mirror of
https://github.com/anomalyco/opencode.git
synced 2026-07-22 18:25:32 -04:00
Artur Do Lago
bc57ddff43
Pre-Alpha Fixes (10 items):
- Fix credential file permissions in calendar.ts (mode: 0o600)
- Add socket close handler in ipc-server.ts (memory leak prevention)
- Add event unsubscribe in daemon.stop() (memory leak prevention)
- Wrap Qdrant init with retry logic and graceful degradation
- Fix ALWAYS-ON-PERSONAS.md gateway architecture documentation
- Remove legacy spawn('claude') in tiara executor-sdk.ts
- Filter environment variables via safe-env.ts utility
- Add error boundary around IPC socket writes
- Update tiara README.md and INDEX.md version references
- Create zee gateway external-gateway.md documentation
Beta Security Fixes (6 items):
- CRITICAL: Fix command injection via persona parameter validation
- HIGH: Fix terminal escape sequence injection in setPaneTitle
- HIGH: Fix command escaping in sendCommand and canvas manager
- HIGH: Add secret redaction for copilot auth logging
- MEDIUM: Fix echo -e ANSI escape injection in status display
- MEDIUM: Strengthen prompt injection defense in fact-extractor
New Utilities:
- src/util/safe-env.ts: Environment variable filtering for child processes
- src/util/shell-escape.ts: Shell escaping, persona validation, secret redaction
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>