Fix high-severity security and bug findings - #2244

Merged

kojiwakayama merged 17 commits into

mainfrom

fix/security-bug-review-2026-06

Jun 9, 2026

Commits on Jun 9, 2026

Validate paths in coding-agent template file tools
kojiwakayama
committed
6574647
Contain worker fs adapter to the project directory
kojiwakayama
committed
caeab79
Stop OAuth init handler leaking internal error details
kojiwakayama
committed
3c04f81
Align constant-time padding with the CSRF comparison
kojiwakayama
committed
f5a3166
Scope DAG child-graph concurrency to a child executor
kojiwakayama
committed
554a72f
Release stream reader locks on error
kojiwakayama
committed
2cbcc9c
Throw JsonRpcError from MCP setLogLevel
kojiwakayama
committed
1070a0a
Derive SSR import cache buster from content
kojiwakayama
committed
3a6539b
Delete stale path-cache entry when cached path is not a file
kojiwakayama
committed
fddbfd6
Prepare security fixes for release 0.1.739
kojiwakayama
committed
28f7c67
Revert content-hash SSR cache buster
kojiwakayama
committed
a0be59b
Harden worker fs guard against symlink and Windows escapes
kojiwakayama
committed
343eb3a
Document residual compiled-binary worker read risk
kojiwakayama
committed
9668fd2
Fix worker-script test cast rejected by deno check
kojiwakayama
committed
5dedc09
Add portable realPath to veryfront/fs
kojiwakayama
committed
544dd67
Make coding-agent file tools symlink- and traversal-safe
kojiwakayama
committed
1f66f53
Add realPath to the veryfront/fs export-surface test
kojiwakayama
committed
830c03e