jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-31 18:22:22 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,789 Commits 16 Branches 0 Tags
a8e0ff1c8e1b8a288432b94ab2d004ae3f841e92
Commit Graph
2789 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alexandre Teixeira 5c542d03ac Merge remote-tracking branch 'origin/dev' into fix/pr-6080-llama-recovery 2026-10-30 13:02:47 +00:00
red person 4fe8fb28e5 test: isolate photo routing from external MCP registry state 2026-10-29 23:45:05 +03:00
red person 84e232e7ee fix(cache): retain the upstream worker key format 2026-10-29 23:42:25 +03:00
red person 2cace27723 test: isolate photo routing from external MCP registry state 2026-10-29 23:40:25 +03:00
red person 508c7b3d9d Merge current dev into PR 6932 2026-10-29 23:28:45 +03:00
red person 5b8a72931d Merge current dev into PR 6934 2026-10-29 23:28:28 +03:00
red person 2e7edf908d Merge current dev into PR 6935 2026-10-29 23:27:57 +03:00
red person b80f9afb3e Merge current dev into PR 6943 2026-10-29 23:27:34 +03:00
red person 533d48ad8d Merge current dev into Compare SSE fix 2026-10-29 23:26:15 +03:00
red person d5bc7fb70e Merge current dev into group peer history fix 2026-10-29 23:21:20 +03:00
Alexandre Teixeira 3b8c60ac1e test: check database ownership against the private temp namespace 2026-10-29 17:49:45 +00:00
Alexandre Teixeira d237c3fbba perf(tests): reuse immutable admin auth configuration 2026-10-29 17:35:59 +00:00
Alexandre Teixeira f510b1973a perf(tests): bound Notes server descendant cleanup 2026-10-29 17:35:52 +00:00
Alexandre Teixeira fe81c491cd test: give collection database URL one cleanup owner 2026-10-29 17:30:10 +00:00
Alexandre Teixeira 1339efa856 test: restore editor aliases and validate procfs guard control flow 2026-10-29 17:12:26 +00:00
Alexandre Teixeira 6f5c28b345 test: require real cold reads, cancellation and auth writes 2026-10-29 17:12:20 +00:00
Alexandre Teixeira aa2db8d87c test: keep worker collection databases consistent across threads 2026-10-29 17:12:14 +00:00
RaresKeY 8b8fc62449 fix(docker): require the patched Debian Brotli decoder (#6956) 
* fix(docker): require the patched Debian Brotli decoder

Refresh the signed Debian native Brotli package in a shared build-stage base and fail builds below the security backport floor. Verify the actual selected library, native fix marker, valid decoding, and distro Node linkage before accepting the runtime.

* fix(docker): guard HTTPS trust and accept Bookworm Brotli

Check the inherited system CA store before the shared base makes its first HTTPS package request. Accept the exact fixed Debian 12 marker alongside Debian 13 while retaining package floors, decoder ownership, and valid decoding controls.

* fix(docker): preserve Brotli gate diagnostics
 2026-10-29 15:05:58 +01:00
Alexandre Teixeira 0f996f58da Merge pull request #6972 from odysseus-dev/test/env-reference-cli-fixture-performance 
test: isolate environment-reference CLI state transitions
 2026-10-29 10:31:08 +00:00
Alexandre Teixeira 18329268b0 Merge pull request #6974 from odysseus-dev/test/import-stub-guard-snapshot-performance 
test: avoid tuple-list allocation in the import-stub guard
 2026-10-29 10:30:50 +00:00
Alexandre Teixeira 6cc98f34b8 Merge pull request #6740 from odysseus-dev/codex/review-7011-preview-ui-20261015 
fix(ui): integrate streaming, model picker and Notes updates
 2026-10-29 10:29:51 +00:00
Alexandre Teixeira c493a66101 Merge pull request #6960 from odysseus-dev/test/remove-duplicate-editor-cache-check 
test: remove duplicate editor cache-name check
 2026-10-29 10:28:06 +00:00
Alexandre Teixeira d5949c0286 Merge pull request #6961 from odysseus-dev/test/restore-regression-test-sensitivity 
test: restore active-document and owner-isolation sensitivity
 2026-10-29 10:26:18 +00:00
Alexandre Teixeira 9ec897d947 Merge pull request #6964 from odysseus-dev/test/imap-concurrent-delete-regression 
test: simulate concurrent IMAP deletion at the protocol boundary
 2026-10-29 10:25:48 +00:00
Alexandre Teixeira 9257f0e6d0 Merge pull request #6965 from odysseus-dev/test/admin-route-authorization-regressions 
test: enforce behavioral admin authorization on listings and diagnostics
 2026-10-29 10:25:36 +00:00
Alexandre Teixeira a334a21d57 Merge pull request #6967 from odysseus-dev/test/chat-document-owner-context 
test: protect chat document context owner boundaries
 2026-10-29 10:24:53 +00:00
Alexandre Teixeira 87ef52f7cc test: avoid tuple-list allocation in the import-stub guard 2026-10-29 08:54:46 +00:00
Alexandre Teixeira 25617a8c10 test: isolate environment-reference CLI state transitions 2026-10-29 08:44:19 +00:00
Alexandre Teixeira 4992cc620f test: protect chat document context owner boundaries 2026-10-29 02:09:37 +00:00
Alexandre Teixeira 59cca6b915 fix(upload): canonicalize confinement on symlinked upload roots 2026-10-29 02:02:47 +00:00
Alexandre Teixeira 1ddda10716 test: exercise real admin gates before listing data 2026-10-29 01:58:21 +00:00
Alexandre Teixeira 958848f9f8 test: interleave concurrent IMAP deletion before expunge 2026-10-29 01:51:41 +00:00
Alexandre Teixeira 571ac09cea fix(security): sanitize file_id and enforce strict prefix confinement on upload paths 2026-10-29 01:39:41 +00:00
Alexandre Teixeira f979e5602f fix(upload,sw): sanitize and confine upload paths and align service worker precache token 2026-10-29 01:35:07 +00:00
Alexandre Teixeira 0f95032177 test: restore active-document and owner-isolation sensitivity 2026-10-29 01:29:04 +00:00
Alexandre Teixeira b3e2e628ab fix(upload,ui): confine thumbnail paths and align stylesheet cache-bust token 2026-10-29 01:25:07 +00:00
Alexandre Teixeira f1a45e85c5 test: remove duplicate editor cache-name assertion 2026-10-29 01:19:32 +00:00
Alexandre Teixeira f843a3dc01 merge(dev): integrate latest upstream dev (PR #6498 omit temperature from subscription requests) 2026-10-29 01:12:31 +00:00
Alexandre Teixeira 72ba37af6b merge(dev): integrate reviewed preview UI changes 2026-10-29 01:12:08 +00:00
Raul JuarezandRaul 5bf4524618 fix(chatgpt): omit temperature from subscription requests (#6498) 
Co-authored-by: Raul <9117159+raultcj@users.noreply.github.com>
 2026-10-29 01:34:52 +01:00
Alexandre Teixeira 1a7c79946b Merge pull request #6741 from odysseus-dev/codex/review-7011-photo-editor-20261015 
feat(editor): integrate layer tools, document tabs and editor UI
 2026-10-28 21:27:53 +00:00
Alexandre Teixeira 6d102a213f fix(security): confine teardown paths and avoid interpolating exception data in logs 
- routes/gallery/gallery_routes.py: use stable diagnostic log message without
  interpolating raw exception, resolver details, tokens, or destination strings.
- tests/e2e/teardown.js: remove environment-variable path overrides from production
  code, strictly confine test options and temp directories, and prevent arbitrary
  directory cleanup.
- Add regression tests covering non-leakage of synthetic tokens/queries/exceptions
  into logs and responses, and path confinement during teardown.
 2026-10-28 21:14:43 +00:00
Alexandre Teixeira de8f151632 fix(security): harden trace teardown and gallery error responses 
- CodeQL #1202 (tests/e2e/teardown.js): replace execSync shell execution with
  execFileSync, passing python executable and sanitizer arguments separately with
  shell: false. Preserve ODYSSEUS_TEST_PYTHON support, timeout handling, and
  fail-closed deletion.
- CodeQL #1203 (routes/gallery/gallery_routes.py): prevent exception information
  exposure in /api/image/edit-progress by returning a generic rejection response
  without leaking internal hostnames, IPs, resolver errors, or credentials.
- Add regression tests covering paths with spaces, metacharacters, synthetic command
  substitutions, process failure modes, fail-closed artifact purge, and SSRF
  rejection confidentiality.
 2026-10-28 21:10:12 +00:00
Alexandre Teixeira cce5892eeb test(css): update approved photo editor visual baseline 
Record the Product Owner-approved 13 element changes across 48 page/variant
combinations for PR #6741. The regenerated baseline exactly matches the
visually reviewed candidate; retain the upstream PR #6840 sidebar styles.

Validation: 49 CSS snapshot/layout tests and 26 frontend/mobile browser tests.
Visual acceptance evidence remains outside the repository.
 2026-10-28 20:56:09 +00:00
Alexandre Teixeira f4e3ae6e68 test(security): allowlist synthetic dummy api key in trace sanitizer test fixture 
- Add gitleaks allowlist rule for synthetic test string in tests/test_trace_artifact_sanitizer.py
- Resolves Gitleaks generic-api-key false positive on GitHub Actions CI
 2026-10-28 19:52:10 +00:00
Alexandre Teixeira 671cbd79ac merge(dev): integrate latest upstream dev (PR #6840 sidebar animations) 
- Merge upstream/dev at 0116f0a62b
- Incorporate upstream sidebar toggle animation and auto-collapse measurement fixes
- Preserve upstream CSS snapshot baseline in tests/css_snapshot/baseline.json
- Retain all PR #6741 photo-editor features, security controls, and mobile fixes
 2026-10-28 19:30:57 +00:00
Alexandre Teixeira 2e1c2a343a merge(dev): reconcile photo editor security and upstream changes 
- Reconcile conflict resolution in routes/editor_agent_routes.py and src/editor_agent_model.py
- Enforce strict server-authorized endpoint resolution and reject client URL overrides
- Enforce bearer-token privilege separation: delegated API tokens are capped at non-admin scope per src/tool_security.py and cannot inspect private base URLs or probe metadata
- Preserve chat-scope authorization, missing-session 401 rejection, and owner-scoped browser bridge/SSE queues
- Preserve administrator-disabled-tool denylist enforcement introduced by PR #6357
- Fix mobile toolbar flyout hit-testing and stacking context trapping on viewports <= 700px via scoped elevation and mask suppression
- Stabilize project recovery test fixture by awaiting document draft quiescence prior to baseline capture
 2026-10-28 19:30:08 +00:00
Alexandre Teixeira 0116f0a62b Merge pull request #6840 from eesoymilk/fix/sidebar-toggle-animation 
fix(sidebar): animate the sidebar toggle instead of snapping
 2026-10-28 18:15:15 +00:00
Alexandre Teixeira c237a1cb9c feat(editor): harden photo editor security and interactions 2026-10-28 17:37:10 +00:00
dxrpl 6b284d2bc5 test(gallery): enable local image models in the bad-input test 2026-10-28 18:27:00 +01:00