Skip to content

v2.0.1

Choose a tag to compare

View all tags
@sprngr sprngr released this 03 Aug 13:07
· 30 commits to main since this release
v2.0.1
69036e2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Patch release: duck-tape opencode plugin hook hardening.

Fixed

  • Path traversal in opencode.plugin.js — strict sessionId charset validation (alphanumeric + hyphen, max 128 chars) before filename construction. Prevents ../-style traversal attacks on state file paths.
  • Windows filename safety — stamp format changed from HH:MM to HHMM (colon stripped), matching skill's <YYYY-MM-DD-HHMM> session ID format. Colons invalid in Windows filenames.
  • Rotation off-by-one — cap now enforces 10 total state files (was allowing 11). Eviction precedence: auto, then recovered, then manual.
  • Rotation comment aligned with actual behavior.
  • Tests added — sessionId traversal guard, extraction edge cases (<-prefixed user text skip, multiple DECISION_PATTERN variants, lastText assignment, null-info guards).

Changed

  • [Unreleased] entries folded into v2.0.0 (changelog hygiene).

Full Changelog: v2.0.0...v2.0.1

Assets 2
Loading