oh-my-opencode

Author SHA1 Message Date

Author	SHA1	Message	Date
MoerAI	111b796820	fix(resolve-file-uri): explain project boundary restriction in rejection warning (fixes #3554 ) Root cause: when a file:// prompt URI resolves outside the project root, resolvePromptAppend returns the warning '[WARNING: Path rejected: $URI]' with no indication of WHY the path was rejected. Issue #3554 reports that this is confusing because the docs explicitly advertise support for absolute, home-relative, and cross-project file:// paths, yet the code intentionally restricts file:// prompt resolution to the project boundary (commit `98659783`, security hardening). Fix: extend the warning message so it now includes the resolved project root and an explicit hint that file:// prompts must reside within the project boundary. The security restriction itself is preserved unchanged. Verification: added a regression test that asserts the rejection warning matches /outside project root/i. Test fails before the fix, passes after. Full resolve-file-uri.test.ts suite: 11 pass / 0 fail. typecheck clean.	2026-04-27 20:33:06 +09:00
YeonGyu-Kim	98659783c0	fix(security): confine file resolution to project roots Block traversal, out-of-root absolute path, and symlink escapes for @file references, file:// URIs, and config skill file loading while logging rejected attempts. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-04-02 14:55:35 +09:00
YeonGyu-Kim	60b4d20fd8	feat(agents): add file:// URI support in prompt_append configuration Port devxoul's PR #821 feature to current codebase structure. Supports absolute, relative, ~/home paths with percent-encoding. Gracefully handles malformed URIs and missing files with warnings. Co-authored-by: devxoul <devxoul@gmail.com>	2026-02-13 11:25:40 +09:00

MoerAI

111b796820

fix(resolve-file-uri): explain project boundary restriction in rejection warning (fixes #3554 )

Root cause: when a file:// prompt URI resolves outside the project root, resolvePromptAppend returns the warning '[WARNING: Path rejected: $URI]' with no indication of WHY the path was rejected. Issue #3554 reports that this is confusing because the docs explicitly advertise support for absolute, home-relative, and cross-project file:// paths, yet the code intentionally restricts file:// prompt resolution to the project boundary (commit 98659783, security hardening).

Fix: extend the warning message so it now includes the resolved project root and an explicit hint that file:// prompts must reside within the project boundary. The security restriction itself is preserved unchanged.

Verification: added a regression test that asserts the rejection warning matches /outside project root/i. Test fails before the fix, passes after. Full resolve-file-uri.test.ts suite: 11 pass / 0 fail. typecheck clean.

2026-04-27 20:33:06 +09:00

YeonGyu-Kim

98659783c0

fix(security): confine file resolution to project roots

Block traversal, out-of-root absolute path, and symlink escapes for @file references, file:// URIs, and config skill file loading while logging rejected attempts.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

2026-04-02 14:55:35 +09:00

YeonGyu-Kim

60b4d20fd8

feat(agents): add file:// URI support in prompt_append configuration

Port devxoul's PR #821 feature to current codebase structure.
Supports absolute, relative, ~/home paths with percent-encoding.
Gracefully handles malformed URIs and missing files with warnings.

Co-authored-by: devxoul <devxoul@gmail.com>

2026-02-13 11:25:40 +09:00

3 Commits