Alexandre Teixeira de8f151632 fix(security): harden trace teardown and gallery error responses ...

- CodeQL #1202 (tests/e2e/teardown.js): replace execSync shell execution with
  execFileSync, passing python executable and sanitizer arguments separately with
  shell: false. Preserve ODYSSEUS_TEST_PYTHON support, timeout handling, and
  fail-closed deletion.
- CodeQL #1203 (routes/gallery/gallery_routes.py): prevent exception information
  exposure in /api/image/edit-progress by returning a generic rejection response
  without leaking internal hostnames, IPs, resolver errors, or credentials.
- Add regression tests covering paths with spaces, metacharacters, synthetic command
  substitutions, process failure modes, fail-closed artifact purge, and SSRF
  rejection confidentiality.

2026-10-28 21:10:12 +00:00

..

admin_wipe

refactor(routes): move admin_wipe domain into routes/admin_wipe/ subpackage (#5659)

2026-07-21 12:39:27 +02:00

cleanup

refactor(routes): move cleanup domain into routes/cleanup/ subpackage (#5658)

2026-07-21 12:38:32 +02:00

compare

refactor(routes): move compare domain into routes/compare/ subpackage (#5660)

2026-07-21 12:40:09 +02:00

contacts

Squash Odysseus development history

2026-09-11 06:04:19 +00:00

document

Merge current dev and refresh PR #6738 from the 7011 integration

2026-10-26 16:21:22 +00:00

email

Merge branch 'dev' into review/pewds-pr6738-terra-20261027

2026-10-27 18:12:05 +00:00

gallery

fix(security): harden trace teardown and gallery error responses

2026-10-28 21:10:12 +00:00

history

fix(history): reject implicit and coerced truncation targets (#6565)

2026-10-14 08:41:38 +01:00

mcp

fix(security): stop the agent from re-enabling tools an admin disabled (#6357)

2026-10-27 22:50:35 -06:00

memory

feat(settings): opt-in reasoning effort for utility model calls (#6572)

2026-10-13 21:02:16 +01:00

note

Squash Odysseus development history

2026-09-11 06:04:19 +00:00

research

feat(security): apply audited PR #6738 remediations and test hardening

2026-10-27 17:25:25 +00:00

search

fix(harness): ship coherent vendor harness cluster

2026-10-13 13:59:04 +00:00

task

fix(harness): ship coherent vendor harness cluster

2026-10-13 13:59:04 +00:00

vault

feat(runtime): bind remote and owned resources to authority

2026-10-02 03:00:46 +01:00

webhook

refactor(routes): move webhook domain into routes/webhook/ subpackage (#5781)

2026-08-03 20:44:31 +02:00

__init__.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

_validators.py

fix(hwfit): validate remote SSH detection targets (#3718)

2026-06-11 00:43:49 +02:00

admin_wipe_routes.py

refactor(routes): move admin_wipe domain into routes/admin_wipe/ subpackage (#5659)

2026-07-21 12:39:27 +02:00

api_token_routes.py

fix(api): normalize non-object JSON bodies to empty dict in token PATCH (#3976)

2026-06-15 18:05:15 +01:00

assistant_routes.py

fix(harness): ship coherent vendor harness cluster

2026-10-13 13:59:04 +00:00

auth_routes.py

fix(auth): honor AUTH_ENABLED=false in admin-gated app-config routes (#6029)

2026-10-14 09:47:57 +01:00

backup_routes.py

fix(memory): don't let an unreadable store get overwritten with an empty one (#5831)

2026-08-06 02:33:50 -06:00

calendar_routes.py

feat(harness): authority, turn contract, tools, clean_agent_preview

2026-10-13 13:41:53 +00:00

chat_helpers.py

fix(editor): resolve preview authorization and CI regressions

2026-10-28 00:31:42 +00:00

chat_routes.py

Merge branch 'dev' into review/pewds-pr6738-terra-20261027

2026-10-27 18:12:05 +00:00

chatgpt_subscription_routes.py

feat(provider): support multiple ChatGPT subscriptions with usage

2026-09-22 13:12:19 +01:00

cleanup_routes.py

refactor(routes): move cleanup domain into routes/cleanup/ subpackage (#5658)

2026-07-21 12:38:32 +02:00

codex_routes.py

feat(agent): expose chat history with existing chat scope (#6443)

2026-10-23 13:18:49 -06:00

compare_routes.py

refactor(routes): move compare domain into routes/compare/ subpackage (#5660)

2026-07-21 12:40:09 +02:00

contacts_routes.py

Merge remote-tracking branch 'origin/dev'

2026-07-07 00:51:34 +00:00

cookbook_helpers.py

Squash Odysseus development history

2026-09-11 06:04:19 +00:00

cookbook_output.py

fix(cookbook): report dead finished downloads as completed instead of stopped (#4025)

2026-06-15 15:26:55 +09:00

cookbook_routes.py

fix(harness): ship coherent vendor harness cluster

2026-10-13 13:59:04 +00:00

copilot_routes.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

device_flow.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

diagnostics_routes.py

feat(ui): add real-time diagnostic logs console (#974)

2026-06-15 10:32:51 +02:00

document_helpers.py

refactor(routes): move document domain into routes/document/ subpackage (#5885)

2026-08-04 03:54:55 -06:00

document_routes.py

refactor(routes): move document domain into routes/document/ subpackage (#5885)

2026-08-04 03:54:55 -06:00

editor_agent_routes.py

merge(dev): reconcile photo editor security and upstream changes

2026-10-28 19:30:08 +00:00

editor_draft_routes.py

fix(review): harden scholarly redirects, editor draft limits, and threat model

2026-09-23 12:53:06 +01:00

email_helpers.py

Preserve preview harness, editor, email and task improvements

2026-10-01 01:34:26 +00:00

email_pollers.py

refactor(routes): move the email modules into routes/email/

2026-09-29 18:21:18 +02:00

email_routes.py

Preserve preview harness, editor, email and task improvements

2026-10-01 01:34:26 +00:00

embedding_routes.py

feat(paths): abstract runtime path logic for frozen distribution packages (#969)

2026-06-15 17:44:10 +01:00

emoji_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

font_routes.py

Keep compact font family names together (#1263)

2026-06-03 14:24:30 +09:00

gallery_helpers.py

Merge dev into main for testing

2026-06-28 14:07:23 +00:00

gallery_routes.py

Merge dev into main for testing

2026-06-28 14:07:23 +00:00

history_routes.py

refactor(routes): move history domain into routes/history/ subpackage (#5090)

2026-07-04 13:36:35 +02:00

hwfit_routes.py

feat(photo-editor): NL editor planner, image ops, email/gallery server

2026-10-15 11:57:00 +00:00

mcp_routes.py

refactor(routes): move mcp domain into routes/mcp/ subpackage (#5899)

2026-08-11 02:24:55 -06:00

memory_routes.py

refactor(routes): move memory domain into routes/memory/ subpackage (#5007)

2026-06-30 17:52:14 +02:00

model_routes.py

fix(security): stop the agent from re-enabling tools an admin disabled (#6357)

2026-10-27 22:50:35 -06:00

note_routes.py

refactor(routes): move note domain into routes/note/ subpackage (#5236)

2026-07-20 13:52:30 +02:00

personal_routes.py

fix(runtime): enforce workspace confinement in one place

2026-10-01 19:45:59 +02:00

prefs_routes.py

refactor(model-routing): centralize explicit foreground fallback policy (#6020)

2026-08-14 08:10:30 +01:00

preset_routes.py

Squash Odysseus development history

2026-09-11 06:04:19 +00:00

research_routes.py

refactor(routes): move research domain into routes/research/ subpackage

2026-06-28 14:34:11 +01:00

search_routes.py

refactor(routes): move search domain into routes/search/ subpackage (#5779)

2026-07-28 22:26:29 +02:00

session_routes.py

Merge current dev and refresh PR #6738 from the 7011 integration

2026-10-26 16:21:22 +00:00

shell_routes.py

Merge current dev and refresh PR #6738 from the 7011 integration

2026-10-26 16:21:22 +00:00

signature_routes.py

Constrain signature uploads to PNG data (#2844)

2026-06-05 13:17:43 +02:00

skills_routes.py

refactor(skills): extract evaluation and audit orchestration (#6711)

2026-10-15 09:30:16 +01:00

stt_routes.py

refactor(uploads): centralize upload byte-limits in upload_limits.py (#3364) (#3518)

2026-06-09 01:24:30 +02:00

task_routes.py

refactor(routes): move task domain into routes/task/ subpackage

2026-08-17 10:07:17 +08:00

tts_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

upload_routes.py

fix(upload): honor no-login mode after account setup (#6528)

2026-10-15 11:08:58 +01:00

vault_routes.py

refactor(routes): move vault domain into routes/vault/ subpackage (#5780)

2026-08-03 20:44:00 +02:00

webhook_routes.py

refactor(routes): move webhook domain into routes/webhook/ subpackage (#5781)

2026-08-03 20:44:31 +02:00

workspace_routes.py

Squash Odysseus development history

2026-09-11 06:04:19 +00:00