roboomp 0788933110 fix(mcp): escape Windows cmd shim args against injection ...

Building the cmd.exe /c command line and spawning with windowsVerbatimArguments so cmd.exe expansion cannot eat or inject on %VAR%, quote, and metacharacter args (BatBadBut / CVE-2024-24576).

Fixes #5696

2026-07-16 13:39:42 +00:00

..

advisor

fix(advisor): steer late blocker after terminal answer

2026-07-15 23:12:42 +00:00

async

refactor(coding-agent): consolidated tool surface onto xd:// devices and hub

2026-07-15 15:16:29 +02:00

auto-thinking

feat(coding-agent): centralized preprocessing and guidance for small models

2026-07-11 12:28:18 +02:00

autolearn

Merge PR #4924: fix(coding-agent): skip autolearn capture after aborted turns (@metaphorics)

2026-07-14 18:45:22 +02:00

autoresearch

fix(tui): handled Kitty vim navigation sequences

2026-07-14 18:08:23 +00:00

capability

fix(ttsr): registered rules with inline regex flags and malformed scope

2026-07-14 19:01:47 +00:00

cli

merged PR #5417: fix(openai): render native response images

2026-07-16 03:48:21 +02:00

collab

fix collab reconnect backpressure drain

2026-07-05 13:25:26 +02:00

commands

Merge PR #5044: fix(cli): parse max-time duration suffixes (@roboomp)

2026-07-14 18:46:14 +02:00

commit

feat(coding-agent-task): implemented agent-centric flat task structure

2026-07-11 13:44:04 +02:00

config

merged PR #5443: fix(tools): prefer active image provider and fall back

2026-07-16 03:32:01 +02:00

dap

fix(debug): stopped native fallback for missing delve

2026-07-10 14:06:57 +02:00

debug

fix(debug): guarded v8.setFlagsFromString call so CPU profiler works on Bun

2026-06-30 12:47:07 +00:00

discovery

merged PR #5562: fix(discovery): root Codex config.toml MCP command/cwd at config dir

2026-07-16 03:31:55 +02:00

edit

feat(coding-agent): made hashline seen-line guard opt-in via edit.enforceSeenLines

2026-07-15 15:15:08 +02:00

eval

chore: reformat

2026-07-15 00:08:50 +02:00

exa

fix: address easy issues review

2026-06-08 15:47:57 -03:00

exec

fix(bash): aborted isolated shells on cancellation

2026-07-14 19:57:59 +00:00

export

merged PR #5417: fix(openai): render native response images

2026-07-16 03:48:21 +02:00

extensibility

feat(coding-agent): added opt-in task prewalk and tightened --tools and xdev behavior

2026-07-15 18:39:36 +02:00

goals

fix(coding-agent): reused one codex side session per guided-goal interview

2026-07-14 20:25:16 +00:00

hindsight

fix(mnemopi): stripped retention markers from embeddings

2026-07-03 04:59:02 +00:00

internal-urls

test(coding-agent): cover nested output priority

2026-07-16 03:41:51 +02:00

irc

feat(coding-agent): implemented resumable subagent yielding for tasks

2026-07-11 17:27:35 +02:00

jsonrpc

refactor(coding-agent): consolidated message framing logic

2026-06-22 05:29:00 +02:00

launch

style: formatted evaluator test additions

2026-07-14 23:11:49 +02:00

lib

fix(web-search): honored configured xai transport

2026-07-15 17:44:30 +00:00

lsp

fix(lsp): sent initial workspace configuration

2026-07-12 13:38:42 +00:00

markit

fix(coding-agent): handled inline image pdf delimiters

2026-07-04 12:18:06 +00:00

mcp

fix(mcp): escape Windows cmd shim args against injection

2026-07-16 13:39:42 +00:00

memories

feat(coding-agent): removed canonical model variant selection and tracking

2026-07-01 05:22:42 +02:00

memory-backend

fix(agent): kept autolearn memory prompts cache-stable

2026-06-28 18:10:57 +00:00

mnemopi

fix(mnemopi): made recall fact ids resolvable via memory reads

2026-07-09 18:27:23 +02:00

modes

fix(session): await session.dispose() on non-interactive exit paths

2026-07-16 04:29:55 +02:00

plan-mode

Merge remote-tracking branch 'origin/farm/80b5de49/plan-mode-reentry-anchor-new-request'

2026-07-15 15:34:06 +02:00

prompts

merged PR #5462: fix(coding-agent): resolve agent:// slash form for nested subagent output

2026-07-16 03:41:51 +02:00

registry

refactor(coding-agent): consolidated tool surface onto xd:// devices and hub

2026-07-15 15:16:29 +02:00

secrets

fix(coding-agent): hid secrets from advisor prompts

2026-06-22 07:05:23 +00:00

session

fix(session): await session.dispose() on non-interactive exit paths

2026-07-16 04:29:55 +02:00

slash-commands

merged PR #5515: fix(skills): reload runtime skill state

2026-07-16 03:31:59 +02:00

ssh

refactor(coding-agent): consolidated tool surface onto xd:// devices and hub

2026-07-15 15:16:29 +02:00

stt

style: bun run fix

2026-07-01 00:07:30 +00:00

subprocess

isolate eval runtimes from terminal

2026-07-13 09:57:19 -04:00

task

chore: fixed remaining stale tests after prompt and session api changes

2026-07-15 19:50:46 +02:00

tiny

feat(coding-agent): replaced legacy pi/ role alias prefix with

2026-07-13 23:26:33 +02:00

tools

merged PR #5453: fix(browser): bound tab teardown waits

2026-07-16 03:43:17 +02:00

tts

feat(coding-agent): replaced legacy pi/ role alias prefix with

2026-07-13 23:26:33 +02:00

tui

feat(coding-agent): refactored eval tool to single-step execution

2026-06-23 00:59:58 +02:00

utils

Merge PR #5459: fix(coding-agent): reject prose thinking session titles (@roboomp)

2026-07-14 22:58:46 +02:00

vibe

refactor(coding-agent): consolidated tool surface onto xd:// devices and hub

2026-07-15 15:16:29 +02:00

web

fix(web-search): reuse supplied registry auth

2026-07-16 03:31:58 +02:00

cli-commands.ts

fix(cli): guard scoped plugin verb aliases

2026-07-16 03:32:02 +02:00

cli.ts

lazy load js eval process entry in cli

2026-07-13 09:57:20 -04:00

config.ts

chore: drop unrelated profile branch hunks

2026-05-29 22:24:22 -03:00

cursor.ts

fix(cursor): propagated returned tool error status

2026-07-14 20:20:54 +00:00

index.ts

refactor(coding-agent): integrated zod validation and upgraded typebox shim

2026-06-18 01:57:23 +02:00

main.ts

feat(coding-agent): added support for task-agent field and model resolution

2026-07-15 00:50:55 +02:00

priority.json

config(coding-agent): extended model priority lists

2026-06-27 04:34:39 +02:00

sdk.ts

merged PR #5515: fix(skills): reload runtime skill state

2026-07-16 03:31:59 +02:00

startup-splash.ts

fix(coding-agent): tighten startup splash review coverage

2026-06-17 10:53:08 -04:00

system-prompt.test.ts

Merge PR #5504: fix(prompt): restore non-Linux CPU model metadata (@roboomp)

2026-07-14 23:11:11 +02:00

system-prompt.ts

merged PR #5515: fix(skills): reload runtime skill state

2026-07-16 03:31:59 +02:00

telemetry-export.ts

perf(coding-agent): deferred heavy module imports to startup paths

2026-06-06 23:25:18 +02:00

thinking.ts

feat(coding-agent): replaced legacy pi/ role alias prefix with

2026-07-13 23:26:33 +02:00

workspace-tree.ts

feat: standardized elision markers and improve transcript viewer robustness

2026-06-19 04:35:18 +02:00