Yuval Dinodia acb0e8e88d fix(irc): classify host-less nick!user allowlist entries as mutable ...

An IRC sender mask is nick!user@host where only host is server verified;
nick and user (ident) are client supplied and spoofable. The allowlist
identity classifier treated any entry containing "!" or "@" as a verified
stable identity, so a host-less nick!user entry was classified stable and
matched by the host-less nick!user subject candidate. With
dangerouslyAllowNameMatching at its secure default (off), the mutable
identifier policy only strips entries owned by a dangerous field, so the
host-less entry was never stripped and a remote sender presenting the same
nick and ident was admitted regardless of host.

Require a verified @host component before an entry or subject is classified
stable. Host-less nick and host-less nick!user are now both routed to a
dangerous (mutable) field so they are gated by the same name-matching policy.
The doctor mutable-allowlist detector now also flags host-less nick!user
entries so operators who typed that undocumented shape get a warning. The
documented full nick!user@host mask stays stable and unaffected.

2026-07-01 04:01:05 -07:00

..

acpx

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

active-memory

Fix active-memory stale ops summaries (#95888)

2026-07-01 00:59:47 -07:00

admin-http-rpc

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

alibaba

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

amazon-bedrock

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

amazon-bedrock-mantle

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

anthropic

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

anthropic-vertex

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

arcee

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

azure-speech

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

bonjour

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

brave

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

browser

fix(browser): bound error body read in fetchHttpJson to prevent OOM (#98455)

2026-07-01 03:05:58 -07:00

byteplus

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

canvas

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

cerebras

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

chutes

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

clickclack

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

cloudflare-ai-gateway

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

codex

fix(codex): derive terminal-idle watchdog from explicit run timeout (#85296)

2026-07-01 03:25:13 -07:00

codex-supervisor

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

cohere

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

comfy

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

copilot

fix(copilot): guard against undefined runtime.state during cli-metadata registration (#95229)

2026-07-01 01:56:51 -07:00

copilot-proxy

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

deepgram

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

deepinfra

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

deepseek

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

device-pair

fix: advertise route-aware LAN Control UI links (#98482)

2026-07-01 04:02:12 -05:00

diagnostics-otel

fix(gateway): emit stale exec approval followup diagnostics (#98293)

2026-07-01 05:20:53 +01:00

diagnostics-prometheus

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

diffs

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

diffs-language-pack

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

discord

fix(anthropic): surface Discord pre-tool commentary

2026-06-30 18:12:07 -07:00

document-extract

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

duckduckgo

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

elevenlabs

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

exa

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

fal

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

feishu

[AI] fix(feishu): guard partial channelRuntime in monitor startup (#94013)

2026-07-01 01:58:58 -07:00

file-transfer

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

firecrawl

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

fireworks

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

github-copilot

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

gmi

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

google

fix(llm): preserve structured tool result replay

2026-06-30 23:44:02 -07:00

google-meet

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

googlechat

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

gradium

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

groq

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

huggingface

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

image-generation-core

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

imessage

feat(imessage): native poll support — create, read, vote (#98421)

2026-07-01 10:48:32 +01:00

inworld

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

irc

fix(irc): classify host-less nick!user allowlist entries as mutable

2026-07-01 04:01:05 -07:00

kilocode

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

kimi-coding

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

line

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

litellm

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

llama-cpp

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

llm-task

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

lmstudio

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

lobster

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

matrix

fix(matrix): guard JSON.parse against malformed homeserver response bodies (#97973)

2026-06-30 18:15:14 -07:00

mattermost

fix(mattermost): bound null-body error response reads (#97851)

2026-07-01 02:53:24 -07:00

media-understanding-core

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

memory-core

test(memory): cover live manager after CLI reindex (#96094)

2026-07-01 01:59:20 -07:00

memory-lancedb

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

memory-wiki

fix(memory-wiki): preserve notes after transient page reads (#98360)

2026-07-01 02:55:05 -07:00

microsoft

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

microsoft-foundry

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

migrate-claude

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

migrate-hermes

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

minimax

fix(minimax): bound OAuth JSON response via shared provider reader (#96322)

2026-07-01 01:54:42 -07:00

mistral

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

moonshot

fix(moonshot): bound video description JSON response reads (#96502)

2026-06-30 12:12:46 -07:00

msteams

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

nextcloud-talk

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

nostr

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

novita

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

nvidia

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

oc-path

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

ollama

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

open-prose

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

openai

feat(openai): add GPT-5.6 series support (#98333)

2026-07-01 06:48:57 +01:00

opencode

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

opencode-go

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

openrouter

fix(openrouter): send explicit auth headers (#98187)

2026-06-30 18:03:14 -07:00

openshell

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

parallel

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

perplexity

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

phone-control

…

pixverse

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

policy

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

qa-channel

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

qa-lab

test(qa-lab): harden whatsapp qa scenarios (#95622)

2026-07-01 00:01:09 -03:00

qa-matrix

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

qianfan

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

qqbot

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

qwen

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

raft

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

runway

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

searxng

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

senseaudio

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

sglang

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

signal

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

slack

fix(slack): truncate served arg-menu option labels on a surrogate boundary (#97923)

2026-07-01 03:12:56 -07:00

sms

fix(sms): guard Twilio JSON.parse against malformed API response bodies (#97999)

2026-06-30 18:15:08 -07:00

stepfun

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

synology-chat

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

synthetic

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

talk-voice

fix(voice): require admin for voice set (#97874)

2026-06-29 15:41:26 -07:00

tavily

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

telegram

fix(anthropic): surface Discord pre-tool commentary

2026-06-30 18:12:07 -07:00

tencent

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

test-support

Bound successful provider response reads

2026-06-24 19:08:22 -05:00

thread-ownership

…

tlon

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

together

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

tokenjuice

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

tts-local-cli

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

twitch

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

venice

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

vercel-ai-gateway

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

video-generation-core

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

vllm

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

voice-call

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

volcengine

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

voyage

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

vydra

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

web-readability

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

webhooks

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

whatsapp

test(qa-lab): harden whatsapp qa scenarios (#95622)

2026-07-01 00:01:09 -03:00

workboard

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

xai

fix(llm): preserve structured tool result replay

2026-06-30 23:44:02 -07:00

xiaomi

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

zai

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

zalo

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

zalouser

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

.npmignore

…

AGENTS.md

…

CLAUDE.md

…

music-generation-providers.live.test.ts

…

tsconfig.package-boundary.base.json

…

tsconfig.package-boundary.paths.json

…

video-generation-providers.live.test.ts

…