Skip to content
This repository was archived by the owner on May 23, 2026. It is now read-only.

v0.7.4 — Concurrency & Info Exposure Fixes

Choose a tag to compare

View all tags
@magifd2 magifd2 released this 19 Apr 02:02
· 23 commits to main since this release
v0.7.4
03d22bf

Security (Medium)

Addresses remaining Medium-severity findings from code review:

  • session.Records data race: sessionMu guards append (agent loop goroutine) and range (Wails bindings like GetLLMStatus)
  • guardians map rebuild race: guardiansMu (RWMutex) protects all read paths (GetTools, buildToolDefs, handleToolCall MCP dispatch) during restartGuardians rebuild
  • HTTP error body exposure: Truncated to 512 bytes via io.LimitReader — prevents internal server details from leaking into LLM context or logs
  • osascript path injection: %q quoting for temp file path — prevents injection via poisoned TMPDIR

All tests pass with -race flag.

Full changelog: https://github.com/nlink-jp/shell-agent/blob/main/CHANGELOG.md

Assets 3
Loading