can1357
cafa86a6cf
The structured SQLite helper interpolates `where=` directly into SQL. A crafted clause like `where=1=1 LIMIT 1000000 --` could comment out the helper's bound `LIMIT ? OFFSET ?`, returning the full table in violation of the documented pagination contract. Validate where= at the selector boundary and reject SQL comments, statement terminators, and pagination/attach/pragma keywords. Raw SQL remains available via ?q=SELECT... for callers that need it. Fixes #735
@oh-my-pi/pi-coding-agent
Core implementation package for the omp coding agent in the oh-my-pi monorepo.
For installation, setup, provider configuration, model roles, slash commands, and full CLI reference, see:
Package-specific references: