root c33377150e fix(agents): include SOUL.md, IDENTITY.md, USER.md in subagent/cron bootstrap allowlist ...

Subagent and isolated cron sessions only loaded AGENTS.md and TOOLS.md,
causing subagents to lose their role personality, identity, and user
preferences. Expand MINIMAL_BOOTSTRAP_ALLOWLIST to include the three
missing identity files.

Closes #24852

2026-02-24 11:02:28 +08:00

..

acp

fix(acp): harden permission tool-name validation

2026-02-24 01:11:34 +00:00

agents

fix(agents): include SOUL.md, IDENTITY.md, USER.md in subagent/cron bootstrap allowlist

2026-02-24 11:02:28 +08:00

auto-reply

fix(commands): restrict commands.allowFrom to sender principals

2026-02-24 02:01:01 +00:00

browser

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

canvas-host

test: tighten canvas host websocket watchdog timeouts

2026-02-21 23:02:44 +00:00

channels

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

cli

test(core): trim redundant setup and tighten waits

2026-02-24 00:31:58 +00:00

commands

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00

compat

…

config

feat(gateway)!: require explicit non-loopback control-ui origins

2026-02-24 01:57:11 +00:00

cron

Session/Cron maintenance hardening and cleanup UX (#24753)

2026-02-23 22:39:48 +00:00

daemon

doctor: clean up legacy Linux gateway services (#21188)

2026-02-22 19:18:59 -05:00

discord

refactor(security): unify dangerous name matching handling

2026-02-24 01:33:08 +00:00

docs

…

gateway

feat(gateway)!: require explicit non-loopback control-ui origins

2026-02-24 01:57:11 +00:00

hooks

fix(agents): include SOUL.md, IDENTITY.md, USER.md in subagent/cron bootstrap allowlist

2026-02-24 11:02:28 +08:00

imessage

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

infra

fix(security): harden exec wrapper allowlist execution parity

2026-02-24 01:52:17 +00:00

line

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

link-understanding

chore: remove verified dead code paths

2026-02-22 09:21:09 +01:00

logging

fix(security): harden regex compilation for filters and redaction

2026-02-23 23:54:50 +00:00

markdown

test: dedupe channel and transport adapters

2026-02-21 21:44:01 +00:00

media

test(core): reduce mock reset overhead in targeted suites

2026-02-22 08:40:29 +00:00

media-understanding

refactor: de-duplicate channel runtime and payload helpers

2026-02-23 21:25:28 +00:00

memory

refactor: deduplicate shared helpers and test setup

2026-02-23 20:40:44 +00:00

node-host

fix(security): harden exec wrapper allowlist execution parity

2026-02-24 01:52:17 +00:00

pairing

refactor: de-duplicate channel runtime and payload helpers

2026-02-23 21:25:28 +00:00

plugin-sdk

refactor(security): unify dangerous name matching handling

2026-02-24 01:33:08 +00:00

plugins

refactor: deduplicate shared helpers and test setup

2026-02-23 20:40:44 +00:00

process

test: speed up supervisor test timing

2026-02-23 20:15:56 +00:00

providers

refactor: harden kilocode auth ordering and dedupe provider wiring

2026-02-23 23:37:13 +00:00

routing

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

scripts

test(scripts): dedupe a2ui temp fixture and cover skip-missing env path

2026-02-21 21:40:39 +00:00

security

feat(gateway)!: require explicit non-loopback control-ui origins

2026-02-24 01:57:11 +00:00

sessions

Agents/Replies: scope done fallback to direct sessions

2026-02-22 13:30:30 -08:00

shared

test(config): consolidate env/include scenario coverage

2026-02-23 22:16:30 +00:00

signal

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

slack

refactor(security): unify dangerous name matching handling

2026-02-24 01:33:08 +00:00

telegram

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

terminal

test(core): use lightweight clears in runtime and telegram setup

2026-02-22 08:09:14 +00:00

test-helpers

refactor: dedupe media and request-body test scaffolding

2026-02-22 18:37:25 +00:00

test-utils

test: dedupe fixtures and test harness setup

2026-02-23 05:45:54 +00:00

tts

test: streamline auto-reply and tts suites

2026-02-21 21:44:01 +00:00

tui

test: dedupe fixtures and test harness setup

2026-02-23 05:45:54 +00:00

types

chore(deadcode): add deadcode scanning and remove unused lockfile deps (#22468)

2026-02-21 01:29:20 -05:00

utils

refactor!: remove google-antigravity provider support

2026-02-23 05:20:14 +01:00

web

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

whatsapp

WhatsApp: enforce allowFrom for explicit outbound sends (#20921)

2026-02-22 18:13:23 -05:00

wizard

test: dedupe gateway browser discord and channel coverage

2026-02-22 17:11:54 +00:00

channel-web.ts

…

docker-image-digests.test.ts

fix(docker): pin base images to SHA256 digests (#7734)

2026-02-19 12:42:07 -08:00

docker-setup.test.ts

Docker: precreate identity dir in docker setup

2026-02-22 16:33:53 -08:00

dockerfile.test.ts

test(docker): cover browser install build arg

2026-02-16 22:35:27 -05:00

entry.ts

refactor(gateway): simplify restart flow and expand lock tests

2026-02-22 10:44:47 +01:00

extensionAPI.ts

…

globals.ts

…

index.ts

…

logger.test.ts

test: merge logger subsystem prefix drop cases

2026-02-19 08:49:52 +00:00

logger.ts

…

logging.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

polls.test.ts

test: table-drive poll duration clamp cases

2026-02-18 23:27:50 +00:00

polls.ts

…

runtime.ts

…

utils.test.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

utils.ts

fix(utils): guard resolveUserPath for missing workspace input

2026-02-22 13:19:25 +01:00

version.test.ts

test(core): increase coverage for sessions, auth choice, and model listing

2026-02-22 14:08:51 +00:00

version.ts

refactor: centralize presence routing and version precedence coverage (#19609)

2026-02-18 00:02:51 -05:00