huqiantao 75593a0eac fix: address security review comments ...

1. Fix whitespace bypass in normalize_command (execpolicy/lib.rs:446)
   - Collapse internal whitespace to prevent 'git  status' bypassing 'git status'
   - split_whitespace().join(' ') normalizes all whitespace

2. Fix 'never'/'deny' approval mapping (app-server/lib.rs:287)
   - Map to AskForApproval::Never instead of OnRequest
   - 'never'/'deny' should forbid commands, not prompt for approval

3. Optimize prefix matching (execpolicy/lib.rs:355, bash_arity.rs:375)
   - Avoid format! allocation on every check
   - Use byte comparison for space boundary check

2026-06-07 19:35:20 +08:00

..

agent

feat(agent): classify model families

2026-06-03 15:34:12 -07:00

app-server

fix: address security review comments

2026-06-07 19:35:20 +08:00

cli

chore(release): v0.8.53 — Arcee support, telegram bridge, provider fixes

2026-06-03 16:12:38 -07:00

config

Add path_suffix to ProviderConfigToml and ProviderConfig

2026-06-03 15:34:24 -07:00

core

chore(release): bump workspace to 0.8.53

2026-06-03 12:39:01 -07:00

execpolicy

fix: address security review comments

2026-06-07 19:35:20 +08:00

hooks

chore(release): bump workspace to 0.8.53

2026-06-03 12:39:01 -07:00

mcp

test(mcp): add comprehensive unit tests for MCP manager and helpers (#2441)

2026-05-31 11:01:20 -07:00

protocol

docs(protocol): add doc comments to all public types (#2458)

2026-05-31 10:33:13 -07:00

release

docs(release): add doc comments to all public types and functions (#2449)

2026-05-31 10:23:59 -07:00

secrets

fix(release): stabilize v0.8.52

2026-06-03 02:39:45 -07:00

state

test(state): cover same-second migration idempotency

2026-06-01 05:43:09 -07:00

tools

chore(release): bump workspace to 0.8.53

2026-06-03 12:39:01 -07:00

tui

fix: security bugs in execpolicy, app-server, and tools

2026-06-07 19:13:43 +08:00

tui-core

test(tui-core): add unit tests for UiState state machine (#2450)

2026-05-31 10:38:24 -07:00