diegosouzapw 0efaf1cca7 fix(security): post-review hardening batch — command injection, CSP, auth gaps, error sanitization, resilience ...

- plugin.mjs: replace execSync string-template with spawnSync arg-array (command injection)
- electron/main.js: gate unsafe-eval on !app.isPackaged instead of URL substring; merge duplicate connect-src
- budget/bulk, resilience/reset: add requireManagementAuth guard
- gemini-web, claude-web, copilot-web executors: route catch-block messages through sanitizeErrorMessage
- oauth route, agents/tasks routes: route catch-block errors through sanitizeErrorMessage
- codex.ts: return null (not error-object) from refreshCredentials on failure
- tokenRefresh.ts: safe unknown-error access in catch block
- combo.ts: reset exhaustedProviders per set-retry iteration so providers get a second chance
- circuitBreaker.ts: persist and restore lastFailureKind via options JSON column

2026-05-20 11:11:13 -03:00

..

cli

fix(security): post-review hardening batch — command injection, CSP, auth gaps, error sanitization, resilience

2026-05-20 11:11:13 -03:00

mcp-server.mjs

node dependency updates (#2259)

2026-05-14 20:20:54 -03:00

nodeRuntimeSupport.mjs

fix(infrastructure): move wreq-js to optionalDependencies and add Node 25/26 to secure runtime policy (#1924)

2026-05-04 02:03:20 -03:00

omniroute.mjs

Release/v3.8.0 (#2430)

2026-05-20 09:12:49 -03:00

reset-password.mjs

Release/v3.8.0 — full changelog with 660+ commits (#2419)

2026-05-20 02:05:50 -03:00