3 people bde0b77a86 fix(security): prevent metadata spoofing of internal job monitor flag (#1195) ...

The `__internal_job_monitor` metadata key that bypassed the entire
agent pipeline (hooks, safety checks, LLM processing) was spoofable
by external channels — WASM channel plugins could inject arbitrary
metadata including this key, causing attacker-controlled content to be
forwarded directly as assistant responses.

Replace the metadata-based check with a dedicated `is_internal` field
on `IncomingMessage` that can only be set via `into_internal()` by
trusted in-process code. Both the field and setter are `pub(crate)` to
prevent external crates from spoofing the flag. Also remove
`notify_metadata` forwarding (the monitor only needs channel/user/thread
routing) and the unused `__job_monitor_job_id` metadata key.

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

2026-03-15 21:33:04 +00:00

..

agent_loop.rs

fix(security): prevent metadata spoofing of internal job monitor flag (#1195)

2026-03-15 21:33:04 +00:00

agentic_loop.rs

feat(web): add follow-up suggestion chips and ghost text (#1156)

2026-03-14 18:57:24 +00:00

attachments.rs

feat: WASM channel attachments with LLM pipeline integration (#596)

2026-03-07 18:01:40 +00:00

CLAUDE.md

merge: resolve conflicts for PR #800 and #822 into staging (#881)

2026-03-10 11:19:23 -07:00

commands.rs

Revert "Feat/docker shell edition" + fix fmt/clippy (#886)

2026-03-10 11:57:50 -07:00

compaction.rs

Revert "Feat/docker shell edition" + fix fmt/clippy (#886)

2026-03-10 11:57:50 -07:00

context_monitor.rs

Load tools at launch

2026-02-03 00:48:22 -08:00

cost_guard.rs

fix: prevent Instant duration overflow on Windows (#657) (#664)

2026-03-07 20:00:40 +00:00

dispatcher.rs

fix(security): prevent metadata spoofing of internal job monitor flag (#1195)

2026-03-15 21:33:04 +00:00

heartbeat.rs

fix: agent logging (#888)

2026-03-10 13:55:06 -07:00

job_monitor.rs

fix(security): prevent metadata spoofing of internal job monitor flag (#1195)

2026-03-15 21:33:04 +00:00

mod.rs

style(agent): remove unnecessary Worker re-export (#923)

2026-03-12 11:29:02 -07:00

router.rs

Replace hardcoded intent patterns with job tools

2026-02-04 22:09:52 -08:00

routine_engine.rs

Fix schema-guided tool parameter coercion (#1143)

2026-03-14 16:27:18 -07:00

routine.rs

feat(routines): human-readable cron schedule summaries in web UI (#1154)

2026-03-14 13:07:05 -07:00

scheduler.rs

Fix schema-guided tool parameter coercion (#1143)

2026-03-14 16:27:18 -07:00

self_repair.rs

fix: agent logging (#888)

2026-03-10 13:55:06 -07:00

session_manager.rs

Add automated QA: schema validator, CI matrix, Docker build, and P1 test coverage (#353)

2026-02-27 09:09:45 +04:00

session.rs

fix(mcp): handle 400 auth errors, clear auth mode after OAuth, trim tokens (#1158)

2026-03-15 05:42:49 +00:00

submission.rs

feat: restart (#531)

2026-03-05 17:12:49 -08:00

task.rs

fix: persist turns after approval and add agent-level tests (#250)

2026-02-20 02:28:15 +00:00

thread_ops.rs

fix(auth): avoid false success and block chat during pending auth (#1111)

2026-03-15 07:08:06 +00:00

undo.rs

fix: persist turns after approval and add agent-level tests (#250)

2026-02-20 02:28:15 +00:00