Peter Steinberger
2b76901f35
docs(changelog): credit reporter for control-ui auth hardening
2026-02-21 12:57:22 +01:00
Peter Steinberger
99048dbec2
fix(gateway): align insecure-auth toggle messaging
2026-02-21 12:57:22 +01:00
Peter Steinberger
810218756d
docs(security): clarify trusted-host deployment assumptions
2026-02-21 12:53:12 +01:00
Peter Steinberger
ede496fa1a
docs: clarify trusted-host assumption for tokenless tailscale
2026-02-21 12:52:49 +01:00
Peter Steinberger
fbb79d4013
fix(security): harden runtime command override gating
2026-02-21 12:49:57 +01:00
Peter Steinberger
cb84c537f4
fix: normalize status auth cost handling and models header tests
2026-02-21 12:45:06 +01:00
Peter Steinberger
e393d7aa5b
docs(changelog): clarify Security/Exec release note
2026-02-21 12:44:20 +01:00
Peter Steinberger
dff61a10e1
docs(changelog): add windows system.run approval mismatch fix note
2026-02-21 11:58:40 +01:00
Santiago Medina Rolong
11f6bea598
add secret safety
2026-02-21 11:58:14 +01:00
Santiago Medina Rolong
8db5e77ffa
skills: fmt
2026-02-21 11:58:14 +01:00
Santiago Medina Rolong
da844d6411
skills: update xurl description
2026-02-21 11:58:14 +01:00
Santiago Medina
ac2ef69454
Update skills/xurl/SKILL.md
...
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-02-21 11:58:14 +01:00
Santiago Medina Rolong
635b6298e3
skills: add xurl skill
2026-02-21 11:58:14 +01:00
Peter Steinberger
283029bdea
refactor(security): unify webhook auth matching paths
2026-02-21 11:52:34 +01:00
Peter Steinberger
6007941f04
fix(security): harden and refactor system.run command resolution
2026-02-21 11:49:38 +01:00
Peter Steinberger
5cc631cc9c
fix(agents): harden model-skip and tool-policy imports
2026-02-21 11:48:02 +01:00
Peter Steinberger
55aaeb5085
refactor(browser): centralize navigation guard enforcement
2026-02-21 11:46:11 +01:00
Peter Steinberger
2cdbadee1f
fix(security): block startup-file env injection across host execution paths
2026-02-21 11:44:20 +01:00
Peter Steinberger
6b2f2811dc
fix(security): require BlueBubbles webhook auth
2026-02-21 11:41:50 +01:00
Peter Steinberger
220bd95eff
fix(browser): block non-network navigation schemes
2026-02-21 11:31:53 +01:00
Peter Steinberger
c6ee14d60e
fix(security): block grep safe-bin file-read bypass
2026-02-21 11:18:29 +01:00
Ayaan Zaidi
f81522af2e
fix(docker): install Playwright Chromium into node cache ( #22585 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 84dc9ffccd27a51a5c9b8793e55d44abfc7ee520
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Reviewed-by: @obviyus
2026-02-21 15:48:27 +05:30
Peter Steinberger
75d4f6d51b
docs: reorder and trim 2026.2.21 changelog entries
2026-02-21 11:12:58 +01:00
Peter Steinberger
eccff0b6c0
docs: relabel dependency hygiene changelog entries
2026-02-21 11:05:05 +01:00
Peter Steinberger
9231d7d30f
chore: bump version to 2026.2.21
2026-02-21 11:02:30 +01:00
Ayaan Zaidi
677384c519
refactor: simplify Telegram preview streaming to single boolean ( #22012 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: a4017d3b9469d0c25c6ab3f4d9be06b98445474e
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Reviewed-by: @obviyus
2026-02-21 15:19:13 +05:30
Ayaan Zaidi
e1cb73cdeb
fix: unblock Docker build by aligning commands schema default ( #22558 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 1ad610176d0d08eb5ba055429a10d7e8f9ec07a4
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Reviewed-by: @obviyus
2026-02-21 14:47:28 +05:30
Vincent Koc
3f19259843
Update bug_report.yml
2026-02-21 04:06:07 -05:00
Vincent Koc
d2a7293744
Docs: issue template copy cleanup ( #22546 )
...
* docs: reduce channel-specific wording in feature template placeholder
* docs: make bug report template placeholders version-neutral
* docs: fix YAML indentation in bug report placeholder
* docs: fix indentation of version field in bug report template
2026-02-21 03:43:35 -05:00
Vincent Koc
dcf2c6d7f1
docs: normalize Amazon Bedrock setup section labels ( #22549 )
...
* docs(channels): promote Signal option setups to onboarding sections
* docs(channels): rename Microsoft Teams minimal setup section
* docs(channels): standardize onboarding option headings for Zalo and Twitch
* docs(providers): normalize Amazon Bedrock onboarding section labels
2026-02-21 03:40:54 -05:00
Vincent Koc
e36245bd37
docs: finalize onboarding option heading normalization ( #22547 )
...
* docs(channels): promote Signal option setups to onboarding sections
* docs(channels): rename Microsoft Teams minimal setup section
* docs(channels): standardize onboarding option headings for Zalo and Twitch
2026-02-21 03:38:37 -05:00
Vincent Koc
ef42fe0094
docs: rename Tlon setup heading ( #22544 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
* docs(channels): normalize Discord configuration heading
* docs(channels): standardize Microsoft Teams onboarding heading
* docs(channels): rename Signal configuration reference heading
* docs(channels): rename Matrix configuration reference heading
* docs(channels): normalize WhatsApp configuration heading
* docs(thinking): link reasoning section heading to in-page anchor
* docs(channels): normalize BlueBubbles configuration heading
* docs(channels): normalize Feishu configuration heading
* docs(channels): standardize Signal setup option headings
* docs(channels): refine Twitch setup heading clarity
* docs(channels): simplify Zalo setup heading phrasing
* docs(channels): trim Microsoft Teams minimal setup heading
* docs(channels): rename Tlon setup to onboarding
2026-02-21 03:37:27 -05:00
Vincent Koc
b5a77b9cb2
docs: finalize remaining setup heading phrasing ( #22543 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
* docs(channels): normalize Discord configuration heading
* docs(channels): standardize Microsoft Teams onboarding heading
* docs(channels): rename Signal configuration reference heading
* docs(channels): rename Matrix configuration reference heading
* docs(channels): normalize WhatsApp configuration heading
* docs(thinking): link reasoning section heading to in-page anchor
* docs(channels): normalize BlueBubbles configuration heading
* docs(channels): normalize Feishu configuration heading
* docs(channels): standardize Signal setup option headings
* docs(channels): refine Twitch setup heading clarity
* docs(channels): simplify Zalo setup heading phrasing
* docs(channels): trim Microsoft Teams minimal setup heading
2026-02-21 03:36:39 -05:00
Vincent Koc
d7891badda
docs: more channel heading consistency updates ( #22541 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
* docs(channels): normalize Discord configuration heading
* docs(channels): standardize Microsoft Teams onboarding heading
* docs(channels): rename Signal configuration reference heading
* docs(channels): rename Matrix configuration reference heading
* docs(channels): normalize WhatsApp configuration heading
* docs(thinking): link reasoning section heading to in-page anchor
* docs(channels): normalize BlueBubbles configuration heading
* docs(channels): normalize Feishu configuration heading
* docs(channels): standardize Signal setup option headings
2026-02-21 03:36:03 -05:00
Nimrod Gutman
78caf9ec3d
feat(ios): surface gateway talk defaults and refresh icon assets ( #22530 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 54f3a40e223f64a48f22485e919951d7ccd7ac85
Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com >
Co-authored-by: ngutman <1540134+ngutman@users.noreply.github.com >
Reviewed-by: @ngutman
2026-02-21 10:34:20 +02:00
Vincent Koc
e93e67bc8e
docs: fix thinking section heading link target ( #22539 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
* docs(channels): normalize Discord configuration heading
* docs(channels): standardize Microsoft Teams onboarding heading
* docs(channels): rename Signal configuration reference heading
* docs(channels): rename Matrix configuration reference heading
* docs(channels): normalize WhatsApp configuration heading
* docs(thinking): link reasoning section heading to in-page anchor
2026-02-21 03:33:06 -05:00
Vincent Koc
7c593cd333
docs: finish onboarding/config heading consistency ( #22537 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
* docs(channels): normalize Discord configuration heading
* docs(channels): standardize Microsoft Teams onboarding heading
* docs(channels): rename Signal configuration reference heading
* docs(channels): rename Matrix configuration reference heading
* docs(channels): normalize WhatsApp configuration heading
2026-02-21 03:32:37 -05:00
Vincent Koc
79183852f9
docs: more channel onboarding naming cleanup ( #22536 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
* docs(channels): standardize Google Chat onboarding heading
* docs(channels): standardize Mattermost onboarding heading
* docs(channels): standardize Zalo Personal onboarding heading
2026-02-21 03:31:55 -05:00
Vincent Koc
4c4147fb0a
docs: continue onboarding terminology cleanup ( #22535 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
* docs(channels): standardize Nostr onboarding and configuration headings
* docs(channels): standardize Zalo onboarding and configuration headings
* docs(channels): standardize Twitch onboarding heading
2026-02-21 03:31:22 -05:00
Vincent Koc
5eca08dab7
Chore: trim stale TODOs and issue-template language ( #22534 )
...
* docs: refresh issue template contact copy
* chore: remove OneDrive resumable upload TODO note
2026-02-21 03:31:17 -05:00
Vincent Koc
12d75ff7f5
docs: continue channel onboarding/config naming cleanup ( #22533 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
* docs(channels): rename iMessage onboarding and configuration sections
* docs(channels): rename Slack onboarding and configuration sections
* docs(channels): rename Signal onboarding heading
2026-02-21 03:30:35 -05:00
Vincent Koc
436f79839b
docs: more channel onboarding heading consistency ( #22532 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
* docs(channels): standardize Discord onboarding heading
* docs(channels): standardize Telegram onboarding heading
* docs(channels): standardize WhatsApp onboarding heading
2026-02-21 03:29:42 -05:00
Vincent Koc
325992b777
docs: small docs sweep consistency updates ( #22531 )
...
* docs: fix thinking link and add reasoning anchor reference
* docs(channels): rename LINE setup heading to onboarding
* docs(channels): normalize Nextcloud Talk onboarding headings
* docs(channels): use onboarding heading for Matrix setup
2026-02-21 03:29:17 -05:00
Vincent Koc
c20d519e05
feat(security): migrate sha1 hashes to sha256 for synthetic ids ( #7343 ) ( #22528 )
...
* feat(prompt): add explicit owner hash secret to obfuscation path
* feat(security): migrate synthetic IDs to sha256 for #7343
2026-02-21 03:20:14 -05:00
Vincent Koc
9abab6a2c9
Add explicit ownerDisplaySecret for owner ID hash obfuscation ( #22520 )
...
* feat(config): add owner display secret setting
* feat(prompt): add explicit owner hash secret to obfuscation path
* test(prompt): assert owner hash secret mode behavior
* Update src/agents/system-prompt.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-02-21 03:13:56 -05:00
SleuthCo.AI
fe609c0c77
security(hooks): block prototype-chain traversal in webhook template getByPath ( #22213 )
...
* security(hooks): block prototype-chain traversal in webhook template getByPath
The getByPath() function in hooks-mapping.ts traverses attacker-controlled
webhook payload data using arbitrary property path expressions, but does not
filter dangerous property names (__proto__, constructor, prototype).
The config-paths module (config-paths.ts) already blocks these exact keys
for config path traversal via a BLOCKED_KEYS set, but the hooks template
system was not protected with the same guard.
Add a BLOCKED_PATH_KEYS set mirroring config-paths.ts and reject traversal
into __proto__, prototype, or constructor in getByPath(). Add three test
cases covering all three blocked keys.
Signed-off-by: Alan Ross <alan@sleuthco.ai >
* test(gateway): narrow hook action type in prototype-pollution tests
* changelog: credit hooks prototype-path guard in PR 22213
* changelog: move hooks prototype-path fix into security section
---------
Signed-off-by: Alan Ross <alan@sleuthco.ai >
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-02-21 03:01:03 -05:00
Takayuki Maeda
0bee3f337a
MSTeams: dedupe sent-message cache storage ( #22514 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 88e14dcbe13006c4d1f353c0e7e196175747a4c8
Co-authored-by: TaKO8Ki <41065217+TaKO8Ki@users.noreply.github.com >
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Reviewed-by: @obviyus
2026-02-21 13:27:50 +05:30
Vincent Koc
f4a59eb5d8
Chore: harden A2UI bundle dependency resolution ( #22507 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: d84c5bde518a4b2f3d192b0446672afeecf3fa3d
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com >
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com >
Reviewed-by: @obviyus
2026-02-21 13:16:31 +05:30
Vincent Koc
187f4ea41f
deadcode: remove unused extension dev dependencies ( #22495 )
...
* Chore: remove unused extension dev dependencies
* Chore: fix changelog PR reference
* Chore: restore dropped deadcode changelog entries
* Chore: retag unused-dependency changelog entries
2026-02-21 02:15:43 -05:00
Vincent Koc
92ac6c95cc
CI: format github workflow ( #22497 )
2026-02-21 02:12:36 -05:00
