Repository navigation
docs: changelog update 2026-10-28 (6 new entries) #483
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,17 +1,17 @@ | ||
| --- | ||
| last_updated: 2026-10-26T00:00:00Z | ||
| last_mapping: 2026-02-14 | ||
| last_audit: 2026-10-26 | ||
| commits_since_audit: 0 | ||
| commits_since_mapping: 255 | ||
| open_findings: 11 | ||
| open_questions: 12 | ||
| status: audit_complete_yellow | ||
| --- | ||
|
|
||
| # Security Audit State | ||
|
|
||
| **Last Updated:** 2026-10-26 00:00 UTC | ||
|
|
||
| This document provides persistent state for security audits, enabling incremental reviews that build on previous work rather than starting fresh each time. | ||
|
|
||
|
|
@@ -22,27 +22,28 @@ This document provides persistent state for security audits, enabling incrementa | |
| | Metric | Value | Notes | | ||
| |--------|-------|-------| | ||
| | Last full mapping | 2026-02-14 | Comprehensive audit completed | | ||
| | Last incremental audit | 2026-10-26 | Incremental - YELLOW - 3 new MEDIUM findings (#013, #014, #015) | | ||
| | Commits since last audit | 0 | At 3601bfa (2026-10-26) | | ||
| | Open findings | 11 | See [FINDINGS-INDEX.md](intel/FINDINGS-INDEX.md) | | ||
| | Open questions | 12 | 4 new questions (Q15-Q18); 8 carried over | | ||
|
|
||
| **Status:** YELLOW - Finding #012 (Web API + file serving) needs documentation; 3 new findings in OAuth and config validation. | ||
|
|
||
| ### Finding Breakdown | ||
|
|
||
| - **Critical: 0** | ||
| - **High: 1** (#012 web API auth missing - now includes file serving route) | ||
| - High: 1 (accepted risk - hostConfigOverride #002) | ||
| - **Medium: 5** (#013 OAuth perms NEW, #014 settings validation NEW, #011 OAuth elevated, #010 job retention, #008 npm audit) | ||
| - **Low: 2** (#015 OAuth logging NEW, #009 shell escaping partial fix) | ||
| - Intentional: 1 (#005 example config) | ||
| - Accepted: 1 (#006 shell:true) | ||
|
|
||
| ### Question Priorities | ||
|
|
||
| - High: 0 | ||
| - Medium: 9 (Q1 webhook auth, Q4 log injection, Q5 config merge, Q7 container user, Q8 SDK escaping, Q15 OAuth logging NEW, Q16 SDK settings validation NEW, Q17 session adoption NEW, Q18 file serving NEW) | ||
|
Contributor
There was a problem hiding this comment. Reconcile the open-question count and registry. The front matter reports 12 open questions, but the priority rows list 9 medium IDs and 4 low IDs, which totals 13. The Active Investigations table also omits IDs listed in the priority rows. Reconcile the authoritative question list, counts, and table before the next audit. (raw.githubusercontent.com)
 |
||
| - Low: 3 (Q3 container name chars, Q9 rate limiting, Q10 MCP security, Q11 GitHub SSRF) | ||
|
|
||
| --- | ||
|
|
||
|
|
@@ -52,12 +53,12 @@ Security coverage by area with staleness tracking. | |
|
|
||
| | Area | Last Checked | Commits Since | Status | Notes | | ||
| |------|--------------|---------------|--------|-------| | ||
| | Attack surface | 2026-10-26 | 0 | ✅ Current | File serving route added (`/files/:agentName/*`) | | ||
| | Data flows | 2026-10-26 | 0 | ✅ Current | OAuth credential injection, MCP bridge auth reviewed | | ||
| | Security controls | 2026-10-26 | 0 | ✅ Current | Path traversal defenses verified (Windows fix applied) | | ||
| | Threat vectors | 2026-10-26 | 0 | ✅ Current | File serving containment, settings validation gaps assessed | | ||
| | Hot spots | 2026-10-26 | 0 | ✅ Current | 4 critical files verified - WARN status | | ||
| | Code patterns | 2026-10-26 | 0 | ✅ Current | OAuth logging patterns, settings field validation reviewed | | ||
|
|
||
| ### Staleness Thresholds | ||
|
|
||
|
|
@@ -73,29 +74,36 @@ Active findings and open questions requiring attention. | |
|
|
||
| | ID | Type | Summary | Priority | Status | Source | | ||
| |----|------|---------|----------|--------|--------| | ||
| | #012 | Finding | Web API lacks authentication (chat + files) | **HIGH** | OPEN - Needs documentation | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | #013 | Finding | OAuth credential file permissions not enforced | **MEDIUM** | OPEN - Code fix needed | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | #014 | Finding | Unvalidated `settings` config field | **MEDIUM** | OPEN - SDK validation review | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | #011 | Finding | OAuth credential management - risk elevated | **MEDIUM** | YELLOW - Session exposure risk | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | #010 | Finding | bypassPermissions in 22 job files | MEDIUM | YELLOW - Retention policy needed | [FINDINGS-INDEX.md](intel/FINDINGS-INDEX.md) | | ||
| | #008 | Finding | npm audit - devalue vulnerabilities | Medium | Update to 5.9.4 | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | #015 | Finding | OAuth error logging may leak tokens | Low | OPEN - Sanitize errors | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | #009 | Finding | Incomplete shell escaping | Low | Partially fixed (updated 2026-10-26) | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | Q15 | Question | OAuth tokens logged during refresh/injection? | Medium | Open - relates to #015 | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | Q16 | Question | SDK settings validation requirements | Medium | Open - relates to #014 | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | Q17 | Question | Session adoption privilege boundaries | Medium | Open - new session system | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | Q18 | Question | Can agents access each other's files via route? | Medium | Open - file serving route | [2026-10-26 Report](intel/2026-10-26.md) | | ||
| | Q1 | Question | Webhook authentication | Medium | Related to #012 - web API has no auth | [2026-03-06 Report](intel/2026-03-06.md) | | ||
| | Q4 | Question | Log injection via agent output | Medium | Open | [CODEBASE-UNDERSTANDING.md](CODEBASE-UNDERSTANDING.md) | | ||
| | Q5 | Question | Fleet/agent config merge overrides | Medium | Open | [CODEBASE-UNDERSTANDING.md](CODEBASE-UNDERSTANDING.md) | | ||
| | Q8 | Question | SDK wrapper prompt escaping | Medium | Open | [CODEBASE-UNDERSTANDING.md](CODEBASE-UNDERSTANDING.md) | | ||
|
|
||
| ### Priority Queue | ||
|
|
||
| Ordered by urgency for next audit session: | ||
|
|
||
| 1. **HIGH P1:** Document web dashboard + file serving as localhost-only, warn against network exposure (#012) | ||
| 2. **MEDIUM P1:** Add file permission enforcement to `writeCredentialsFile()` - use mode 0o600 (#013) | ||
| 3. **MEDIUM P2:** Review SDK `settings` field validation requirements (#014, Q16) | ||
| 4. **MEDIUM P3:** Audit session files for OAuth credential leaks (#011 + #012 combined risk) | ||
| 5. **MEDIUM P4:** Sanitize OAuth error logging to prevent token leaks (#015, Q15) | ||
| 6. **MEDIUM P5:** Implement job file retention policy (30 days) to resolve #010 | ||
| 7. **MEDIUM P6:** Investigate session adoption privilege boundaries (Q17) | ||
| 8. **MEDIUM P7:** Test file serving route for cross-agent access (Q18) | ||
| 9. **LOW:** Complete shell escaping verification (#009) | ||
|
|
||
| --- | ||
|
|
||
|
|
@@ -105,13 +113,15 @@ Ordered by urgency for next audit session: | |
|
|
||
| | Date | Decision | Rationale | | ||
| |------|----------|-----------| | ||
| | 2026-10-26 | #013 MEDIUM - OAuth file permissions not enforced | Regression check confirms #011 issue still present; `writeCredentialsFile()` needs mode 0o600 | | ||
| | 2026-10-26 | #014 MEDIUM - Settings field unvalidated | New `settings` field uses `z.unknown()` - unknown what SDK settings are security-sensitive | | ||
| | 2026-10-26 | #015 LOW - OAuth error logging may leak tokens | HTTP response bodies and error objects logged without redaction | | ||
| | 2026-10-26 | #012 UPDATED - File serving route added | `/files/:agentName/*` route added; well-defended but same auth gap as chat API | | ||
| | 2026-10-26 | #009 status UPDATED | Shell escaping now handles `$`, backtick, `\`, `"` (missing `!` escape) | | ||
|
Contributor
There was a problem hiding this comment. Synchronize the shell-escaping details. This decision records
|
||
| | 2026-10-26 | File serving route APPROVED | Path traversal defenses verified; CSP sandbox headers mitigate untrusted content | | ||
| | 2026-10-26 | MCP bridge auth IMPROVED | Bearer token + loopback binding added - security improvement | | ||
| | 2026-03-06 | #012 HIGH - Web API lacks authentication | New web API routes have no auth; designed for localhost only; needs documentation | | ||
| | 2026-03-06 | #011 risk ELEVATED | Session files exposed via web API may contain OAuth tokens; combined risk with #012 | | ||
| | 2026-02-20 | #011 MEDIUM - OAuth credential review needed | New credential handling added to container-manager.ts; needs file permission and logging audit | | ||
| | 2026-02-17 | #010 DOWNGRADED to MEDIUM; HALT LIFTED | 2026-02-15 audit correctly identified measurement error: 143 count included JSONL files; correct count is 21 YAML files | | ||
| | 2026-02-14 | Comprehensive security audit completed | Full attack surface mapping, data flow tracing, controls assessment, threat modeling | | ||
|
|
@@ -123,22 +133,25 @@ Ordered by urgency for next audit session: | |
|
|
||
| Security capabilities not yet implemented or areas needing investigation: | ||
|
|
||
| - **HIGH: Web API + file serving have no authentication** - localhost-only by design but needs documentation (#012) | ||
| - **MEDIUM NEW: OAuth credential file permissions not enforced** - writeCredentialsFile() doesn't set 0600 (#013) | ||
| - **MEDIUM NEW: Settings field unvalidated** - z.unknown() accepts arbitrary SDK settings (#014) | ||
| - **MEDIUM: Session files exposed via web API** - may contain OAuth tokens from error logs (#011 + #012) | ||
| - **MEDIUM: Job file retention policy not implemented** - 22 bypassPermissions files accumulating (#010) | ||
| - **MEDIUM: GitHub SSRF potential** - no URL allowlist for repository cloning (Q11) | ||
| - **LOW NEW: OAuth error logging may leak tokens** - logger.error() calls log response bodies and errors (#015) | ||
| - **LOW: Shell escaping incomplete** - missing `!` escape (#009) | ||
| - No secret detection in logs (output could leak sensitive data) - Q4 | ||
| - No rate limiting on triggers (DoS vector for scheduled jobs) - Q9 | ||
| - Session adoption privilege boundaries unclear - Q17 | ||
| - File serving cross-agent access untested - Q18 | ||
|
|
||
| ### Session Continuity | ||
|
|
||
| - **Last session:** 2026-10-26 - Incremental audit covering 144 commits (7+ months) | ||
| - **Completed:** Change analysis, hot-spot verification (WARN), file serving route review, OAuth patterns review, findings #013/#014/#015 discovered, dependency audit | ||
| - **Resume from:** Normal operations; next scheduled audit ~2026-11-02 | ||
| - **Next priority:** Document web dashboard + file serving security model (#012), fix OAuth file permissions (#013), review SDK settings validation (#014) | ||
|
|
||
| --- | ||
|
|
||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Correct the new-finding severity summary.
#015is LOW, not MEDIUM. The audit reports classify the three new findings as two MEDIUM and one LOW. Change this text to3 new findings (2 MEDIUM, 1 LOW). (raw.githubusercontent.com)