Peter Steinberger
|
538605ff44
|
[codex] Extract filesystem safety primitives (#77918)
* refactor: extract filesystem safety primitives
* refactor: use fs-safe for file access helpers
* refactor: reuse fs-safe for media reads
* refactor: use fs-safe for image reads
* refactor: reuse fs-safe in qqbot media opener
* refactor: reuse fs-safe for local media checks
* refactor: consume cleaner fs-safe api
* refactor: align fs-safe json option names
* fix: preserve fs-safe migration contracts
* refactor: use fs-safe primitive subpaths
* refactor: use grouped fs-safe subpaths
* refactor: align fs-safe api usage
* refactor: adapt private state store api
* chore: refresh proof gate
* refactor: follow fs-safe json api split
* refactor: follow reduced fs-safe surface
* build: default fs-safe python helper off
* fix: preserve fs-safe plugin sdk aliases
* refactor: consolidate fs-safe usage
* refactor: unify fs-safe store usage
* refactor: trim fs-safe temp workspace usage
* refactor: hide low-level fs-safe primitives
* build: use published fs-safe package
* fix: preserve outbound recovery durability after rebase
* chore: refresh pr checks
|
2026-05-06 02:15:17 +01:00 |
|
Michael Appel
|
9f97ad857a
|
fix(security): pin axios to 1.15.0 and add dependency denylist for plugin installs [AI-assisted] (#63891)
* fix: address issue
* fix: address review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* Plugins: fix install security CI regressions
* Plugins: make manifest traversal linear
* Plugins: bound manifest security traversal
* Plugins: block denied node_modules package dirs
* Plugins: match node_modules case-insensitively
* Plugins: block denied package symlink paths
* Tests: normalize blocked symlink assertion
* Plugins: fail closed on unreadable denied paths
* Plugins: block denied node_modules file aliases
* Plugins: inspect node_modules symlink targets
* Plugins: preserve symlink target package paths
* fix: address PR review feedback
* chore(changelog): add axios pin and dependency denylist entry
---------
Co-authored-by: Devin Robison <drobison@nvidia.com>
|
2026-04-10 11:20:05 -06:00 |
|
George Zhang
|
150faba8d1
|
plugins: enrich before_install policy context
|
2026-03-29 12:35:01 -07:00 |
|
Peter Steinberger
|
0b94382930
|
fix(plugins): prefer runtime version for host compatibility
|
2026-03-27 02:29:32 +00:00 |
|
Peter Steinberger
|
5d379f92a3
|
perf: lazy-load plugin install runtime helpers
|
2026-03-22 21:52:42 +00:00 |
|