Apply upstream security hardening (parent PR #29) + cross-platform fixes - #2

Merged

cbeaulieu-gt merged 5 commits into

security/apply-upstream-pr29

Jun 22, 2026

Commits on Jun 21, 2026

fix: harden security — patch 7 critical and 3 high vulnerabilities

Dng
authored and
cbeaulieu-gt
committed
b050ade
fix: cross-platform path containment + harden reveal endpoint

cbeaulieu-gt
and
claude
committed
f84d194
fix: address Codex PR review — close projectDir & SSR-XSS bypasses, harden shutdown

cbeaulieu-gt
and
claude
committed
d2fbab1
fix: restore project-file reads via home-dir boundary (Codex re-review)

cbeaulieu-gt
and
claude
committed
f831b64

Commits on Jun 22, 2026

fix: preserve MCP disabled flag through import (Codex P2)

cbeaulieu-gt
and
claude
committed
de27fe3