bc57ddff43
security: comprehensive pre-alpha and beta security fixes
...
Pre-Alpha Fixes (10 items):
- Fix credential file permissions in calendar.ts (mode: 0o600)
- Add socket close handler in ipc-server.ts (memory leak prevention)
- Add event unsubscribe in daemon.stop() (memory leak prevention)
- Wrap Qdrant init with retry logic and graceful degradation
- Fix ALWAYS-ON-PERSONAS.md gateway architecture documentation
- Remove legacy spawn('claude') in tiara executor-sdk.ts
- Filter environment variables via safe-env.ts utility
- Add error boundary around IPC socket writes
- Update tiara README.md and INDEX.md version references
- Create zee gateway external-gateway.md documentation
Beta Security Fixes (6 items):
- CRITICAL: Fix command injection via persona parameter validation
- HIGH: Fix terminal escape sequence injection in setPaneTitle
- HIGH: Fix command escaping in sendCommand and canvas manager
- HIGH: Add secret redaction for copilot auth logging
- MEDIUM: Fix echo -e ANSI escape injection in status display
- MEDIUM: Strengthen prompt injection defense in fact-extractor
New Utilities:
- src/util/safe-env.ts: Environment variable filtering for child processes
- src/util/shell-escape.ts: Shell escaping, persona validation, secret redaction
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-20 12:57:47 +01:00
8c06aa3707
fix: technical debt cleanup (Sprints 6-10)
...
Sprint 6 - Gateway Stability:
- Add exponential backoff to Telegram poll loop
- Fix process timeout with SIGKILL
- Add fetch timeouts with AbortController to all HTTP calls
- Fix WhatsApp init race condition
- Add WhatsApp event listener cleanup tracking
Sprint 7 - Error Visibility:
- Fix silent error catches in share, canvas-tool, council, qdrant
- Replace console.log with structured logging across surface, browser, mcp
- Add JSON validation with zod for config and API responses
Sprint 8 - Type Safety:
- Define LogMeta type to replace Record<string, any>
- Add WhatsApp type guards (isChatMessage, isValidPersona)
- Create util/net.ts with shared helpers
Sprint 9 - Test Coverage:
- Create WhatsApp API mock for testing
- Add WhatsApp gateway tests (13 tests passing)
- Export mocks from test/mock/index
Sprint 10 - Debug Ergonomics:
- Fix fact extraction getSessionContent to retrieve actual messages
- Enhance debug memory search with semantic search
- Add debug errors command with follow mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-20 12:41:11 +01:00
97e3f275fb
feat(surface): add showThinking capability for platform-aware thinking visibility
...
- Add showThinking to SurfaceCapabilities type
- Set showThinking=true for CLI, Web, API (user toggleable)
- Set showThinking=false for WhatsApp, Telegram (locked to hide)
- Messaging platforms never show thinking/reasoning output
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-20 12:39:20 +01:00
cb30a15508
refactor: consolidate naming from opencode to agent-core
...
- Change comments and commands in new code to use "agent-core"
- Rename OAUTH_DUMMY_KEY to agent-core-oauth-dummy-key
- Add AGENT_CORE_TEST_HOME env var (with OPENCODE_TEST_HOME compat)
- Keep external service URLs (opencode.ai, antigravity.opencode.ai)
- Keep OPENCODE_* flags for upstream compatibility
Part of technical debt cleanup (Phase 7).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-20 12:39:20 +01:00
ac8aed235e
feat: Agent-core customizations for Personas ecosystem
...
- Add Personas skills (johny, stanley, zee)
- Add domain tools (stanley finance, zee personal)
- Add personas orchestration and knowledge graphs
- Add LLM Council for multi-model deliberation
- Add memory types for Qdrant vector storage
- Add tiara submodule for orchestration
- Add CLAUDE.md project documentation
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-20 11:51:37 +01:00
Artur Do Lago