839d244e51
fix: intermediate output and comfirmation
2026-07-27 23:17:42 +01:00
6eb3827ddd
feat: dnsname argument type
2026-07-25 22:00:02 +01:00
1396184777
fix(executor): always anchor custom regex patterns and harden shellAfterCompleted
...
Wrap regex: patterns in a non-capturing group before applying ^...$ so
alternation cannot bypass full-string matching. Return template parse
errors from buildShellAfterCommand, and guard nil binding/action before
building shellAfterCompleted commands.
2026-07-08 10:46:13 +01:00
0e45f3b0e3
security: GHSA-xc5w-4v5w-7x65 (HIGH) harden shell argument type safety
...
Block additional unvalidated argument types from shell actions, enforce
full-string custom regex matching, and allowlist http/https URL schemes.
Update checkbox integration test to use exec, matching the intended shell
vs exec split for choiceless checkbox arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 09:40:48 +01:00
42f2572616
fix(config): reject ambiguous checklist comma format and propagate encode errors
...
ParseChecklistValue now accepts JSON arrays or single bare values and rejects
legacy comma-separated input. Empty JSON segments are validated consistently,
and FormatChecklistValue returns marshal errors instead of an empty string
2026-07-07 11:57:20 +01:00
9dc51df01d
fix: harden checklist JSON wire format, entity pagination, and review findings across API and UI
2026-07-07 10:14:17 +01:00
b18518ebea
fix: add support for entities in checklists
2026-07-06 12:17:03 +01:00
e24ae6265b
feat: Checklist support ( #922 )
2026-07-06 11:01:22 +01:00
633d9ecd82
feat: action group sizing
2026-06-18 23:33:27 +01:00
ebffd9f040
security: GHSA-prj9-97mp-mwh2 (HIGH) Treat all ot_ system arguments as reserved, preventing RCE
...
Ensure OliveTin-owned arguments are injected only after filtering and validate system values before command execution.
2026-05-31 22:44:40 +01:00
4bbd2eab15
security: GHSA-49gm-hh7w-wfvf
2026-02-22 10:19:08 +00:00
b777d599aa
fix: Massive cleanup of template parsing
2026-02-07 00:09:46 +00:00
b4157ed5ba
fix: argument validation on bindings
2025-12-25 01:16:04 +00:00
c917d1b1e7
bugfix: #639 Exec support, disallow URL and similar arguments with
2025-10-26 16:40:44 +00:00
60814b97e2
chore: fix gocyclo issues
2025-10-11 00:52:18 +01:00
a464e6a445
fix: broken tests after changing the way arguments are parsed
2025-10-01 22:20:56 +01:00
570c0ba087
chore: Repair output streaming, lots of css/go lint
2025-09-06 08:42:13 +01:00
d4d3193c1d
bugfix: Argument confirmations stopped working ( #627 ) ( #632 )
...
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2025-07-29 21:51:34 +00:00
b99b3f4345
chore: Various codestyle fixes
2025-07-12 23:46:50 +01:00
e38361f3d7
fix: gofmt/gocylo leftover from old PR ( #610 )
2025-06-22 20:42:57 +00:00
1ffdd93ddf
fix: Redact password arguments in logs #594 ( #601 )
2025-06-06 21:00:56 +00:00
fcfa007cec
build: Add unit tests for regex (ref: #578 )
2025-05-01 16:30:29 +01:00
eb2721c023
chore: Cleanup argument handling ( #571 )
2025-04-21 08:50:59 +00:00
88f639d29f
chore: Cleanup executor shell passing ( #556 )
2025-04-07 20:48:45 +00:00
ff31abe66c
refactor: Project directories ( #541 )
2025-03-22 01:06:59 +00:00
jamesread