Release v1.14.0 · tylergraydev/fury

What's New

One-click repo containerization via AI (#131) — AI-powered Dockerfile and docker-compose generation for any repository

Path traversal protection — read_file_base64, diff, and branch file operations now validate paths against known workspace/repo roots
Container ID validation — all docker exec calls validate container IDs match hex format
Env var key sanitization — prevents argument injection via docker exec -e flags
Deadlock prevention — fixed 3 lock ordering violations in agent and devcontainer commands
Poisoned lock hardening — security validation now fails hard instead of silently degrading

WCAG AA improvements: aria-label on chat textarea, icon buttons, notification bell
Dialog semantics (role="dialog", focus trap, Escape key) on settings and notification overlays
Keyboard navigation on model dropdown menu
aria-live status announcements on agent status indicator

Scroll-aware auto-scroll in chat — no longer force-scrolls when reading earlier messages
Adaptive polling in ChangesPanel (3s when active, 15s when idle)
MarkdownContent memoization — components no longer rebuild on every streaming chunk
Fixed 8 components using non-selective Zustand subscriptions
Output arrays capped at 5000 lines in script/test runner stores

Fixed keybindings shift-match bug — Cmd+Shift+* shortcuts now work correctly
Fixed chatStore stale closure losing content blocks during fast streaming
Fixed chatStore subscribe race condition causing duplicate listeners
Fixed workspace archive/delete navigating to stale repo
Added cross-store cleanup on workspace delete to prevent memory leaks
UTF-8 safe string truncation in Rust (10 sites) — prevents panics on multi-byte characters
Fixed devcontainer stderr race between tokio task and wait_with_output
Converted Linear and Azure DevOps services from blocking to async HTTP
Added Copilot LSP pending request cleanup on timeout
Added restoreMocks: true to vitest config

Full Changelog: v1.13.1...v1.14.0