Skip to content

v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Aug 21:44
· 186 commits to master since this release
v2.0.0
1e50652 
AetherShell v2.0.0

Security release. Three breaking changes, all consequences of closing
findings from the 2026-08-04 audit pass:

- The Agent API requires a bearer token on every route but /health.
  POST /api/v1/eval had no authentication while CORS defaulted to
  allow_origin(Any), making it drive-by RCE from any visited web page.
- AgentApiConfig gained a public auth_token field.
- Agent mode gates the exec capability rather than the name 'sh':
  timeout, xargs, proc.spawn, nohup, strace, ltrace, perf.stat,
  perf.record and lxc.exec now require approval.

Human/REPL mode is unchanged. See docs/security/SECURITY_AUDIT_2026-07-30.md
Assets 11
Loading