Skip to content

Tera Pilot v2.3.5

Choose a tag to compare

View all tags
@ilyaosovskoi ilyaosovskoi released this 21 Aug 14:08
· 25 commits to main since this release
v2.3.5
087fcc3

v2.3.5 — OS sandbox, SSRF hardening, fail-closed autonomy, LM Studio native tool calls

Security hardening

  • OS-level sandbox (P1.10) for execute_command / run_code / auto-detected test-lint commands: macOS sandbox-exec (Seatbelt) and Linux bubblewrap backends — network denied, writes restricted to the workspace + OS temp, sensitive paths (~/.ssh, ~/.aws, ~/.gnupg, cloud SDK configs) unreadable. Configurable via agent_os_sandbox (auto default / on fail-closed / off).
  • web_fetch SSRF defense (P0.2): loopback, private, link-local and cloud-metadata targets rejected (IPv4 + IPv6 incl. ::ffff:-mapped); the hostname is DNS-resolved and every resolved address checked (DNS-rebinding defense); every redirect hop is re-validated.
  • Local API token (P0.3): no longer returned by the public GET /api/status — delivered only through the same-origin HTML page the server itself serves (no CORS header on the token-bearing page).
  • Headless fail-closed (P0.4): daemon/ACP side-effecting actions are blocked when no confirmation UI is wired; explicit opt-in via --no-confirm / TERA_PILOT_ACP_NO_CONFIRM=1. Guardian now fails closed on provider errors / unparseable verdicts instead of silently approving.

LM Studio / local-model integration

  • LM Studio's engine rejects generated native tool calls whose content contains quotes (400 Invalid diff). The runtime now stops advertising the tools schema to LM Studio and parses the model's native <|tool_call_start|>[name(arg='...')] text format instead (agent_runtime/parser.py) — enabling fully-local agent runs.

Evaluation harness

  • New direct driver — the same task prompt sent straight to an OpenAI-compatible endpoint with no agent loop, for head-to-head with/without Tera Pilot comparisons; --repeat for N fresh-workspace runs.
  • security category with security_expectation; per-run evidence (the actual diff, provider/tool error counters, self_verify); 10 adversarial sec-* tasks (prompt injection, git-hook escapes, npm backdoors, SSRF, exfiltration, MCP write-outside).
  • Local-model smoke batch: 4 of 5 coding tasks solved via Tera Pilot (eval/REPORT_2026-08-21.md).

Reliability & polish

  • Timezone-aware UTC datetimes (datetime.utcnow removed) in swarm manager and plugins; request-queue stream serialization fixes; quota breakdown + token-optimization tips API; GUI/TUI polish.

Full test suite: 627 tests passing (20 skipped).

Assets 2
Loading