Skip to content

v0.1.95 — SSRF, MCP & env-leak hardening + local-model robustness

Choose a tag to compare

View all tags
@Mechres Mechres released this 16 Aug 14:47
· 29 commits to master since this release
v0.1.95
c4454c1

v0.1.95

Security and local-model robustness hardening, each audited via codex, verified against the current source, and covered by a permanent regression test.

Security

  • web_fetch SSRF hardening — scheme-only guard replaced with full host-range rejection (loopback / RFC1918 private / link-local incl. 169.254.169.254 / unspecified), DNS-rebind-safe resolution, and per-redirect re-validation. New web.allow_local_fetch config (default off) opts in only the local dev servers you explicitly trust.
  • MCP tools default to RiskWrite — an MCP delete/deploy/send tool can no longer bypass the approval gate. Only a server's mcp.read_only_tools allowlist downgrades named tools to read-only.
  • shell_bg env scrub — background/bwrap jobs no longer inherit the agent's API keys / tokens; they use the same scrubbed env as shell_exec.

Robustness (weak local model)

  • Streamed tool_call index bound: out-of-range indices rejected as a protocol error (no gigantiac slice allocation).
  • subagent fan-out cap: blank tasks dropped, batch capped at 8 with a bounded worker pool, per-task capped at 4 KiB, over-large batches rejected with guidance.
  • checkpoint List/Prune exclude hidden state (restore-staging regression fixed).
Assets 2
Loading