# v1.3.11 Release Notes

> v1.3.10 -> v1.3.11

## Summary

Keeps secrets out of everything the model and logs see, and closes request paths that let outside callers trigger the agent or skip its sandbox. Cuts wasted context by withholding reads unrelated to the request, and moves destructive file actions into tools of their own.

<details>
<summary>翻譯</summary>

工具輸出中的密鑰不再進入模型與紀錄，並封住讓外部呼叫觸發 agent 或繞過沙箱的請求路徑。略過與需求無關的讀取以減少無效 context，並把具破壞性的檔案操作移到獨立工具。

</details>

## Changes

### SECURITY

- Redact secrets in tool output by format before it reaches the model, logs or history — results, errors, streamed progress and background reports — keeping the first and last three characters, and masking a private key block as one value (@pardnchiu) [6eab4610]
- Refuse `edit_file` and `run_command` calls that would write a masked value back as if it were the original (@pardnchiu) [6eab4610]
- Reject write requests that carry a non-loopback `Origin`, and require a JSON body on `/v1/send` and `/v1/chat/completions` (@pardnchiu) [6eab4610]
- Accept `enable_sandbox: false` (`agen -p --skip-sandbox`) only from loopback, and mark it as dangerous in the CLI help and docs (@pardnchiu) [1932e250]

<details>
<summary>翻譯</summary>

- 工具輸出中的密鑰在送進模型、log 與歷史前依格式遮蓋（結果、錯誤、串流進度與背景報告），保留前後三字元，私鑰區塊整段視為一個值
- `edit_file` 與 `run_command` 要把遮罩值當原文寫回時直接拒絕
- 帶非 loopback `Origin` 的寫入請求一律拒絕，`/v1/send` 與 `/v1/chat/completions` 只收 JSON body
- `enable_sandbox: false`（`agen -p --skip-sandbox`）只接受 loopback 呼叫，並在 CLI 說明與文件標註危險

</details>

### FIX

- Stop the root process when a `sudo` command is cancelled, by relaying SIGTERM through `sudo` instead of killing the process group (@pardnchiu) [1fa59754]

<details>
<summary>翻譯</summary>

- 取消 `sudo` 指令時改由 `sudo` 轉送 SIGTERM，不再直接殺掉程序群組，root 子程序會一併結束

</details>

### UPDATE

- Rewrite the sandbox escalation advice so a permission error points to `network`, `write_paths` or reporting the block before leaving the sandbox (@pardnchiu) [1fa59754]
- Withhold large `read_files` and `chat_history` results the decision model judges unrelated to the request, sharing one relevance check with `fetch_page`; reading the same file or task again returns its content (@pardnchiu) [cc9cd8ac]

<details>
<summary>翻譯</summary>

- 改寫沙箱提權建議，權限錯誤先導向 `network`、`write_paths` 或回報被擋，離開沙箱改為最後手段
- `read_files` 與 `chat_history` 的大型結果若被 decision model 判定與需求無關即略過，與 `fetch_page` 共用同一個相關性檢查；再次讀取同一檔案或 task 會回傳內容

</details>

### REFACTOR

- Split `edit_file` into `edit_file` (write and patch), `remove_file` and `restore_file`, move `error_history` writes into `write_error`, and drop parameter descriptions that repeated a sibling parameter (@pardnchiu) [827b5525]

<details>
<summary>翻譯</summary>

- `edit_file` 拆成 `edit_file`（write 與 patch）、`remove_file` 與 `restore_file`，`error_history` 的寫入移到 `write_error`，並刪除與同 schema 其他參數重複的說明

</details>

## Scope

- `internal/utils/secret/`, `configs/jsons/secret_patterns.json`, `configs/configs.go` — SECURITY
- `internal/tools/register/`, `internal/tools/interactive/background.go` — SECURITY
- `internal/runtime/routes/` — SECURITY
- `cmd/app/`, `README.md`, `doc/` — SECURITY
- `internal/tools/runCommand.go`, `internal/tools/runCommandBackground.go` — SECURITY, FIX, UPDATE, REFACTOR
- `internal/runtime/tui/` — FIX, REFACTOR
- `internal/agents/decision/`, `internal/tools/fetchPage/`, `internal/tools/history/action/` — UPDATE
- `internal/tools/file/` — SECURITY, UPDATE, REFACTOR (`editFile.go`, `readFiles.go`, `relevance.go`, `removeFile.go`, `restoreFile.go`)
- `internal/tools/history/error/`, `internal/tools/history/file/`, `configs/prompts/guide/tool_error.md` — REFACTOR
- `internal/agents/exec/`, `internal/utils/toolFormat.go`, `internal/tools/external/toolAdapter.go` — SECURITY, REFACTOR

---

Generated by [SKILL](https://github.com/pardnchiu/skill-version-generate)