v0.9.0
What's changed
Security & robustness
- Path traversal guards in file and artifact download/delete; session paths validated under workspace
session_idvalidation in API (pattern) and JSON store- Content-Disposition filename sanitization; docs for WebSocket API key risk, executor isolation, health endpoint
Configuration
- Single config source: server uses
dsagent.config;DSAGENT_REQUIRE_API_KEY,DSAGENT_MAX_UPLOAD_MB - API version from package
__version__; Dockerfile label 0.9.0
Features
- Upload size limit per file (
DSAGENT_MAX_UPLOAD_MB) - Session path validation under workspace (code scanning)
Documentation
- README, CLI (serve, skills), configuration, HTTP API (
/api), Docker docs updated
Full changelog
See PR #46 for the full list of changes.