Skip to content

v0.24.1 — Second-pass audit hardening

Choose a tag to compare

View all tags
@VickyXAI VickyXAI released this 28 Jun 08:19
v0.24.1
c1f416c

A second audit pass (every finding adversarially re-verified) over the 0.24.0 code — including the changes 0.24.0 itself introduced — surfaced a batch of hardening fixes. None critical; the two notable ones are residuals of the 0.24.0 budget work.

Budget integrity

  • High-res video can no longer settle past the cap — the pre-pay gate reserved only the 720p per-second estimate; the real token-priced 402 amount is now re-reserved against the budget before paying (and held through the polling window for concurrent jobs).
  • Concurrent blockrun_chat no longer over-counts / cross-attributes spend — withSettledCost read a shared cumulative counter; each chat call now uses a fresh per-call client so the spend delta isolates that call (was fail-safe — never overspent, but inflated the ledger and misattributed per-agent spend).

Security / robustness

  • SSRF guard on blockrun_image reference-URL fetch — rejects loopback/private/link-local/CGNAT/IPv6-ULA + metadata/internal hosts and re-validates every redirect hop.
  • Bounded fetches for blockrun_dex and the Base balance RPC (no unbounded hang); model cache treats an empty catalogue as not-loaded (was pinned for the full TTL); getChain detects Solana via a usable key, so an empty session file can't pin every tool to an unbuildable client.
  • Video success message reports the billed duration (not a hardcoded 8s); OpenAI inventory comment lists gpt-5.5.

68 unit tests. Full details in CHANGELOG.md.

Assets 2
Loading