v0.37.17

Security: please upgrade

This release closes critical issues. Upgrade as soon as you can, and if anyone beyond you could hold an API key or a console login, change your secrets too (below).

• An API key could read any file as root: a marker file in a session's folder could point the file routes at any folder on the machine, and a caller's own PUT could set it, with no agent involved. That reached the instance's internal key, HR_SECRET_KEY, the stored provider keys and the databases. A follow-up turn on Codex through its app server could also write through a link an agent left in its folder. Only the value the runner writes itself now counts, and these reads and writes run as the session. Upgrading doesn't undo a read that already happened, and logs can't show one. So if anyone beyond you could hold a key or a login, or a key may have leaked: change HR_SECRET_KEY and your console password, replace your stored provider keys and any passed in the environment, reissue your API keys, then restart.
• File routes refuse dot paths: every route on a session's files (read, write, move, mkdir, delete, file ids, the listing, the archive and share links) now refuses a path with any segment that starts with a dot, and a link that lands on one. That covers the runner's state, git's folder, every CLI's folder and any credential file, including one an older version left behind, without depending on a list of names. Before this, the listing, the archive and share links also served a dot file inside a folder, such as sub/.env, so anyone holding a share link could read one. If you've shared a session that may hold such a file, treat what's in it as read. Tested through the real routes with about 12,000 requests, with 0.37.16 as a control that failed.
  What changes for you: an app can no longer read or write a file like .env or .gitignore in a session through the API, and such a file isn't listed or downloadable. The agent itself still works with them as before.
  What this doesn't do: it limits what a caller can reach by path. An agent can still copy a file it can read into an ordinary file, so don't rely on this to keep a secret out of a session's reach.
• Root no longer runs what the product user can change: the gateway and the console run as agent, but that user owned files root runs, so a bug in either one could become root at the next restart. /app is now root's, root has its own HOME, and on the data volume root keeps its folders where agent can't move or replace them. The release gate now checks this on a running container. Reported by @eric-epsilla.
• Plugins across organizations: two organizations connecting the same plugin in a workspace called default shared one record, so the second overwrote the first. Each now has its own. Existing records keep working. Reported by @trifonnt.
• Read-only database queries: a MySQL or MariaDB server that refuses a read-only session now gets no query. Before, the query ran anyway. If you connect a MySQL-compatible database that doesn't support this, its queries will now be refused with a message saying why.
• Signed links: on an instance with no internal key set, some signatures used a constant from the source code. They now use a random key. The container always sets one, so this only affects unusual setups.
• Error messages: an unexpected error in a turn now tells the caller only that the turn stopped, because its text could name internal addresses. The details go to the log.
• Workflows: the conformance workflow now runs third-party code with no write access, and with only secrets named UHP_*.

The console is always light

The console no longer follows your system's dark appearance. Its tab icon is now the rounded mark on white.

Starting up

Every start now checks that the installed agent tools are root's and written by nobody else, and corrects what isn't. Upgrading our test instance from 0.37.16 took 38 seconds in all. A restart with nothing to correct took 22 seconds in all, on a volume with 345,000 tool files.

Tested against real AWS

0.37.16's notes said Bedrock had been tested only as far as AWS accepting the relay's signatures. It has now been run with a real key limited to one model: real Claude Code and Hermes turns through the relay, with a key pair and with a short-term API key, each with a follow-up turn. The agent's session held no AWS credential, the relay's route stopped working when the turn ended, and AWS refused any other model.

If your account hasn't used a Bedrock model before, the key's first call can succeed and later ones fail with a 403 naming aws-marketplace actions. That's AWS subscribing your account to the model. The key needs aws-marketplace:Subscribe and aws-marketplace:ViewSubscriptions until that finishes, and not after.

Dependencies

• Removed 38 console packages that nothing reaches, which clears their alerts too.
• Updated postcss 8.5.32, mcp 1.30.0, Markdown 3.8.1.

Full Changelog: v0.37.16...v0.37.17