Skip to content

v1.14.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Jul 09:58
v1.14.0
2246fdd

v1.14.0

This release is a security-hardening and documentation-sync follow-up to v1.13.0. It closes the C1, H1–H9, M1–M15, and L1–L12 findings tracked in sec_findings.md, and brings the public docs and Docker Compose examples in line with the new behavior.

Highlights

  • Project sandbox approval gate (C-1). sandbox_env / sandbox_image / sandbox_network / sandbox_volumes from ./odek.json now require explicit operator approval before they are applied.
  • Danger classifier hardening (H1–H3, M12). git -c aliases/config, find -delete, rsync --delete, shell RC files, and ${VAR:--rf} style flag substitutions are now classified correctly; rm -rf ./.. normalisation catches wipe-target bypasses.
  • Search path classification and bounds (H4–H5). search_files and multi_grep classify every descended directory and file, skip sensitive paths, and enforce match/content caps.
  • MCP trust boundaries (H6–H8, M4–M6, L8). MCP server approvals now include the env hash; tool schemas are guard-scanned and size-capped; MCP tools classify as unknown in the batch gate; untrusted sub-agents no longer load MCP servers.
  • Web UI / WebSocket security (H9, L2, L3, M15). The per-instance WS token is no longer served over plain HTTP; API endpoints require the token and a loopback Host; trusted_proxies is configurable for reverse-proxied deployments.
  • Telegram hardening (M1–M3, M14, L11). Outbound media uploads require explicit approval and are chat-scoped; inline-keyboard approvals hide “Trust Session” for high-impact classes and add friction counters; clarify callbacks are bound to request ID and originating user.
  • Config and runtime boundaries (L1, L2, L9, L10). non_interactive is validated and defaults to deny; trusted_proxies cannot be set from ./odek.json; session IDs are validated on write; REPL history is created with 0600.
  • Docs and Docker sync. SECURITY.md, MCP.md, TELEGRAM.md, CLI.md, CONFIG.md, AGENTS.md, the Docker README, and DOCKER_COMPOSE_USER_GUIDE.md were updated to match the implemented behavior.

Assets

Binaries are available for linux/amd64, linux/arm64, darwin/amd64, and darwin/arm64. Verify with checksums.txt.

Full Changelog: v1.13.0...v1.14.0

Assets 7
Loading