helm/ulysses
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ulysses/src
History
Michael 3d75fad52f
fix(security): apply sensitive-file deny-list to grep tool (#5011) (#5013) 
The grep tool bypassed the sensitive-file deny-list that read_file,
write_file, and edit_file all respect. Two code paths fixed:

1. ripgrep path: adds --glob exclusion patterns for each entry in
   _SENSITIVE_FILE_PATTERNS (id_rsa, known_hosts, authorized_keys, etc.)
2. Pure-Python os.walk fallback: checks _is_sensitive_path() before
   opening each file, skipping files that match the deny-list

Fixes #5011

Co-authored-by: michaelxer <michaelxer@users.noreply.github.com>
2026-06-30 17:44:45 +01:00
..
agent_tools fix(security): apply sensitive-file deny-list to grep tool (#5011) (#5013) 2026-06-30 17:44:45 +01:00
search refactor(search): make src analytics a service shim (#2264) 2026-06-04 18:57:24 +02:00
tools refactor(tools): split tool_implementations.py into src/tools/ package (#4423) 2026-06-26 15:40:04 +01:00
action_intents.py fix(agent): honor explicit web search requests 2026-06-15 15:02:10 +09:00
agent_loop.py fix(security): prevent ReDoS in verdict-prose and continuation matchers (#4943) 2026-06-28 11:42:20 +01:00
agent_runs.py Agent stream: 10s heartbeat keepalive on the SSE subscribe so long-running thinking models dont drop the connection 2026-06-19 00:34:30 +00:00
ai_interaction.py fix(ai): offload model resolution from async paths 2026-06-28 00:48:35 +01:00
api_key_manager.py fix: use atomic write in APIKeyManager.save() to prevent credential data loss (#4591) (#4597) 2026-06-23 23:28:53 +02:00
app_helpers.py fix(routes): log and cleanly 500 on unreadable HTML page (#4637) 2026-06-23 16:12:32 +02:00
app_initializer.py fix(health): report unhealthy memory vector store as degraded 2026-06-27 22:25:13 +01:00
assistant_log.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
auth_helpers.py fix(auth): gate api tokens from user routes (#2992) 2026-06-07 12:55:01 +02:00
bg_jobs.py feat(agent): add manage_bg_jobs tool to inspect and kill background bash jobs (#4577) 2026-06-19 00:28:22 -07:00
bg_monitor.py fix: drop thinking deltas from background agent loops 2026-06-15 15:03:09 +09:00
builtin_actions.py fix(cookbook): preserve scheduled serve server metadata (#4545) 2026-06-27 16:48:53 +01:00
builtin_mcp.py fix(mcp): retain builtin startup tasks and reap npx probe 2026-06-28 01:18:17 +01:00
caldav_sync.py fix(calendar): keep imported events with non-positive duration visible (#4484) 2026-06-27 16:52:40 +02:00
caldav_writeback.py Harden CalDAV write-back with retries (#1193) 2026-06-15 15:59:31 +09:00
chat_handler.py Scope vision model resolution by owner (#3009) 2026-06-07 12:39:02 +02:00
chat_helpers.py fix(chat): keep balanced trailing ')' when extracting URLs (#3406) 2026-06-08 21:33:29 +02:00
chat_processor.py fix(chat): sanitize web search query to strip markdown and code blocks (#4863) 2026-06-28 01:23:08 +01:00
chatgpt_subscription.py Fix model endpoint route test regressions 2026-06-09 10:16:38 +09:00
chroma_client.py fix: ChromaDB unreachable blocks app startup for 30-60s (#326) (#476) 2026-06-01 22:22:41 +09:00
cleanup_service.py Replace cleanup service datetime.utcnow calls (#1494) 2026-06-03 14:14:27 +09:00
config.py feat(paths): abstract runtime path logic for frozen distribution packages (#969) 2026-06-15 17:44:10 +01:00
constants.py Merge origin/dev into main 2026-06-21 11:08:50 +00:00
context_budget.py Ignore invalid context budget numbers (#1831) 2026-06-29 19:56:17 +01:00
context_compactor.py fix(research): keep Discuss chats grounded on their report (#4006) 2026-06-15 20:31:57 +09:00
cookbook_serve_lifecycle.py fix(cookbook): only persist successfully stopped scheduled serves (#4267) 2026-06-15 17:30:18 +02:00
copilot.py feat(provider): add GitHub Copilot provider with device-flow auth (#1480) 2026-06-04 21:13:14 +02:00
database.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
deep_research.py fix(research): track analyzed URLs separately (#3125) 2026-06-10 12:08:22 +01:00
document_actions.py fix: document tidy crashes on a duplicate with NULL timestamps (#1772) 2026-06-03 13:23:01 +09:00
document_processor.py Settings overhaul + UI polish pass 2026-06-10 15:15:13 +09:00
email_thread_parser.py Ignore non-string email thread bodies (#1654) 2026-06-03 14:06:31 +09:00
embedding_lanes.py fix(embeddings): survive numpy embeddings when restoring a reset lane (#3410) 2026-06-09 10:40:17 +02:00
embeddings.py Retry oversized embedding requests (#1106) 2026-06-26 14:21:27 +01:00
endpoint_resolver.py Merge origin/dev into main 2026-06-21 11:08:50 +00:00
event_bus.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
exceptions.py refactor(exceptions): dedupe src/exceptions via core re-export (#4785) 2026-06-24 16:50:07 +02:00
generated_images.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
goal_based_extractor.py fix(deep-research): wrap fetched webpage content in untrusted-context sandbox 2026-06-06 03:37:10 -06:00
integrations.py fix(endpoints): normalize URL handling (#4338) 2026-06-16 03:59:18 +01:00
llm_core.py fix(llm): normalize OpenAI-compatible chat URLs 2026-06-28 15:30:15 +01:00
markitdown_runtime.py Settings overhaul + UI polish pass 2026-06-10 15:15:13 +09:00
mcp_manager.py feat(paths): abstract runtime path logic for frozen distribution packages (#969) 2026-06-15 17:44:10 +01:00
mcp_oauth.py feat(mcp): add Streamable HTTP transport with OAuth 2.0 (#1033) 2026-06-05 02:40:52 +02:00
memory.py refactor(memory): canonicalize memory imports (#50) 2026-06-04 05:31:15 +01:00
memory_provider.py feat(memory): add provider interface (#72) 2026-06-04 16:26:11 +01:00
memory_vector.py fix: split Chroma embedding lanes (#3046) 2026-06-06 03:17:19 -06:00
model_context.py fix(llm): add default context window lengths for Xiaomi Mimo 2.5 models (#4579) 2026-06-27 16:43:00 +01:00
model_discovery.py fix(models): accept bare-list /models responses (Together AI) (#4761) 2026-06-27 16:25:15 +01:00
office_doc.py Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
optional_deps.py fix(image): patch realesrgan torchvision compatibility (#4110) 2026-06-15 15:16:41 +09:00
pdf_form_doc.py refactor(tools): extract document tools to handle registry (#3666) 2026-06-10 10:41:52 +02:00
pdf_forms.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
pdf_runtime.py Show a clear message when PyMuPDF is missing 2026-06-01 18:27:17 +09:00
personal_docs.py Ignore non-string personal doc text (#1832) 2026-06-29 19:24:29 +01:00
preset_manager.py fix(presets): persist presets atomically to avoid corruption on crash (#2169) 2026-06-08 19:16:37 +02:00
prompt_security.py Isolate untrusted context from visible user prompts (#3584) 2026-06-27 13:50:04 +01:00
rag_manager.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
rag_singleton.py feat(paths): abstract runtime path logic for frozen distribution packages (#969) 2026-06-15 17:44:10 +01:00
rag_vector.py fix(auth): clean up rename and null-owner ownership (#4340) 2026-06-16 03:33:02 +01:00
rate_limiter.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
readiness.py feat: add /api/ready readiness probe (DB, data dir, local-first) (#1200) 2026-06-02 23:33:22 +09:00
reminder_personas.py Settings overhaul + UI polish pass 2026-06-10 15:15:13 +09:00
request_models.py Odysseus v1.0 2026-05-31 23:58:26 +09:00
research_handler.py fix(research): migrate active task owners on rename (#3618) 2026-06-11 01:17:02 +02:00
research_utils.py Treat non-string research summaries as low quality 2026-06-03 13:42:24 +09:00
runtime_paths.py feat(paths): abstract runtime path logic for frozen distribution packages (#969) 2026-06-15 17:44:10 +01:00
secret_storage.py refactor(constants): single source of truth for data dir (#3368) 2026-06-08 09:58:52 +02:00
service_health.py feat(diagnostics): add consolidated service health endpoint for degraded-state reporting (#964) 2026-06-09 16:00:24 +01:00
session_actions.py fix(sessions): keep fresh chats during auto tidy (#1871) 2026-06-09 01:06:20 +01:00
session_search.py fix(search): batch FTS hit lookups into one query (N+1) (#3909) 2026-06-11 16:31:54 +02:00
settings.py feat(teacher): add teacher_tier2_enabled setting and strict parser 2026-06-26 22:26:15 +05:30
settings_scrub.py fix(settings): scrub camelCase secret keys (#3707) 2026-06-11 12:53:33 +02:00
task_endpoint.py Cookbook model workflow fixes 2026-06-21 11:02:35 +00:00
task_scheduler.py fix(tasks): keep scheduled-task prompt cache stable 2026-06-28 00:05:02 +01:00
teacher_escalation.py fix(ai): offload model resolution from async paths 2026-06-28 00:48:35 +01:00
text_helpers.py fix(security): prevent ReDoS in LLM-output tool/think parsers (#4704) 2026-06-27 10:12:28 -07:00
tls_overrides.py Support extra CA bundle for private-CA LLM providers (#769) 2026-06-04 13:18:50 +01:00
tool_execution.py fix(agent): execute fenced tool calls with inline args and route bare email tool names (#3681) 2026-06-30 16:50:32 +01:00
tool_implementations.py refactor(tools): split tool_implementations.py into src/tools/ package (#4423) 2026-06-26 15:40:04 +01:00
tool_index.py fix ask-user choices across reloads (#4669) 2026-06-22 20:49:49 +02:00
tool_parsing.py fix(agent): execute fenced tool calls with inline args and route bare email tool names (#3681) 2026-06-30 16:50:32 +01:00
tool_policy.py fix(agent): enforce guide-only tool policy (#3088) 2026-06-06 18:48:24 -06:00
tool_schemas.py fix(agent): execute fenced tool calls with inline args and route bare email tool names (#3681) 2026-06-30 16:50:32 +01:00
tool_security.py fix(agent): execute fenced tool calls with inline args and route bare email tool names (#3681) 2026-06-30 16:50:32 +01:00
tool_utils.py refactor(tools): migrate config/integration admin tools to the registry (#4742) 2026-06-24 09:29:10 +02:00
topic_analyzer.py Topics: hydrate session history before analysis 2026-06-02 20:44:27 +09:00
upload_handler.py fix(upload): remove trailing whitespace 2026-06-26 18:01:04 +01:00
upload_limits.py refactor(uploads): centralize upload byte-limits in upload_limits.py (#3364) (#3518) 2026-06-09 01:24:30 +02:00
url_safety.py Reject resolver results without IPs (#1826) 2026-06-29 16:32:32 +01:00
url_security.py Reapply "Merge branch 'main' of github.com:pewdiepie-archdaemon/odysseus" 2026-06-03 22:47:00 +09:00
user_time.py fix(tasks): keep scheduled-task prompt cache stable 2026-06-28 00:05:02 +01:00
visual_report.py fix(visual_report): ignore fenced headings in TOC extraction 2026-06-27 17:44:32 +01:00
webhook_manager.py fix(webhooks): keep references to in-flight delivery tasks (#3859) 2026-06-11 15:53:52 +02:00
youtube_handler.py fix(youtube): consolidate duplicate handler 2026-06-15 15:03:41 +09:00