Xiangzhe 50f5cecb80 fix(security): don't auto-adopt an unverified listener on a service port ...

decidePreSpawn adopted any listener that returned a 2xx on the health path, so a
local process that squats an embedded-service port before the supervisor starts
it would be adopted — receiving the injected service API key and script execution
inside the dashboard origin. Adoption is now opt-in
(OMNIROUTE_ADOPT_EXISTING_SERVICE=1); by default a healthy-but-unverified listener
yields the same actionable error as a held-but-unhealthy port. The embedded-UI CSP
hardening (strict embed CSP / the dead scriptSrc ternary) is a separate follow-up.

Reported by @rafaelfiguereod-stack via GHSA-wg9p-6m2g-4v27.

2026-08-21 14:49:31 -03:00

..

app

fix(security): mask the Obsidian WebDAV password from non-management callers

2026-08-21 14:49:30 -03:00

domain

fix(domain): treat unreported Antigravity quota fraction as unknown, not exhausted (#10095)

2026-08-20 20:29:38 -03:00

hooks

fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn (#10452)

2026-08-18 10:50:26 -03:00

i18n

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

lib

fix(security): don't auto-adopt an unverified listener on a service port

2026-08-21 14:49:31 -03:00

middleware

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

mitm

fix(agent-bridge): make the regenerate-cert endpoint actually mint a new cert (#10467) (#10715)

2026-08-20 06:28:41 -03:00

models

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

scripts

feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)

2026-05-04 19:25:41 -03:00

server

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00

shared

fix(security): enforce per-key policy for a bare x-api-key (allowedModels bypass)

2026-08-21 14:49:30 -03:00

sse

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

store

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

types

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

instrumentation-node.ts

fix(startup): log when credential health check is disabled (#11016) (#11021)

2026-08-21 14:00:27 -03:00

instrumentation.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

proxy.ts

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00