Sebastien Tardif fe8d99d421 fix(security): escape field names in transcript regex extraction ...

extractJsonStringFieldPrefix and extractJsonNullableStringFieldPrefix
interpolate the `field` parameter into `new RegExp(...)` without
escaping.  All current callers pass hardcoded strings ("id",
"parentId", "type", "role"), but the function signature accepts
any string.  A future caller passing a field containing regex
metacharacters (e.g. "foo.bar") would match unintended patterns.

Wrap the interpolation with escapeRegExp() from src/shared/regexp.ts
so metacharacters are treated literally.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

2026-05-25 20:57:01 +01:00

..

acp

build: enable modern TypeScript module syntax

2026-05-25 10:10:12 +01:00

agents

perf: speed up local TUI startup

2026-05-25 20:30:00 +01:00

auto-reply

refactor(logging): share diagnostic message lifecycle

2026-05-25 19:48:45 +01:00

bindings

…

bootstrap

…

channels

perf(plugins,gateway): thread metadata snapshot + discovery through hot paths + plugin owner fixes (#84649)

2026-05-24 13:44:03 -07:00

chat

…

cli

fix(gateway): ignore inherited launchd env for respawn

2026-05-25 19:03:37 +01:00

commands

perf: speed up local TUI startup

2026-05-25 20:30:00 +01:00

commitments

fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock (#86326)

2026-05-25 05:18:19 +00:00

compat

…

config

fix: tighten Discord voice wake matching (#86595)

2026-05-25 19:51:32 +01:00

context-engine

fix: guard transcript source reply rewrites

2026-05-24 03:37:43 +01:00

crestodian

refactor: remove sender owner tool gating

2026-05-21 15:14:48 +01:00

cron

refactor(logging): share diagnostic message lifecycle

2026-05-25 19:48:45 +01:00

daemon

fix(gateway): ignore inherited launchd env for respawn

2026-05-25 19:03:37 +01:00

docs

docs(config): quote bracket config paths (#83058)

2026-05-22 20:20:10 +01:00

flows

Doctor: expose shell completion health findings (#85566)

2026-05-25 08:39:41 -07:00

gateway

fix(security): escape field names in transcript regex extraction

2026-05-25 20:57:01 +01:00

hooks

fix: limit subagent bootstrap defaults

2026-05-22 12:55:42 +01:00

i18n

…

image-generation

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

infra

fix(update): allow package-manager hardlinks in swaps

2026-05-25 18:30:49 +01:00

interactive

fix(discord): preserve reusable presentation buttons

2026-05-21 22:02:16 +01:00

link-understanding

…

logging

fix(logging): keep string failure codes on EPIPE

2026-05-25 20:56:56 +01:00

markdown

fix(telegram): preserve fenced code languages (#85209)

2026-05-22 09:59:06 +01:00

mcp

refactor: remove sender owner tool gating

2026-05-21 15:14:48 +01:00

media

Replace Sharp image backend with Photon (#86437)

2026-05-25 15:04:44 +01:00

media-generation

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

media-understanding

fix(google): stop appending preview to flash lite

2026-05-25 19:12:36 +01:00

meeting-notes

fix: order meeting notes startup around channels

2026-05-24 00:30:39 +01:00

memory

…

memory-host-sdk

fix(memory): report qmd workspace cwd probe failures (#63167)

2026-05-22 22:31:59 +01:00

model-catalog

Adapt image compression quality by model (#85742)

2026-05-23 21:45:55 +01:00

music-generation

…

node-host

Recheck rebuilt system.run argv [AI] (#84090)

2026-05-20 12:30:26 +05:30

pairing

fix(gateway): gate talk secret bootstrap handoff (#85690)

2026-05-25 11:34:12 +03:00

plugin-sdk

refactor: share realtime voice activation helpers (#86615)

2026-05-25 20:25:17 +01:00

plugin-state

feat: add meeting notes plugin

2026-05-23 10:38:09 +01:00

plugins

fix(google): stop appending preview to flash lite

2026-05-25 19:12:36 +01:00

process

fix: gracefully escalate process supervisor cancellations (#85865)

2026-05-24 03:35:37 +01:00

provider-runtime

…

proxy-capture

test(release): harden plugin prerelease checks

2026-05-24 12:02:29 +01:00

realtime-transcription

…

routing

fix(agent): support explicit CLI session keys (#85121)

2026-05-22 03:08:25 +00:00

scripts

fix(scripts): harden Windows native opus install

2026-05-24 21:28:09 +02:00

secrets

fix(secrets): allow hash in exec SecretRef ids (#86072)

2026-05-24 14:56:17 +00:00

security

fix(security): audit Claude permission overrides under YOLO (#86557)

2026-05-25 18:18:51 +01:00

sessions

fix: preserve internal handoff status attribution [AI-assisted] (#85726)

2026-05-24 03:24:27 +01:00

shared

fix(gateway): gate talk secret bootstrap handoff (#85690)

2026-05-25 11:34:12 +03:00

status

fix(status): prefer active OAuth for runtime aliases

2026-05-25 19:19:51 +01:00

talk

refactor: share realtime voice activation helpers (#86615)

2026-05-25 20:25:17 +01:00

tasks

fix: quiet retained lost task noise (#86475)

2026-05-25 13:28:23 +01:00

terminal

Scope config preflight note suppression (#84439)

2026-05-22 15:51:34 -07:00

test-helpers

…

test-utils

fix(secrets): allow hash in exec SecretRef ids (#86072)

2026-05-24 14:56:17 +00:00

tools

…

trajectory

fix: suppress async media incomplete-turn errors (#85933)

2026-05-25 09:17:30 +01:00

tts

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

tui

perf: speed up local TUI startup

2026-05-25 20:30:00 +01:00

types

fix(memory): close local embedding providers on timeout (#84048)

2026-05-19 09:19:09 +00:00

utils

fix(utils): clamp fetch timeout timers (#85985)

2026-05-25 16:16:09 +01:00

video-generation

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

web

feat: add xai oauth web search and provider timeouts

2026-05-22 08:49:53 +01:00

web-fetch

…

web-search

fix: pass active agent to web search execution

2026-05-22 08:49:53 +01:00

wizard

fix(skills): show empty state notice in config wizard (#85032)

2026-05-23 15:49:49 +01:00

browser-lifecycle-cleanup.test.ts

…

browser-lifecycle-cleanup.ts

…

docker-build-cache.test.ts

…

docker-image-digests.test.ts

…

docker-setup.e2e.test.ts

fix(docker): restore config parent ownership

2026-05-25 01:00:10 -04:00

dockerfile.test.ts

fix(docker): restore config parent ownership

2026-05-25 01:00:10 -04:00

entry.compile-cache.test.ts

…

entry.compile-cache.ts

…

entry.respawn.test.ts

…

entry.respawn.ts

…

entry.test.ts

perf: speed up secrets and nodes help startup (#84818)

2026-05-21 16:51:57 +08:00

entry.ts

perf: speed up secrets and nodes help startup (#84818)

2026-05-21 16:51:57 +08:00

entry.version-fast-path.test.ts

…

entry.version-fast-path.ts

…

extensionAPI.ts

…

global-state.ts

…

globals.ts

…

index.test.ts

…

index.ts

…

install-sh-version.test.ts

…

library.test.ts

…

library.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

…

param-key.ts

…

plugin-activation-boundary.test.ts

fix(ollama): bypass managed proxy for loopback embeddings (#85707)

2026-05-23 21:17:55 +01:00

poll-params.test.ts

…

poll-params.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

ui-app-settings.agents-files-refresh.test.ts

…

utils.test.ts

…

utils.ts

…

version.test.ts

…

version.ts

…