singularity/singularity-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
singularity-forge/packages
History
Mikael Hugo 2d5a05a48b fix(security): resolve 7 findings from full-repo code review 
- Create web/middleware.ts to authenticate all API routes via bearer token
  and origin checks (previously unauthenticated due to missing middleware file)

- Fix path traversal in browse-directories: replace startsWith with
  realpathSync + relative + isAbsolute containment checks

- Fix XSS in session HTML export: escape raw HTML blocks via marked renderer

- Fix PTY process leak: destroy session on SSE stream cancellation

- Fix unhandled exception in terminal sessions POST: wrap getOrCreateSession
  in try/catch with structured JSON error response

- Fix silent child-process failure in headless dispatch: add exit handler
  to write failed claim when sf headless triage exits non-zero

- Fix TypeError on malformed claim JSON: add Array.isArray guard before
  accessing claim.ids.length

All changes type-check cleanly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-15 02:18:43 +02:00
..
agent-core sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00
ai sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00
coding-agent fix(security): resolve 7 findings from full-repo code review 2026-05-15 02:18:43 +02:00
daemon sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00
google-gemini-cli-provider sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00
native build: switch full build pipeline to TypeScript 7 native (tsgo) 2026-05-10 11:58:58 +02:00
openai-codex-provider sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00
rpc-client sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00
tui sf snapshot: uncommitted changes after 268m inactivity 2026-05-15 02:08:06 +02:00