Coy Geek 40a292619e fix: Control UI Insecure Auth Bypass Allows Token-Only Auth Over HTTP (#20684) ...

Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: ad9be4b4d65698785ad7ea9ad650f54d16c89c4a
Co-authored-by: coygeek <65363919+coygeek@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky

2026-02-20 17:34:34 +00:00

..

audit-channel.ts

refactor(security): share DM allowlist state resolver

2026-02-18 23:58:11 +00:00

audit-extra.async.ts

chore: fix formatting drift and stabilize cron tool mocks

2026-02-19 15:41:38 +01:00

audit-extra.sync.test.ts

perf(test): fold secret equality assertions into audit extra suite

2026-02-16 00:18:27 +00:00

audit-extra.sync.ts

style: fix formatting drift in security allowlist checks

2026-02-19 13:31:01 +00:00

audit-extra.ts

feat(security): audit gateway HTTP no-auth exposure

2026-02-19 14:25:56 +01:00

audit-fs.ts

Doctor/Security: fix telegram numeric ID + symlink config permission warnings (#19844)

2026-02-18 00:09:51 -08:00

audit-tool-policy.ts

refactor(core): dedupe tool policy and IPv4 matcher logic

2026-02-16 16:14:54 +00:00

audit.test.ts

chore: fix formatting drift and stabilize cron tool mocks

2026-02-19 15:41:38 +01:00

audit.ts

fix: Control UI Insecure Auth Bypass Allows Token-Only Auth Over HTTP (#20684)

2026-02-20 17:34:34 +00:00

channel-metadata.ts

fix(security): separate untrusted channel metadata from system prompt (thanks @KonstantinMirin)

2026-02-03 23:02:45 -08:00

dangerous-tools.ts

refactor(security): centralize dangerous tool lists

2026-02-14 13:27:05 +01:00

dm-policy-shared.test.ts

refactor(security): share DM allowlist state resolver

2026-02-18 23:58:11 +00:00

dm-policy-shared.ts

refactor(security): share DM allowlist state resolver

2026-02-18 23:58:11 +00:00

external-content.test.ts

refactor(core): dedupe shared config and runtime helpers

2026-02-16 14:59:30 +00:00

external-content.ts

fix(security): handle additional Unicode angle bracket homoglyphs in content sanitization (#14665)

2026-02-13 16:18:54 +01:00

fix.test.ts

refactor(core): dedupe shared config and runtime helpers

2026-02-16 14:59:30 +00:00

fix.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

scan-paths.ts

fix(security): enforce plugin and hook path containment

2026-02-19 15:37:29 +01:00

secret-equal.ts

fix(security): SHA-256 hash before timingSafeEqual to prevent length leak (#20856)

2026-02-19 03:16:35 -08:00

skill-scanner.test.ts

security: add skill/plugin code safety scanner (#9806)

2026-02-05 16:06:11 -08:00

skill-scanner.ts

refactor(security): reuse shared scan path containment helper

2026-02-19 00:20:15 +00:00

temp-path-guard.test.ts

refactor(security): harden temp-path handling for inbound media

2026-02-19 14:06:37 +01:00

windows-acl.test.ts

fix: stabilize windows acl tests and command auth registry (#9335) (thanks @M00N7682)

2026-02-05 00:38:35 -08:00

windows-acl.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00