can1357 cafa86a6cf fix(tools/sqlite): reject comments, terminators, and pagination keywords in where= ...

The structured SQLite helper interpolates `where=` directly into SQL.
A crafted clause like `where=1=1 LIMIT 1000000 --` could comment out
the helper's bound `LIMIT ? OFFSET ?`, returning the full table in
violation of the documented pagination contract.

Validate where= at the selector boundary and reject SQL comments,
statement terminators, and pagination/attach/pragma keywords. Raw SQL
remains available via ?q=SELECT... for callers that need it.

Fixes #735

2026-04-24 06:33:20 +02:00

..

cli

feat(coding-agent): added URL selectors with :raw and line range syntax to read command

2026-04-08 19:47:51 +02:00

core

test(coding-agent/core): removed stale chunk-tree test suite from core

2026-04-24 05:54:10 +02:00

debug

feat(coding-agent/debug): Enabled loading older debug logs from archived files

2026-02-15 09:53:17 +01:00

discovery

test(coding-agent): avoid inline imports in claude plugin discovery tests

2026-04-23 22:54:59 +02:00

extensibility/custom-commands

fix(coding-agent): resolved PR checkout worktree paths to canonical form

2026-04-04 16:08:48 +02:00

fixtures

feat(coding-agent): introduced /force command and ToolChoiceQueue for directive management

2026-04-08 22:10:37 +02:00

helpers

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

internal-urls

feat(internal-urls): added mcp:// protocol for MCP resource access via read tool

2026-03-03 04:48:37 +01:00

marketplace

feat(coding-agent): marketplace plugin project scope

2026-03-31 17:43:09 +02:00

memories

chore: reformat

2026-03-14 10:46:26 +01:00

modes/controllers

test(coding-agent): added test coverage for editor border color update call

2026-04-13 04:30:46 +02:00

plan-mode

refactor: restructured monorepo TypeScript config and build tasks for unified setup

2026-04-08 17:05:20 +02:00

prompts

refactor(review): render extra instructions from template

2026-04-09 18:57:51 +02:00

session-manager

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

slash-commands

feat(coding-agent): introduced /force command and ToolChoiceQueue for directive management

2026-04-08 22:10:37 +02:00

ssh

fix(coding-agent): redirect ssh stdin to avoid mux fd errors

2026-02-24 02:59:42 +01:00

task

fix(coding-agent): fail structured subagents without submit_result

2026-04-24 01:02:18 +02:00

tools

fix(tools/sqlite): reject comments, terminators, and pagination keywords in where=

2026-04-24 06:33:20 +02:00

utils

perf(coding-agent): optimized image compression with aggressive payload reduction strategy

2026-04-11 03:42:26 +02:00

web/search

fix(web-search): decoupled Tavily topic from recency filter

2026-04-18 22:36:33 +02:00

acp-agent.test.ts

feat(cross-cutting): added fd crate export and moved fuzzy-find bindings

2026-04-13 21:25:50 +02:00

acp-event-mapper.test.ts

feat(acp): implemented multi-session support with forking and lifecycle management

2026-04-08 06:54:33 +02:00

agent-session-auto-compaction-queue.test.ts

fix(coding-agent): fixed python kernel startup hangs (#548)

2026-03-27 11:16:26 +01:00

agent-session-auto-compaction-x-initiator.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

agent-session-before-agent-start-attribution.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

agent-session-branching.test.ts

feat(coding-agent): added attribution option to control billing and initiator tracking

2026-03-15 22:56:18 +01:00

agent-session-compaction.test.ts

feat(coding-agent): added attribution option to control billing and initiator tracking

2026-03-15 22:56:18 +01:00

agent-session-concurrent.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

agent-session-context-promotion.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

agent-session-eager-todo.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

agent-session-force-tool-choice.test.ts

feat(coding-agent): introduced /force command and ToolChoiceQueue for directive management

2026-04-08 22:10:37 +02:00

agent-session-handoff.test.ts

feat(coding-agent): added attribution option to control billing and initiator tracking

2026-03-15 22:56:18 +01:00

agent-session-mcp-discovery.test.ts

Fix/resume timestamp mutation (#528)

2026-03-25 12:40:08 +01:00

agent-session-message-pipeline.test.ts

feat(coding-agent): added edit tool consolidation via vim handlers

2026-04-14 10:49:53 +02:00

agent-session-new-session-todos.test.ts

feat(coding-agent): added attribution option to control billing and initiator tracking

2026-03-15 22:56:18 +01:00

agent-session-openai-responses-replay.test.ts

fix(coding-agent): strip stale assistant OpenAI Responses replay payload on rehydrate

2026-04-01 14:53:28 +07:00

agent-session-python-cleanup.test.ts

fix(coding-agent): addressed python cleanup review findings

2026-04-12 14:45:19 +02:00

agent-session-resolve-reminder.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

agent-session-retry-fallback.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

agent-session-role-thinking.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

agent-session-tree-navigation.test.ts

fix(coding-agent): changed session.dispose() to await

2026-03-14 11:03:55 +01:00

agent-session-user-shortcut-hooks.test.ts

feat: enabled async shell cancellation with fallback execution and timeout recovery

2026-03-14 13:38:29 +01:00

agent-storage-sqlite-compat.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

args.test.ts

test: add equals syntax tests for --tools and --model

2026-04-18 09:42:33 +08:00

async-job-manager.test.ts

version 2

2026-04-12 01:36:28 +02:00

auth-storage-minimax-login.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

auth-storage-rotation.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

autocomplete-max-visible.test.ts

refactor: migrated imports to unified package root and consolidated skill discovery logic

2026-02-23 20:59:17 +01:00

autoresearch-state.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

autoresearch-tools.test.ts

refactor(patch): restructured chunk edit schema to use explicit op enum and anchor field

2026-04-07 05:53:40 +02:00

bash-execution-clamp.test.ts

fix: sanitize tool execution events and streamline handling

2026-04-10 14:51:27 -05:00

bash-execution-sixel.test.ts

test(coding-agent): updated tests for abbreviated chunk path conventions

2026-04-13 04:24:59 +02:00

bash-executor.test.ts

feat: added strict-mode fallback for OpenAI tool calls with all_strict

2026-04-13 15:46:06 +02:00

block-images.test.ts

feat(coding-agent): add inspect_image tool and image guidance flow (#295)

2026-03-10 02:49:32 +01:00

checkpoint-rpc-qa.ts

test(tui): added regression tests for viewport stability during resize storms

2026-03-01 09:55:02 +01:00

client-prompts.test.ts

fix: corrected resource tracking and context cleanup across MCP and virtualization layers

2026-03-03 06:07:22 +01:00

client-resources.test.ts

fix: corrected resource tracking and context cleanup across MCP and virtualization layers

2026-03-03 06:07:22 +01:00

commit-agentic-attribution.test.ts

refactor(coding-agent): migrated git operations to centralized utils module

2026-04-02 07:35:44 +02:00

commit-model-selection-role-thinking.test.ts

fix: honor per-role thinking in modelRoles helpers

2026-03-11 00:03:48 +01:00

compaction-hooks-example.test.ts

style(deps): migrated from Prettier to Biome and updated formatting rules

2026-01-24 04:20:19 +01:00

compaction-hooks.test.ts

feat(coding-agent): added attribution option to control billing and initiator tracking

2026-03-15 22:56:18 +01:00

compaction-serialization.test.ts

fix(coding-agent): backported pi-mono changes (5133697..15e0957b0)

2026-03-10 07:27:30 +01:00

compaction-thinking-model.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

compaction.test.ts

refactor(coding-agent): migrated test mocks to vitest spyOn with Symbol.dispose cleanup

2026-03-26 16:17:27 +01:00

config-cli.test.ts

fix(coding-agent): fixed memory leak by cancelling idle compaction

2026-04-05 03:50:52 +02:00

config-spacing.test.ts

refactor: migrated tab width resolution to pi-utils with EditorConfig caching

2026-04-10 14:18:36 +02:00

countdown-timer.test.ts

fix(ask): restore ask timeout auto-select behavior (#269)

2026-03-03 14:45:06 +01:00

custom-editor-keybindings.test.ts

fix natives loading in keybinding tests

2026-04-08 18:52:42 +02:00

cycle-order-custom-roles.test.ts

WIP

2026-03-23 08:54:54 -04:00

edit-diff.test.ts

fix: stabilize merged review follow-ups

2026-04-18 23:24:00 +02:00

edit-mode.test.ts

feat(ai): changed spark edit tool resolution

2026-04-24 00:42:19 +02:00

extensions-discovery.test.ts

test(coding-agent): make extension deps discovery test self-contained

2026-02-28 06:33:07 +01:00

extensions-runner.test.ts

feat: add session name getter/setter to extension API

2026-04-11 01:09:08 -05:00

file-mentions.test.ts

fix(coding-agent): added fuzzy @file auto-read matching

2026-02-13 14:07:38 +01:00

fuzzy.test.ts

style(deps): migrated from Prettier to Biome and updated formatting rules

2026-01-24 04:20:19 +01:00

git-process-config.test.ts

fix(coding-agent): resolved duplicate -c in coding-agent git commands

2026-04-11 08:54:27 +02:00

git-url.test.ts

fix(coding-agent): backported pi-mono changes (34878e..5133697)

2026-02-16 10:08:53 +01:00

history-storage-sqlite-compat.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

hook-editor.test.ts

test(coding-agent): corrected hook-editor assertion for keybinding render

2026-03-26 20:05:19 +01:00

hook-input-timeout.test.ts

feat(ask): add back and forward multi-question navigation

2026-03-03 15:09:46 +01:00

hook-selector-overflow.test.ts

fix(coding-agent): prevent selector option overflow

2026-03-03 15:12:50 +01:00

image-b64poly.test.ts

feat(coding-agent): added Buffer.toBase64() polyfill for Bun compatibility

2026-02-21 22:59:04 +01:00

image-input-normalization.test.ts

refactor(coding-agent): migrated image utilities to shared pi-utils package

2026-04-08 14:42:51 +02:00

image-input.test.ts

refactor(coding-agent): migrated image utilities to shared pi-utils package

2026-04-08 14:42:51 +02:00

initial-message.test.ts

fix(coding-agent): backported pi-mono changes (1feccfed..b21b42d0)

2026-03-22 18:28:40 +01:00

input-controller-escape.test.ts

Make temporary model selector keybinding configurable (#539)

2026-03-26 15:33:26 +01:00

input-controller-keybindings.test.ts

fix natives loading in keybinding tests

2026-04-08 18:52:42 +02:00

interactive-mode-lsp-startup.test.ts

feat: introduced @decl chunk region selector for semantic declarations

2026-04-08 17:49:39 +02:00

interactive-mode-plan-review.test.ts

fix(coding-agent): corrected plan review previews to re-append at chat tail on refresh

2026-04-07 22:38:49 +02:00

interactive-mode-status.test.ts

test(coding-agent): updated interactive mode status test to use buildSessionContext

2026-03-10 04:10:36 +01:00

join-patch.test.ts

refactor(coding-agent): migrated git operations to centralized utils module

2026-04-02 07:35:44 +02:00

keybindings-display.test.ts

fix(coding-agent): backported pi-mono changes (1feccfed..b21b42d0)

2026-03-22 18:28:40 +01:00

keybindings-escape-components.test.ts

feat(coding-agent): added canonical aliases for model role resolution

2026-04-11 08:28:50 +02:00

keybindings-migration.test.ts

Make temporary model selector keybinding configurable (#539)

2026-03-26 15:33:26 +01:00

lm-studio-fix.test.ts

fix(tests): added resource cleanup methods and initiatorOverride support

2026-03-14 11:25:40 +01:00

main-interactive-input.test.ts

feat(coding-agent): enabled interactive input submission and fixed continue path state handling

2026-03-10 20:15:03 +01:00

mcp-manager-subscription-action.test.ts

fix(coding-agent): guard stale MCP subscription post-actions

2026-03-03 04:00:30 +01:00

mcp-reconnect.test.ts

feat(coding-agent): added MCP server auto-reconnect with SSE monitoring

2026-03-20 23:48:38 +01:00

mcp-roots-list.test.ts

feat(mcp): implement roots/list and server-to-client request handling (#474)

2026-03-18 23:02:22 +01:00

mcp-test-utils.ts

fix: corrected resource tracking and context cleanup across MCP and virtualization layers

2026-03-03 06:07:22 +01:00

memories-runtime.test.ts

feat(utils): full XDG Base Directory support for all path helpers (#407)

2026-03-14 14:52:12 +01:00

memories-storage.test.ts

test(memories): align cwd-scoped phase2 tests

2026-03-14 11:00:07 +01:00

model-registry-runtime-cleanup.test.ts

chore: reformat

2026-04-13 00:58:32 +02:00

model-registry-runtime-provider.test.ts

fix(model-registry): persist extension-registered models across refresh cycles

2026-04-10 23:25:39 -04:00

model-registry.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

model-resolver.test.ts

feat: added strict-mode fallback for OpenAI tool calls with all_strict

2026-04-13 15:46:06 +02:00

model-selector-role-badge-thinking.test.ts

feat(coding-agent): added canonical aliases for model role resolution

2026-04-11 08:28:50 +02:00

oauth-discovery.test.ts

refactor: extracted fetch mocking into reusable hookFetch utility

2026-03-08 16:16:54 +01:00

oauth-flow.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

oauth-manual-input.test.ts

feat(oauth): Enabled manual OAuth callbacks via slash command input

2026-02-23 06:21:32 +00:00

output-block.test.ts

Implement Windows Sixel support and terminal capability checks (#241)

2026-03-01 22:23:05 +01:00

plan-mode-thinking-level.test.ts

fix(ci): restore Copilot 1M context and stabilize plan-role tests

2026-04-05 18:05:09 +02:00

plugin-command.test.ts

fix(coding-agent): validate plugin scope flag

2026-04-01 15:31:46 +02:00

plugin-extensions-discovery.test.ts

test: isolated plugin discovery test with XDG_DATA_HOME environment variable

2026-03-15 17:36:59 +01:00

prompt-action-autocomplete.test.ts

fix(coding-agent): backported pi-mono changes (1feccfed..b21b42d0)

2026-03-22 18:28:40 +01:00

prompt-format.test.ts

refactor(prompt-templates): migrated prompt utilities to pi-utils package

2026-04-08 05:47:35 +02:00

prompt-templates.test.ts

fix(coding-agent): preserve unconsumed inline args in template expansion (#314)

2026-03-15 23:07:35 +01:00

python-tool-settings.test.ts

fix(coding-agent): scoped python kernel cleanup to sessions

2026-04-12 13:29:17 +02:00

read-tool-group.test.ts

feat(coding-agent): added optional inline read preview toggle

2026-04-18 23:37:47 +02:00

role-info.test.ts

fix(models): unify selector role sources

2026-03-26 19:12:51 +01:00

role-thinking-helper-propagation.test.ts

refactor(coding-agent/tools): restructured tools to inject Settings through render functions

2026-03-12 17:37:52 +01:00

rpc-client.start.test.ts

fix(coding-agent): use ready-signal protocol for RPC client startup

2026-02-20 12:28:25 +01:00

rpc-example.ts

refactor(pi-utils): migrated process spawning from cspawn to spawnGroup/spawnAttached with async resource management

2026-01-28 21:12:28 +01:00

rpc-host-tools.test.ts

feat(coding-agent): enabled bidirectional RPC tool execution with host-owned custom tools

2026-04-08 06:23:27 +02:00

rpc-mode-extension-ui.test.ts

fix(ask): keep multiline custom input in prompt gutter

2026-03-26 16:14:52 +07:00

rpc.test.ts

feat: introduced Effort enum and ThinkingConfig for model-aware reasoning

2026-03-06 12:35:01 +01:00

sdk-mcp-discovery.test.ts

Fix/resume timestamp mutation (#528)

2026-03-25 12:40:08 +01:00

sdk-model-selection.test.ts

refactor: restructured logger.time() API to accept function references with wall-clock markers

2026-04-08 08:47:32 +02:00

sdk-session-isolation.test.ts

test(coding-agent): align prompt wording assertions

2026-04-23 23:05:24 +02:00

sdk-skills.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

sdk-tool-activation.test.ts

feat(coding-agent): added edit tool consolidation via vim handlers

2026-04-14 10:49:53 +02:00

secrets-obfuscator.test.ts

feat(secrets): add secret obfuscation with regex flags support

2026-02-15 17:02:33 +00:00

session-color.test.ts

fix(coding-agent): respected session title source when formatting terminal titles

2026-04-13 06:22:37 +02:00

session-messages.test.ts

fix(coding-agent): add explicit initiator attribution for Copilot headers (#246)

2026-03-02 17:01:44 +01:00

session-provider-section.test.ts

feat: added WebSocket retry logic with configurable budget and enum-based transport policy

2026-02-14 00:58:42 +01:00

session-storage.test.ts

refactor(coding-agent): migrated test mocks to vitest spyOn with Symbol.dispose cleanup

2026-03-26 16:17:27 +01:00

settings-manager.test.ts

feat(config): reorganized settings into 8 focused categories with 15+ new customization options

2026-03-14 13:44:20 +01:00

skills.test.ts

fix(coding-agent): skip skills disabled via frontmatter (#382)

2026-03-13 15:14:05 +01:00

status-line-git-utils.test.ts

fix: corrected URI template expansion and MCP notification epoch handling

2026-03-03 03:56:30 +01:00

status-line-path.test.ts

feat(coding-agent): added symlink resolution and path alias handling for consistent directory behavior

2026-03-16 15:24:18 +01:00

status-line-token-rate.test.ts

feat(status-line): display token-per-second metric

2026-03-03 14:32:02 +01:00

status-text-sanitization.test.ts

fix: stabilize merged review follow-ups

2026-04-18 23:24:00 +02:00

streaming-edit-abort.test.ts

test(coding-agent): restructured streaming abort tests with timing control for isolation

2026-04-08 15:28:08 +02:00

streaming-output.test.ts

chore: update tests, lockfiles, and misc cleanups

2026-04-06 18:41:17 +02:00

streaming-render-debug.ts

feat(coding-agent): auto-switch dark/light theme via SIGWINCH

2026-02-15 10:20:11 +01:00

system-prompt-dedup.test.ts

fix: resolved AI/OAuth helper duplication via shared modules

2026-04-23 21:02:14 +02:00

system-prompt-templates.test.ts

refactor(prompt-templates): migrated prompt utilities to pi-utils package

2026-04-08 05:47:35 +02:00

test-theme-colors.ts

feat(coding-agent): auto-switch dark/light theme via SIGWINCH

2026-02-15 10:20:11 +01:00

theme-auto-detection.test.ts

refactor(natives): migrated native bindings to NAPI-RS with auto-generated types

2026-04-07 02:00:59 +02:00

tool-choice-queue.test.ts

feat(coding-agent): introduced /force command and ToolChoiceQueue for directive management

2026-04-08 22:10:37 +02:00

tools.test.ts

refactor(find): consolidate path relativization and drop gitignore fallback

2026-04-24 05:49:16 +02:00

truncate-to-width.test.ts

refactor: restructured text module and simplified NAPI API surface

2026-02-01 10:23:41 +01:00

ttsr.test.ts

feat(coding-agent): added TTSR injection tracking and deduplication

2026-02-18 01:53:02 +01:00

tui-tree-list-collapsed-lines.test.ts

fix(tui): enforce collapsed line budgets

2026-03-26 19:12:50 +01:00

update-cli.test.ts

fix(coding-agent): harden omp update install-target detection

2026-03-03 05:29:26 +01:00

utilities.ts

feat(coding-agent): added attribution option to control billing and initiator tracking

2026-03-15 22:56:18 +01:00

visual-truncate.test.ts

perf(tui,natives): added native text utilities with JS fast path for short strings

2026-01-29 10:47:55 +01:00