Skip to content

v3.5.0

Choose a tag to compare

View all tags
@eniz1806 eniz1806 released this 06 Jun 09:29
v3.5.0
ca8124c

High-severity fixes from the 2026-06-06 audit (security + data-loss).

Fixed

  • Workspace boundary bypass on multi-tool turns — the parallel tool path skipped the boundary check, letting a model write/delete outside the workspace unprompted. Now checked on every tool, with realpath so symlinks can't escape.
  • Cost/budget reported $0 for current models — COST_TABLE lacked the current alias targets (claude-sonnet-4-6, claude-opus-4-6, …). Added; budget tracks real spend.
  • Sessions lost assistant messages — _save_session kept only string content, dropping Claude content-block turns and orphaning OpenAI tool messages (400 on restore). Now saves full history, trimming only a trailing unresolved tool call.
  • SSRF in web_fetch — validates URLs (http/https only), rejects internal/loopback/link-local/cloud-metadata hosts, and re-checks every redirect hop.
  • MCP stdio deadlock — server stderr → DEVNULL (undrained pipe deadlocked at ~64KB), 30s read timeout so a hung server can't block, killed servers reaped.
  • Batch-edit queue clobbered same-file edits — two queued edits to one file now compose instead of only the last surviving.

Tests

  • Regression tests for SSRF, batch-edit clobber, and the cost table (295 total).
Assets 2
Loading