fix: module-by-module bug sweep - security, correctness, and reliability fixes - #168

Merged

jkyberneees merged 15 commits into

mainfrom

fix/module-bug-sweep

Aug 31, 2026

Commits on Aug 31, 2026

fix(danger): classify trap payloads and bun -e as code exec; structural fork-bomb blocking
jkyberneees
committed
6df2e48
fix(budget): enforce input and cost caps against cache tokens
jkyberneees
committed
738ebb5
fix(skills): pin imported skills NeedsReview; refuse private hosts on import fetch
jkyberneees
committed
7373a3f
fix(loop): never drop the original task when a leading injection shifted the trim boundary
jkyberneees
committed
bad7af8
fix(shell): surface exit status on failing commands that produced output
jkyberneees
committed
954fe47
fix(artifacts): close TOCTOU on artifact read - verify identity of what is actually served
jkyberneees
committed
f4ff4d1
fix(danger): env equals-form flags are env manipulation; TrustedClasses write under mutex; case-folded home guard; honest friction count
jkyberneees
committed
24e2805
fix(tools): honor newest-first glob contract, UTF-8-aware binary detection, tree disclosure, honest batch_patch wording
jkyberneees
committed
42ca9d0
fix(loop): real tool outcome for failure recovery; digest survives trims after leading injection
jkyberneees
committed
14dd643
fix(serve): tracked run goroutines at shutdown, WS slot leak, pong config race, XFF keying
jkyberneees
committed
cff3cf8
fix(skills): skill_load refuses NeedsReview bodies; harden skill-name validation
jkyberneees
committed
992fc24
fix(budget): exhausted parent budget is a hard cap, not unlimited, in share-mode handoff
jkyberneees
committed
08201e7
fix(artifacts,mcpclient): enforce max_result_chars on rendered output, block metadata forgery, bound hash reads
jkyberneees
committed
3b000a9
fix(config): secrets.env parser honors dotenv conveniences and stops silent truncation
jkyberneees
committed
9c969a6
fix(danger,tools,config): unread-exec gate expansions, rune-safe truncation, open-first fingerprint, env warnings
jkyberneees
committed
00c2ecb