Verify User 17b8a9a561 fix(security): canonicalize Claude image attachment reads ...

Resolve image attachment paths with realpath before reading so symlinks inside allowed roots cannot escape to arbitrary files. Preserve support for symlinked project/upload roots and skip invalid descriptors instead of failing the provider turn.

2026-07-06 23:24:17 +03:00

..

constants

Refactor WebSocket context + centralize platform flag (#363)

2026-02-03 10:05:15 +01:00

middleware

Refactor provider/session architecture to be DB-driven, modular, and sessionId-first across backend and frontend (#715)

2026-04-30 08:19:26 +02:00

modules

fix: address code review findings

2026-07-06 21:08:22 +03:00

routes

fix: remove gemini support since google discontinued it

2026-07-06 17:01:29 +03:00

services

feat: add Electron desktop app

2026-06-29 09:37:21 +00:00

shared

fix(security): canonicalize Claude image attachment reads

2026-07-06 23:24:17 +03:00

utils

feat(git): commit graph in history view and cross-spawn everywhere

2026-07-06 16:09:39 +03:00

browser-use-mcp.ts

Add browser use as MCP to providers (#889)

2026-06-17 22:06:17 +02:00

claude-sdk.js

feat: support attached images for all providers

2026-07-06 13:32:06 +03:00

cli.js

fix: remove gemini support since google discontinued it

2026-07-06 17:01:29 +03:00

cursor-cli.js

fix: address code scanning findings

2026-07-06 21:22:30 +03:00

index.js

fix: remove gemini support since google discontinued it

2026-07-06 17:01:29 +03:00

load-env.js

feat: add Electron desktop app

2026-06-29 09:37:21 +00:00

openai-codex.js

feat: support attached images for all providers

2026-07-06 13:32:06 +03:00

opencode-cli.js

feat(git): commit graph in history view and cross-spawn everywhere

2026-07-06 16:09:39 +03:00

opencode-cli.test.js

feat(opencode): support permission options

2026-07-06 15:04:17 +03:00

tsconfig.json

feat: introduce opus 4.7 (#682)

2026-04-21 18:26:25 +02:00

voice-proxy.js

fix: voice tts format settings (#919)

2026-06-26 16:06:40 +02:00