shells
  
  jkyberneees
  and
  claude
  committed
  ffd75ab
- fix(danger): catch pkill/killall inverse, empty, list and root selectors and pgrep-fed kills
  
  jkyberneees
  and
  claude
  committed
  06108aa
- fix(danger): classify gpg key fetch, card, trust and preference verbs as keyring mutations
  
  jkyberneees
  and
  claude
  committed
  202a4d3
- fix(danger): see jq env dumps behind --argfile and python-yq; treat .env filters as data
  
  jkyberneees
  and
  claude
  committed
  e1ba0a2
- fix(danger): scan environment, builtin-assigned and arithmetic code bodies and pipe-fed argv composition in the denylist
  
  jkyberneees
  and
  claude
  committed
  1093a11
- fix(danger): rate sqlite readfile() and recursive readers over secret trees as secret reads
  
  jkyberneees
  and
  claude
  committed
  3344b3e
- fix(danger): compare account homes and rc/history parents case-folded
  
  jkyberneees
  and
  claude
  committed
  a38547d
- fix(danger): refuse shell/REPL history, fish config and rotated odek logs as sensitive reads
  
  jkyberneees
  and
  claude
  committed
  661a5ba
- fix(danger): classify zone-scoped IPv6 URL literals by their address
  
  jkyberneees
  and
  claude
  committed
  ef13f2a
- docs(danger): document the new classifier and denylist coverage
  
  jkyberneees
  and
  claude
  committed
  2d4a45a
- fix(danger): compute the pgrep-substitution broadcast check once per analysis
  
  jkyberneees
  and
  claude
  committed
  90b7fe8
- fix(danger): back the read gate and ClassifyPath with one home history table
  
  jkyberneees
  and
  claude
  committed
  9c33587
- fix(danger): track HOME/XDG_CONFIG_HOME/ZDOTDIR across segments; stop flagging bare exports
  
  jkyberneees
  and
  claude
  committed
  705f70c
- fix(danger): let any /proc environ path component be a glob
  
  jkyberneees
  and
  claude
  committed
  379b2d4
- fix(danger): treat a catch-all pgrep feeding kill through loops and nested substitutions as a broadcast
  
  jkyberneees
  and
  claude
  committed
  e2f4d4c
- fix(danger): compose GNU parallel and xargs placeholders and here-strings in classifier and denylist
  
  jkyberneees
  and
  claude
  committed
  a00d9a1
- docs(danger): document cross-segment startup overrides, parallel composition and shared history table
  
  jkyberneees
  and
  claude
  committed
  4260676
- fix(subagent): forward the parent's tool filter, not its surviving tool list
  
  jkyberneees
  and
  claude
  committed
  4931e47
- fix(loop): neutralise spaced forgeries of the untrusted-content tag
  
  jkyberneees
  and
  claude
  committed
  b3a69f8
- fix(introspect): mask dash-led values after credential flags
  
  jkyberneees
  and
  claude
  committed
  9ba4d0a
- fix(telegram): apply media directory-name rules only below the working dir
  
  jkyberneees
  and
  claude
  committed
  1355e8c
- docs: note UTC daily budget reset on upgrade; list new source files
  
  jkyberneees
  and
  claude
  committed
  291449a
- test: reword comments that referenced review findings
  
  jkyberneees
  and
  claude
  committed
  c1a55a1
- fix(redact): linear credential scanning, brackets inside secrets, skipped references consumed
  
  jkyberneees
  and
  claude
  committed
  6f92ddc
- fix(redact): leave Go source fields and secret-store references unredacted
  
  jkyberneees
  and
  claude
  committed
  3a74b2a
- fix(redact): camelCase and PascalCase names ending in a secret word carry secrets
  
  jkyberneees
  and
  claude
  committed
  b27cb19
- fix(redact): quoted command-substitution references stay readable; document credential value rules
  
  jkyberneees
  and
  claude
  committed
  793546c
- fix(danger): bound argv composer compositions by a total token/byte budget
  
  jkyberneees
  and
  claude
  committed
  2700b6a
- fix(danger): wildcards over /proc environ and home shell rc/history files are secret reads
  
  jkyberneees
  and
  claude
  committed
  2d8f07a
- fix(danger): HOME/XDG_CONFIG_HOME overrides for git are system_write
  
  jkyberneees
  and
  claude
  committed
  d8b6609
- fix(danger): recursive-reader secret roots judge output breadth, wildcard roots and find|xargs
  
  jkyberneees
  and
  claude
  committed
  b1de105
- docs(security): document composer budget, glob/git/recursive-reader classifications
  
  jkyberneees
  and
  claude
  committed
  dbc96db
- fix(loop): neutralise spaced-opener tag forgeries with spaced words
  
  jkyberneees
  and
  claude
  committed
  ee79d9e
- fix(redact): letters-only secrets before punctuation are not treated as source identifiers
  
  jkyberneees
  and
  claude
  committed
  d88eeb0
- perf(redact): judge unquoted credential values on a 256-byte window
  
  jkyberneees
  and
  claude
  committed
  7d632f2
- fix(danger): narrow search patterns must be plain literals; empty search patterns are broad
  
  jkyberneees
  and
  claude
  committed
  0147ffe
- fix(danger): argv composer command cap fails closed
  
  jkyberneees
  and
  claude
  committed
  167d01c
- fix(danger): /proc/<pid>/task/<tid>/environ globs are secret reads
  
  jkyberneees
  and
  claude
  committed
  92e6e47
- fix(danger): other accounts' shell rc/history files are secret reads
  
  jkyberneees
  and
  claude
  committed
  f9ac5e1
- docs(security): literal-pattern rule for narrow searches
  
  jkyberneees
  and
  claude
  committed
  1e72277
- chore: staticcheck fixes; skill promote resolves paths through os.Root
  
  jkyberneees
  and
  claude
  committed
  834bfd4
- test(telegram): wait out post-turn background writes before temp-dir cleanup
  
  jkyberneees
  and
  claude
  committed
  05b2d0a

Commits

Commits on Oct 12, 2026