Skip to content

v1.3.178

Choose a tag to compare

View all tags
@topcheer topcheer released this 24 Jul 13:43
· 2243 commits to main since this release
v1.3.178
64ed2a7

v1.3.178

Release date: 2026-07-24

Summary

Full codebase review round: security hardening, architectural cleanup, test coverage expansion, and diagnostic logging improvements. 18 commits across 28 files (+3,703 / -1,712 lines).

New Features

  • code_execution tool (PTC): Programmatic tool calling via embedded JavaScript runtime — allows the agent to batch-call read-only tools in a sandboxed VM, reducing round-trips for multi-step analysis
  • AppleScript dangerous command detection: 13 new patterns in dangerous.go covering do shell script with dangerous payloads, Keychain access (security find/delete-generic-password), and reverse shell via nc -e
  • Generic IM panel framework: im_panel_generic.go (782 lines) with per-adapter config registry — foundation for eliminating ~10K lines of duplicated panel code
  • i18n translation completeness check: Automated test that detects missing translation keys across all languages

Improvements

  • daemon.go split (2268→1586 lines): Monolithic file split into 5 focused files by responsibility (tunnel, platform, session, runtime, lifecycle)
  • Permission mode switch logging: debug.Log for both Shift+Tab cycling and /mode command — enables tracing security-relevant mode changes
  • Tool execution error logging: debug.Log when safeExecute returns Go error — was previously only forwarded to LLM without diagnostic trace
  • TUI/desktop/mobile label for code_execution: Platform-specific display in tool descriptions

Bug Fixes

  • Chat ID counter race condition: chatIDCounter and assistantCounter used non-atomic increment while sysIDCounter in the same file used atomic.AddInt64 — now all three use atomic operations
  • PTY reader goroutine safety: Bare go func() without safego.Recover replaced with safego.Go
  • TestShutdownAll_WithSubAgents race: Test checked sub-agent status synchronously after async CancelAll — added polling loop matching existing pattern
  • Hooks HTTP timeout validation: Validate timeout > 0 to prevent instant deadline
  • PTC tool bridge panic recovery: Added safego.Recover to JavaScript↔Go bridge functions

Test Coverage

  • permission package: +1,286 lines of tests (dangerous command patterns, path traversal in all modes, AppleScript detection, mode switching behavior)
  • Removed 25 dead tunnel tests: Skipped since TunnelHost refactor, core functionality covered by 17 active tests in agentruntime/
  • i18n completeness: Found zh missing 4 keys, ja missing 38, other languages 52-179

Code Cleanup

  • Removed 1,011 lines of dead test code (skipped tunnel tests)
  • Removed unused imports after daemon.go split
Assets 51
Loading