ccbd646a29
fix(shared): validate tar hard-link targets during preflight
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-04 01:16:37 +09:00
2b43558349
fix(tar): surface traversal extraction failures as blocked entries
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:34:22 +09:00
a4f436c116
fix(tar): classify traversal tar listing errors as blocked entries
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 18:34:12 +09:00
b2b8f73d0d
Fix tar traversal error normalization
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:28:22 +09:00
d861d51959
fix(security): add archive extraction containment validation
...
Validate tar and zip entries before extraction to prevent path traversal:
- Reject absolute paths in archives
- Reject .. traversal paths
- Reject symlinks pointing outside extraction dir
- New archive-entry-validator module with comprehensive tests
Addresses: security audit finding for unsafe archive extraction.
2026-04-02 15:01:15 +09:00
4a82ff40fb
Consolidate duplicate patterns and simplify codebase ( #1317 )
...
* refactor(shared): unify binary downloader and session path storage
- Create binary-downloader.ts for common download/extract logic
- Create session-injected-paths.ts for unified path tracking
- Refactor comment-checker, ast-grep, grep downloaders to use shared util
- Consolidate directory injector types into shared module
* feat(shared): implement unified model resolution pipeline
- Create ModelResolutionPipeline for centralized model selection
- Refactor model-resolver to use pipeline
- Update delegate-task and config-handler to use unified logic
- Ensure consistent model resolution across all agent types
* refactor(agents): simplify agent utils and metadata management
- Extract helper functions for config merging and env context
- Register prompt metadata for all agents
- Simplify agent variant detection logic
* cleanup: inline utilities and remove unused exports
- Remove case-insensitive.ts (inline with native JS)
- Simplify opencode-version helpers
- Remove unused getModelLimit, createCompactionContextInjector exports
- Inline transcript entry creation in claude-code-hooks
- Update tests accordingly
---------
Co-authored-by: justsisyphus <justsisyphus@users.noreply.github.com >
2026-01-31 15:46:14 +09:00
YeonGyu-Kim