Merge H1-H9 security fixes from worktree-h5-deny-list

zhenyi · 3 months ago

chore(workspace): add agent/llm to workspace members and regenerate lockfile

zhenyi · 3 months ago

refactor(export): make fmt_ts public for cross-crate timestamp formatting reuse

zhenyi · 3 months ago

feat(agent): add agent/llm crate (LLM abstraction layer with providers, embeddings, fallback, skills, types)

zhenyi · 3 months ago

fix(git): enforce branch/tag protection at receive-pack time + schema columns (H6)

zhenyi · 3 months ago

fix(ssh): per-channel buffer cap + enforce max_sessions (H7)

zhenyi · 3 months ago

fix(chat): scope idempotency keys by sender + ownership-check lookup (H8)

zhenyi · 3 months ago

fix(repo): enforce per-repo Read authz on all read-side usecases (H2)

zhenyi · 3 months ago

fix(auth): issue channel-membership check + profile PII redaction + end_room pre-authz (H3/H4/H9)

zhenyi · 3 months ago

fix(auth): wire JWT deny-list across repo/issues/chat + restrict SSH + suspend-as-inactive (H5)

zhenyi · 3 months ago

chore(workspace): add lib/mcp to workspace, regenerate lockfile, add mcp defaults to default.yaml

zhenyi · 3 months ago

feat(webapi): mount MCP routes and initialize MCP server in apphost

zhenyi · 3 months ago

feat(config): add mcp section to central lib/config crate and refresh app/lib wiring

zhenyi · 3 months ago

feat(mcp): add lib/mcp crate (Model Context Protocol server with auth, access_key, ip_filter, tools, router, service)

zhenyi · 3 months ago

refactor(lib): trim CWE-fix follow-up comments and unused helpers across auth, webhook, gitauth, gitssh

zhenyi · 3 months ago

refactor(repo): drop unused permission helpers and lifecycle authz scaffolding

zhenyi · 3 months ago

refactor(obs): drop unused features and trim verbose comments in lib/obs and config obs section

zhenyi · 3 months ago

docs: add cybersecurity notes

zhenyi · 3 months ago

Merge branch 'worktree-fix-c3-ssh-authz'

zhenyi · 3 months ago

fix(gitssh): drop unconditional RepoRead scope for SSH actors (CWE-863)

zhenyi · 3 months ago

fix(repo): populate ActorContext.credential_max after C2 merge

zhenyi · 3 months ago

Merge branch 'worktree-fix-c1-repo-authz'

zhenyi · 3 months ago

fix(repo): 接入生命周期与全部写接口的权限校验 (CWE-306)

zhenyi · 3 months ago

fix(gitauth): bind git credentials to the account; auth via access keys (PAT)

zhenyi · 3 months ago

chore(workspace): wire obs/webhook deps, add opentelemetry stack, refresh default.yaml and lockfile

zhenyi · 3 months ago

refactor(webhook): refresh dispatcher to integrate with new obs and config

zhenyi · 3 months ago

refactor(app): wire all 5 binary apps to lib/obs for tracing init

zhenyi · 3 months ago

feat(config): add obs and webhook sections to central lib/config crate, refresh app and lib

zhenyi · 3 months ago

feat(obs): add lib/obs crate with OpenTelemetry tracing, metrics, and logs support

zhenyi · 3 months ago

fix(dvcs): refactor askpass to pass token via env, gate --stateless-rpc for archive uploads, update handlers

zhenyi · 3 months ago