Teknium 3a7907b278 fix(security): prevent zip-slip path traversal in self-update (#3250) ...

Validate each ZIP member's resolved path against the extraction directory
before extracting. A crafted ZIP with paths like ../../etc/passwd would
previously write outside the target directory.

Fixes #3075

Co-authored-by: Hiren <hiren.thakore58@gmail.com>

2026-03-26 13:40:37 -07:00

..

__init__.py

chore: release v0.4.0 (v2026.3.23)

2026-03-23 22:34:04 -07:00

auth.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

banner.py

refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)

2026-03-25 15:54:28 -07:00

callbacks.py

refactor(cli): implement approval locking mechanism to serialize concurrent requests

2026-03-13 23:59:18 -07:00

checklist.py

fix: skip hanging tests + add global test timeout

2026-03-12 01:23:28 -07:00

claw.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

clipboard.py

fix: clean up empty file after failed wl-paste clipboard extraction

2026-03-11 02:56:19 -07:00

codex_models.py

fix: add codex forward-compat model listing

2026-03-13 21:34:01 -07:00

colors.py

Revert "feat(cli): skin-aware light/dark theme mode with terminal auto-detection"

2026-03-17 10:04:53 -07:00

commands.py

refactor: remove /model slash command from CLI and gateway (#3080)

2026-03-25 17:03:05 -07:00

config.py

refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)

2026-03-25 15:54:28 -07:00

copilot_auth.py

chore: remove ~100 unused imports across 55 files (#3016)

2026-03-25 15:02:03 -07:00

cron.py

docs: clarify gateway service scopes (#1378)

2026-03-14 21:17:41 -07:00

curses_ui.py

refactor: extract shared curses checklist, fix skill discovery perf

2026-03-11 03:06:15 -07:00

default_soul.py

fix: reset default SOUL.md to baseline identity text (#3159)

2026-03-26 01:34:27 -07:00

doctor.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

env_loader.py

chore: remove ~100 unused imports across 55 files (#3016)

2026-03-25 15:02:03 -07:00

gateway.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

main.py

fix(security): prevent zip-slip path traversal in self-update (#3250)

2026-03-26 13:40:37 -07:00

mcp_config.py

chore: remove ~100 unused imports across 55 files (#3016)

2026-03-25 15:02:03 -07:00

model_switch.py

chore: remove ~100 unused imports across 55 files (#3016)

2026-03-25 15:02:03 -07:00

models.py

feat(models): add glm-5-turbo to zai provider model list (#3095)

2026-03-25 17:42:25 -07:00

pairing.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

plugins_cmd.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

plugins.py

revert: remove trailing empty assistant message stripping

2026-03-22 04:55:34 -07:00

runtime_provider.py

fix(auth): preserve 'custom' provider instead of silently remapping to 'openrouter'

2026-03-24 06:41:11 -07:00

setup.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

skills_config.py

chore: remove ~100 unused imports across 55 files (#3016)

2026-03-25 15:02:03 -07:00

skills_hub.py

fix(skills): preserve trust for skills-sh identifiers + reduce resolution churn (#3251)

2026-03-26 13:40:21 -07:00

skin_engine.py

refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)

2026-03-25 15:54:28 -07:00

status.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00

tools_config.py

fix: MCP toolset resolution for runtime and config (#3252)

2026-03-26 13:39:41 -07:00

uninstall.py

chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)

2026-03-25 19:47:58 -07:00