Skip to content

Agent Office v0.7.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 19:34
v0.7.6
0c3d9d2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Agent Office v0.7.6

Fixes from a security review of the Control Center, local files and processes. No XSS, path traversal, authentication bypass or cross-site request forgery was found; these close the weaker spots.

Security

  • App cards. An approval now covers the manifest, its folder and every code file in it, and is checked again when a button is pressed. A later run that edits the script, or the same manifest placed in another folder, needs a new approval, and the prompt lists the files the app can run. Apps approved before this release ask once more.
  • Control Center key. When the Control Center restarts, its key is passed in the environment instead of on the command line, where other accounts on the same computer could see it in the process list.
  • Reply buttons. On a post an app sent directly, a reply button's confirmation says which app made it, above the full instruction.
  • Requests and comparisons. The handoff check, which can start your MCP servers, only answers the Office page. The key in the address and in the cookie is compared in constant time.
  • CSV export. Cells starting with =, +, - or @ are prefixed so a spreadsheet does not run them as formulas.
  • Folder permissions. Office's connection, workspace and data folders are set to private (0700) every time it starts.
  • Instruction files. In API mode the Work planner no longer receives your CLAUDE.md and AGENTS.md; those go only to your own subscription app.

Upgrade

Finish active work, close MCP clients and the Control Center, and rerun the installer:

bash -o pipefail -c 'curl -fsSL https://raw.githubusercontent.com/deepdivekr/agent-office/v0.7.6/install.sh | bash'

Saved Works, schedules and settings carry over. The install verifier upgrades from v0.3.1 through v0.7.5.

Assets 5
Loading