Sebastien Tardif 1463d3d72c fix(security): replace regex wildcard matching with linear-time glob in session-visibility ...

The agentToAgent allow-pattern matcher converted user wildcards like
`*a*b*c*` into `^.*a.*b.*c.*$` via RegExp.  Multiple overlapping
`.*` groups cause O(n^k) polynomial backtracking against non-matching
input, where k is the number of wildcards.

Replace the regex path with a segment-based glob matcher that splits on
`*` and checks prefix/suffix/interior segments in order.  The new
matcher runs in O(n*k) worst case and eliminates the regex engine
entirely from this path.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

2026-05-24 05:40:16 +01:00

..

acp

fix(acp): require allow option for auto approvals

2026-05-24 03:55:49 +01:00

agents

fix(security): replace regex wildcard matching with linear-time glob in session-visibility

2026-05-24 05:40:16 +01:00

auto-reply

Fix foreground reply fence visibility

2026-05-24 04:02:59 +01:00

bindings

…

bootstrap

…

channels

Fix foreground reply fence visibility

2026-05-24 04:02:59 +01:00

chat

…

cli

fix(update): ignore restart script spawn failures (#85761)

2026-05-23 20:41:40 -07:00

commands

fix(doctor): prune stale bundled plugin paths (#85038)

2026-05-23 20:39:42 -07:00

commitments

…

compat

…

config

fix: gate discord realtime voice by wake name (#85915)

2026-05-24 04:47:16 +01:00

context-engine

fix: guard transcript source reply rewrites

2026-05-24 03:37:43 +01:00

crestodian

refactor: remove sender owner tool gating

2026-05-21 15:14:48 +01:00

cron

refactor: split subagent delivery state

2026-05-24 00:05:48 +01:00

daemon

docs: absorb documentation PR sweep

2026-05-23 10:23:34 +01:00

docs

docs(config): quote bracket config paths (#83058)

2026-05-22 20:20:10 +01:00

flows

refactor: simplify doctor repair checks (#83753)

2026-05-23 07:55:12 -07:00

gateway

fix: notify chat when main session recovery fails

2026-05-24 05:38:59 +01:00

hooks

fix: limit subagent bootstrap defaults

2026-05-22 12:55:42 +01:00

i18n

…

image-generation

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

infra

fix(update): ignore inherited launchd xpc for respawn (#85789)

2026-05-23 20:42:05 -07:00

interactive

fix(discord): preserve reusable presentation buttons

2026-05-21 22:02:16 +01:00

link-understanding

…

logging

feat(diagnostics): classify skill and tool usage (#80370)

2026-05-23 16:08:55 +08:00

markdown

fix(telegram): preserve fenced code languages (#85209)

2026-05-22 09:59:06 +01:00

mcp

refactor: remove sender owner tool gating

2026-05-21 15:14:48 +01:00

media

Adapt image compression quality by model (#85742)

2026-05-23 21:45:55 +01:00

media-generation

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

media-understanding

fix(media-understanding): restore image description token default

2026-05-24 02:42:18 +01:00

meeting-notes

fix: order meeting notes startup around channels

2026-05-24 00:30:39 +01:00

memory

…

memory-host-sdk

fix(memory): report qmd workspace cwd probe failures (#63167)

2026-05-22 22:31:59 +01:00

model-catalog

Adapt image compression quality by model (#85742)

2026-05-23 21:45:55 +01:00

music-generation

…

node-host

Recheck rebuilt system.run argv [AI] (#84090)

2026-05-20 12:30:26 +05:30

pairing

[codex] restore QR bootstrap operator handoff (#83684)

2026-05-19 20:59:09 +03:00

plugin-sdk

fix(security): replace regex wildcard matching with linear-time glob in session-visibility

2026-05-24 05:40:16 +01:00

plugin-state

feat: add meeting notes plugin

2026-05-23 10:38:09 +01:00

plugins

fix(plugins): return plugin gateway method results (#85785)

2026-05-23 20:41:52 -07:00

process

fix: gracefully escalate process supervisor cancellations (#85865)

2026-05-24 03:35:37 +01:00

provider-runtime

…

proxy-capture

fix(proxy): add missing clientSocket error handler in CONNECT tunnel (#82444)

2026-05-22 22:33:46 +01:00

realtime-transcription

…

routing

fix(agent): support explicit CLI session keys (#85121)

2026-05-22 03:08:25 +00:00

scripts

…

secrets

[Fix] Preflight runtime SecretRefs before config writes (#84454)

2026-05-24 03:40:15 +01:00

security

fix(status): bound deep docker audit probes (#85476)

2026-05-23 12:08:48 +01:00

sessions

fix: preserve internal handoff status attribution [AI-assisted] (#85726)

2026-05-24 03:24:27 +01:00

shared

fix(message-tool): normalize send body aliases (#84102)

2026-05-22 20:38:08 +01:00

status

feat(agents): expose estimated context budget status

2026-05-23 14:17:44 -07:00

talk

feat(talk): add realtime active-run control

2026-05-24 02:35:04 +01:00

tasks

fix(codex): deliver native subagent completions

2026-05-22 15:28:46 +01:00

terminal

Scope config preflight note suppression (#84439)

2026-05-22 15:51:34 -07:00

test-helpers

…

test-utils

feat: add meeting notes plugin

2026-05-23 10:38:09 +01:00

tools

…

trajectory

feat: add meeting notes plugin

2026-05-23 10:38:09 +01:00

tts

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

tui

fix: ignore replayed empty TUI finals

2026-05-24 03:37:43 +01:00

types

fix(memory): close local embedding providers on timeout (#84048)

2026-05-19 09:19:09 +00:00

utils

perf(utils): preserve message identity in stripInlineDirectiveTagsFromMessageForDisplay (#85682)

2026-05-23 15:50:06 +01:00

video-generation

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

web

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

web-fetch

…

web-search

fix: pass active agent to web search execution

2026-05-22 08:49:53 +01:00

wizard

fix(skills): show empty state notice in config wizard (#85032)

2026-05-23 15:49:49 +01:00

browser-lifecycle-cleanup.test.ts

…

browser-lifecycle-cleanup.ts

…

docker-build-cache.test.ts

…

docker-image-digests.test.ts

…

docker-setup.e2e.test.ts

fix(docker): avoid printing gateway token

2026-05-23 11:54:53 +02:00

dockerfile.test.ts

test(docker): expect prod store seed command

2026-05-22 18:31:11 +01:00

entry.compile-cache.test.ts

…

entry.compile-cache.ts

…

entry.respawn.test.ts

…

entry.respawn.ts

…

entry.test.ts

perf: speed up secrets and nodes help startup (#84818)

2026-05-21 16:51:57 +08:00

entry.ts

perf: speed up secrets and nodes help startup (#84818)

2026-05-21 16:51:57 +08:00

entry.version-fast-path.test.ts

…

entry.version-fast-path.ts

…

extensionAPI.ts

…

global-state.ts

…

globals.ts

…

index.test.ts

…

index.ts

…

install-sh-version.test.ts

…

library.test.ts

…

library.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

param-key.ts

…

plugin-activation-boundary.test.ts

fix(ollama): bypass managed proxy for loopback embeddings (#85707)

2026-05-23 21:17:55 +01:00

poll-params.test.ts

…

poll-params.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

ui-app-settings.agents-files-refresh.test.ts

…

utils.test.ts

…

utils.ts

…

version.test.ts

chore(lint): remove underscore-dangle allow list (#83542)

2026-05-18 14:56:06 +01:00

version.ts

chore(lint): remove underscore-dangle allow list (#83542)

2026-05-18 14:56:06 +01:00