Skip to content

fix(email): reject filesystem attachment paths - #110

Merged
yetone merged 1 commit into
yetone:mainfrom
KIDA-MNESIA:codex/fix-email-attachment-file-read
Aug 30, 2026
Merged

fix(email): reject filesystem attachment paths#110
yetone merged 1 commit into
yetone:mainfrom
KIDA-MNESIA:codex/fix-email-attachment-file-read

Conversation

@KIDA-MNESIA

Copy link
Copy Markdown
Collaborator

Summary

  • make Agent CLI email text-only and reject attachment flags before storage, provider, or persistence side effects
  • remove server-local path loading from outbound Agent email send/reply flows
  • cover the real runtime HTTP, JWT, and runCli chain with no-side-effect regressions
  • document the supported email CLI trust boundary

Validation

  • npm run lint
  • npm run typecheck
  • npm run server:typecheck
  • npm run guard:big-brain
  • npm run guard:llm-tracked
  • npm run build
  • targeted runtime integration: 21 passed
  • full integration suite: 199 total, 194 passed, 5 live-Resend tests skipped, 0 failed
  • unit TAP: 932 total, 928 passed, 4 skipped, 0 failed; the local Node 22 parent required interruption after test workers went idle, so this is not reported as a clean process exit

@KIDA-MNESIA
KIDA-MNESIA marked this pull request as ready for review August 30, 2026 04:39
@yetone
yetone merged commit 73585d9 into yetone:main Aug 30, 2026
6 checks passed
@yetone yetone mentioned this pull request Aug 30, 2026
yetone added a commit that referenced this pull request Aug 30, 2026
Fourteen commits since v0.9.1, none of them released yet.

Security: agent CLI email no longer accepts filesystem paths as attachments
(#110). Auth: a taken workspace slug no longer aborts the signup transaction,
and a failed sign-in only reports text we wrote. BYOA: Windows engine version
detection restored (#117), and reconnecting a computer no longer silently
changes its default engine (#118). Conversations: concurrent membership
changes no longer lose each other. Observability: a silent-wake panel, and an
unknown run status no longer takes down the view. Plus an engine-registry CI
guard, one source of truth for the runnable-engine list, and a11y button types
across the app (#122).
@KIDA-MNESIA
KIDA-MNESIA deleted the codex/fix-email-attachment-file-read branch August 30, 2026 17:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants