shenghui kevin 57783680ad fix(whatsapp): guard updateLastRoute when dmScope isolates DM sessions ...

When session.dmScope is set to 'per-channel-peer', WhatsApp DMs correctly
resolve isolated session keys, but updateLastRouteInBackground unconditionally
wrote lastTo to the main session key. This caused reply routing corruption
and privacy violations.

Only update main session's lastRoute when the DM session actually IS
the main session (sessionKey === mainSessionKey).

Fixes #24912

2026-02-24 03:55:29 +00:00

..

acp

fix(acp): harden permission tool-name validation

2026-02-24 01:11:34 +00:00

agents

fix: expand openrouter thinking-off regression coverage (#24863) (thanks @DevSecTim)

2026-02-24 03:54:29 +00:00

auto-reply

fix(security): harden session export image data-url handling

2026-02-24 02:53:39 +00:00

browser

test: add env -S allowlist bypass regressions

2026-02-24 02:28:00 +00:00

canvas-host

test: tighten canvas host websocket watchdog timeouts

2026-02-21 23:02:44 +00:00

channels

fix: harden legacy plugin schema compatibility tests (#24933) (thanks @pandego)

2026-02-24 03:50:53 +00:00

cli

fix(gateway): bind node exec approvals to nodeId

2026-02-24 03:05:58 +00:00

commands

fix: sanitize pairing recovery requestId hints (#24771) (thanks @markmusson)

2026-02-24 03:53:45 +00:00

compat

…

config

fix(config): align whatsapp enabled schema with auto-enable

2026-02-24 03:39:41 +00:00

cron

Session/Cron maintenance hardening and cleanup UX (#24753)

2026-02-23 22:39:48 +00:00

daemon

fix: back up existing systemd unit before overwriting on update (#24350) (#24937)

2026-02-24 03:22:55 +00:00

discord

fix: harden queue retry debounce and add regression tests

2026-02-24 03:52:49 +00:00

docs

…

gateway

fix: harden queue retry debounce and add regression tests

2026-02-24 03:52:49 +00:00

hooks

fix: respect agent model config in slug generator (#24776)

2026-02-24 03:22:48 +00:00

imessage

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

infra

fix(infra): handle Windows dev=0 in sameFileIdentity TOCTOU check (#24939)

2026-02-24 03:33:27 +00:00

line

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

link-understanding

chore: remove verified dead code paths

2026-02-22 09:21:09 +01:00

logging

fix(security): harden regex compilation for filters and redaction

2026-02-23 23:54:50 +00:00

markdown

test: dedupe channel and transport adapters

2026-02-21 21:44:01 +00:00

media

fix(security): harden session export image data-url handling

2026-02-24 02:53:39 +00:00

media-understanding

refactor: de-duplicate channel runtime and payload helpers

2026-02-23 21:25:28 +00:00

memory

refactor: deduplicate shared helpers and test setup

2026-02-23 20:40:44 +00:00

node-host

fix(security): trust resolved skill-bin paths in allowlist auto-allow

2026-02-24 03:12:43 +00:00

pairing

refactor: de-duplicate channel runtime and payload helpers

2026-02-23 21:25:28 +00:00

plugin-sdk

refactor(security): unify dangerous name matching handling

2026-02-24 01:33:08 +00:00

plugins

fix: harden queue retry debounce and add regression tests

2026-02-24 03:52:49 +00:00

process

test: speed up supervisor test timing

2026-02-23 20:15:56 +00:00

providers

Config: expand Kilo catalog and persist selected Kilo models (#24921)

2026-02-23 21:17:37 -05:00

routing

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

scripts

test(scripts): dedupe a2ui temp fixture and cover skip-missing env path

2026-02-21 21:40:39 +00:00

security

fix(sandbox): harden fs bridge path checks and bind mount policy

2026-02-24 02:21:43 +00:00

sessions

Agents/Replies: scope done fallback to direct sessions

2026-02-22 13:30:30 -08:00

shared

fix: scope Telegram RFC2544 SSRF exception to policy opt-in (#24982) (thanks @stakeswky)

2026-02-24 03:28:00 +00:00

signal

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

slack

refactor(security): unify dangerous name matching handling

2026-02-24 01:33:08 +00:00

telegram

fix: scope Telegram RFC2544 SSRF exception to policy opt-in (#24982) (thanks @stakeswky)

2026-02-24 03:28:00 +00:00

terminal

test(core): use lightweight clears in runtime and telegram setup

2026-02-22 08:09:14 +00:00

test-helpers

refactor: dedupe media and request-body test scaffolding

2026-02-22 18:37:25 +00:00

test-utils

test: dedupe fixtures and test harness setup

2026-02-23 05:45:54 +00:00

tts

test: streamline auto-reply and tts suites

2026-02-21 21:44:01 +00:00

tui

test: dedupe fixtures and test harness setup

2026-02-23 05:45:54 +00:00

types

…

utils

refactor!: remove google-antigravity provider support

2026-02-23 05:20:14 +01:00

web

fix(whatsapp): guard updateLastRoute when dmScope isolates DM sessions

2026-02-24 03:55:29 +00:00

whatsapp

WhatsApp: enforce allowFrom for explicit outbound sends (#20921)

2026-02-22 18:13:23 -05:00

wizard

test: dedupe gateway browser discord and channel coverage

2026-02-22 17:11:54 +00:00

channel-web.ts

…

docker-image-digests.test.ts

…

docker-setup.test.ts

Docker: precreate identity dir in docker setup

2026-02-22 16:33:53 -08:00

dockerfile.test.ts

…

entry.ts

refactor(gateway): simplify restart flow and expand lock tests

2026-02-22 10:44:47 +01:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

utils.test.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

utils.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

version.test.ts

test(core): increase coverage for sessions, auth choice, and model listing

2026-02-22 14:08:51 +00:00

version.ts

…