v1.3.11
Home GitHub

v1.3.11 Release Notes

Released


v1.3.10 -> v1.3.11

Summary


Keeps secrets out of everything the model and logs see, and closes request paths that let outside callers trigger the agent or skip its sandbox. Cuts wasted context by withholding reads unrelated to the request, and moves destructive file actions into tools of their own.
翻譯
工具輸出中的密鑰不再進入模型與紀錄，並封住讓外部呼叫觸發 agent 或繞過沙箱的請求路徑。略過與需求無關的讀取以減少無效 context，並把具破壞性的檔案操作移到獨立工具。

Changes


SECURITY


  • Redact secrets in tool output by format before it reaches the model, logs or history — results, errors, streamed progress and background reports — keeping the first and last three characters, and masking a private key block as one value (@pardnchiu) [6eab4610]
  • Refuse edit_file and run_command calls that would write a masked value back as if it were the original (@pardnchiu) [6eab4610]
  • Reject write requests that carry a non-loopback Origin, and require a JSON body on /v1/send and /v1/chat/completions (@pardnchiu) [6eab4610]
  • Accept enable_sandbox: false (agen -p --skip-sandbox) only from loopback, and mark it as dangerous in the CLI help and docs (@pardnchiu) [1932e250]

翻譯
  • 工具輸出中的密鑰在送進模型、log 與歷史前依格式遮蓋（結果、錯誤、串流進度與背景報告），保留前後三字元，私鑰區塊整段視為一個值
  • edit_file 與 run_command 要把遮罩值當原文寫回時直接拒絕
  • 帶非 loopback Origin 的寫入請求一律拒絕，/v1/send 與 /v1/chat/completions 只收 JSON body
  • enable_sandbox: false（agen -p --skip-sandbox）只接受 loopback 呼叫，並在 CLI 說明與文件標註危險


FIX


  • Stop the root process when a sudo command is cancelled, by relaying SIGTERM through sudo instead of killing the process group (@pardnchiu) [1fa59754]

翻譯
  • 取消 sudo 指令時改由 sudo 轉送 SIGTERM，不再直接殺掉程序群組，root 子程序會一併結束


UPDATE


  • Rewrite the sandbox escalation advice so a permission error points to network, write_paths or reporting the block before leaving the sandbox (@pardnchiu) [1fa59754]
  • Withhold large read_files and chat_history results the decision model judges unrelated to the request, sharing one relevance check with fetch_page; reading the same file or task again returns its content (@pardnchiu) [cc9cd8ac]

翻譯
  • 改寫沙箱提權建議，權限錯誤先導向 network、write_paths 或回報被擋，離開沙箱改為最後手段
  • read_files 與 chat_history 的大型結果若被 decision model 判定與需求無關即略過，與 fetch_page 共用同一個相關性檢查；再次讀取同一檔案或 task 會回傳內容


REFACTOR


  • Split edit_file into edit_file (write and patch), remove_file and restore_file, move error_history writes into write_error, and drop parameter descriptions that repeated a sibling parameter (@pardnchiu) [827b5525]

翻譯
  • edit_file 拆成 edit_file（write 與 patch）、remove_file 與 restore_file，error_history 的寫入移到 write_error，並刪除與同 schema 其他參數重複的說明


Scope


  • internal/utils/secret/, configs/jsons/secret_patterns.json, configs/configs.go — SECURITY
  • internal/tools/register/, internal/tools/interactive/background.go — SECURITY
  • internal/runtime/routes/ — SECURITY
  • cmd/app/, README.md, doc/ — SECURITY
  • internal/tools/runCommand.go, internal/tools/runCommandBackground.go — SECURITY, FIX, UPDATE, REFACTOR
  • internal/runtime/tui/ — FIX, REFACTOR
  • internal/agents/decision/, internal/tools/fetchPage/, internal/tools/history/action/ — UPDATE
  • internal/tools/file/ — SECURITY, UPDATE, REFACTOR (editFile.go, readFiles.go, relevance.go, removeFile.go, restoreFile.go)
  • internal/tools/history/error/, internal/tools/history/file/, configs/prompts/guide/tool_error.md — REFACTOR
  • internal/agents/exec/, internal/utils/toolFormat.go, internal/tools/external/toolAdapter.go — SECURITY, REFACTOR


Generated by SKILL