opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
picoclaw/pkg
History
sky5454 ff42ceba6a fix(exec): security guard bypass fixes for PowerShell/CMD encoding and path traversal 
- Split deny patterns into defaultDenyPatterns (all platforms) and
  windowsDenyPatterns (Windows-only) to avoid false positives
- Add PowerShell encoding bypass detection:
  - [Text.Encoding] and [System.Text.Encoding] variants
  - -EncodedCommand short forms (-e, -ec, -enc)
  - .GetString([byte[]] with whitespace variations
  - FromBase64String decoding
  - PowerShell variable = [byte[](...) patterns
  - Literal \uXXXX Unicode escape sequences
- Expand PowerShell ($env:VAR) and CMD (%VAR%) environment variables
  before workspace path checking to prevent $env:USERPROFILE bypass
- Expand ~ to home directory on Windows
- Add .../.../ path traversal variant detection (blocks .../.../, ..../..../)
- Add symlink/junction resolution before workspace check
- Add Windows path normalization for ADS (file.txt:stream) and
  extended-length paths (\?\)
- Add comprehensive tests for all new patterns

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-15 03:21:00 +08:00
..
agent Merge pull request #2158 from afjcjsbx/feat/agent-discovery-prompt 2026-05-09 13:56:19 +02:00
audio feat(provider,web,asr): enhance model management with explicit provider metadata (#2701) 2026-05-06 16:06:49 +08:00
auth fix(auth): canonicalize Google Antigravity provider and enhance credential management (#2599) 2026-04-21 16:28:29 +08:00
bus fix(events): keep runtime observers non-blocking 2026-04-27 13:09:03 +08:00
channels Merge pull request #2705 from hehaijunandhenry/main 2026-05-08 18:50:08 +08:00
commands feat(agent): stop command 2026-05-04 08:41:29 +02:00
config Merge pull request #2158 from afjcjsbx/feat/agent-discovery-prompt 2026-05-09 13:56:19 +02:00
constants refactor: replace bool map with set-style map for internal channels (#472) 2026-02-19 11:48:17 +01:00
credential refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00
cron refactor(cron): remove deliver and type params, unify agent execution path (#2147) 2026-03-29 22:52:34 +08:00
devices refactor(runtime): drop non-session legacy context compatibility 2026-04-01 20:56:48 +08:00
events fix(events): keep runtime observers non-blocking 2026-04-27 13:09:03 +08:00
fileutil Merge pull request #1829 from perhapzz/test/add-fileutil-health-tests 2026-03-26 10:42:13 +01:00
gateway Merge remote-tracking branch 'remotes/upstream/main' 2026-05-07 14:39:29 +08:00
health fix(host): modernize default host selection order 2026-04-14 14:03:23 +08:00
heartbeat refactor(runtime): drop non-session legacy context compatibility 2026-04-01 20:56:48 +08:00
identity fix(identity): support negative integers in isNumeric for Telegram group IDs 2026-03-21 17:09:02 +07:00
isolation fix: treat PID=1 as stale in PID file singleton check, fix govet shadow, add .gitattributes (#2642) 2026-04-24 15:26:34 +08:00
logger unify all panic event to panic log file (#2250) 2026-04-01 23:26:49 +08:00
mcp fix(events): keep runtime observers non-blocking 2026-04-27 13:09:03 +08:00
media Fix 1886 media cleanup policy (#1887) 2026-03-23 12:13:59 +08:00
memory fix(message): ignore transient assistant thoughts in message count and history truncation 2026-04-25 12:26:28 +08:00
migrate refactor(config): make config.Channel to multiple instance support 2026-04-13 22:21:21 +08:00
netbind fix(web): address latest Copilot review points 2026-04-14 23:39:59 +08:00
pid fix: treat PID=1 as stale in PID file singleton check, fix govet shadow, add .gitattributes (#2642) 2026-04-24 15:26:34 +08:00
providers feat(provider,web,asr): enhance model management with explicit provider metadata (#2701) 2026-05-06 16:06:49 +08:00
routing feat(routing): add ordered dispatch rules 2026-04-01 22:13:04 +08:00
seahorse fix(seahorse): enforce target token thresholds for leaf summaries 2026-05-04 14:10:42 +02:00
session fix(reasoning): persist canonical history for DeepSeek and web chat 2026-04-24 21:45:41 +08:00
skills refactor skills registries and add GitHub-backed skill discovery (#2442) 2026-04-14 15:14:16 +08:00
state refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
tokenizer feat(seahorse): implement short-term memory engine (LCM) (#2285) 2026-04-05 09:05:16 +08:00
tools fix(exec): security guard bypass fixes for PowerShell/CMD encoding and path traversal 2026-05-15 03:21:00 +08:00
updater fix(updater): retry release fetches (#2511) 2026-04-14 10:44:21 +08:00
utils Merge pull request #2670 from david1gp/fix/tool-feedback-pretty-print 2026-05-04 21:47:32 +02:00
env.go Merge branch 'main' into version 2026-03-19 18:04:58 +08:00