Haileyesus baf45b7282 fix(security): canonicalize Claude image attachment reads ...

Resolve image attachment paths with realpath before reading so symlinks
inside allowed roots cannot escape to arbitrary files. Preserve support for
symlinked project/upload roots and add focused coverage for both cases.

2026-07-06 23:03:52 +03:00

..

constants

…

middleware

Refactor provider/session architecture to be DB-driven, modular, and sessionId-first across backend and frontend (#715)

2026-04-30 08:19:26 +02:00

modules

fix: address code review findings

2026-07-06 21:08:22 +03:00

routes

fix: remove gemini support since google discontinued it

2026-07-06 17:01:29 +03:00

services

feat: add Electron desktop app

2026-06-29 09:37:21 +00:00

shared

fix(security): canonicalize Claude image attachment reads

2026-07-06 23:03:52 +03:00

utils

feat(git): commit graph in history view and cross-spawn everywhere

2026-07-06 16:09:39 +03:00

browser-use-mcp.ts

Add browser use as MCP to providers (#889)

2026-06-17 22:06:17 +02:00

claude-sdk.js

feat: support attached images for all providers

2026-07-06 13:32:06 +03:00

cli.js

fix: remove gemini support since google discontinued it

2026-07-06 17:01:29 +03:00

cursor-cli.js

fix: address code scanning findings

2026-07-06 21:22:30 +03:00

index.js

fix: remove gemini support since google discontinued it

2026-07-06 17:01:29 +03:00

load-env.js

feat: add Electron desktop app

2026-06-29 09:37:21 +00:00

openai-codex.js

feat: support attached images for all providers

2026-07-06 13:32:06 +03:00

opencode-cli.js

feat(git): commit graph in history view and cross-spawn everywhere

2026-07-06 16:09:39 +03:00

opencode-cli.test.js

feat(opencode): support permission options

2026-07-06 15:04:17 +03:00

tsconfig.json

…

voice-proxy.js

fix: voice tts format settings (#919)

2026-06-26 16:06:40 +02:00