v1.215.2

1.215.2 (2026-10-11)

Bug Fixes

• atrest: bind cost, CCR and pending memory stores to their path (f535b2c)
• auth: fail closed when the credential key cannot be read (45a9a5f)
• coder: classify the exact exec command for the read-only auto-allow (f750160)
• coder: close command and path injection in the coder tools (2ebbc06)
• gateway: require a sender allowlist on every chat adapter (0621549)
• gateway: sign webhook traffic and guard attachment URLs (24cf554)
• mcp: bind MCP OAuth tokens to the configured server URL (951fe24)
• mcp: validate the OAuth authorization server and confine MCP redirects (352c54c)
• operator: enforce trust boundaries for the AIOps pipeline (51466b2)
• plugins: execute the verified bytes and never let a plugin shadow a built-in (435528d)
• plugins: guard browser navigation and harden web tool egress (f380090)
• provision: fill in the pinned digests of the engine and model archives (2e8d83e)
• provision: pin embedded engine and model digests and confine tar extraction (b81b668)
• redact: cover current key formats in the redactor and HTTP logs (3623409)
• registry: match the skills.sh snapshot digest scheme (48a3b2a)
• registry: validate skills.sh snapshot paths in OS form and verify their hash (6b8fbfa)
• security: deny unattended policy asks and operator-gate exec elevation (71dfbcd)
• security: load project configuration only from trusted workspaces (8b88a9f)
• server: isolate saved sessions per principal and refuse client endpoints (aba4c6d)
• server: report a refused client provider_config as InvalidArgument (9cb5883)
• server: restrict agent providers to admin callers (ff02bbd)
• state: keep the state directory and its stores owner-only (e425b00)
• taskgraph: guard the dashboard with a token and an exact Host (55eca95)
• update: embed the release signing public key (789a667)
• update: verify a signed checksums.txt and accept only strict semver tags (b60eb2a)
• webui: serve the page only with the token and stop embedding it (8e5c45c)