fix(security): prevent SSRF via unvalidated GitHub Enterprise URL in Copilot plugin - #22

Open

tejas0077 wants to merge 9308 commits into

CyberStrikeus:mainfrom

tejas0077:fix/security-oauth-credential-detection

This pull request is big! We're only showing the most recent 250 commits

Commits on Feb 12, 2026

feat: support claude agent SDK-style structured outputs in the OpenCode SDK (#8161)

authored
e269788
chore: generate
opencode-agent[bot]
committed
f6e7aef
fix(win32): use ffi to get around bun raw input/ctrl+c issues (#13052)
Hona
authored
8f9742d
release: v1.1.60
opencode
committed
03de51b
zen: return cost
fwang
committed
d86f24b
tweak: tool outputs to be more llm friendly (#13269)
rekram1-node
authored
624dd94
desktop: sqlite migration progress bar (#13294)
Brendonovich
authored
1413d77
Testing SignPath Integration (#13308)
Brendonovich
authored
0eaeb45
ci: move test-sigining policy
Brendonovich
committed
fa97475
chore: style loading screen
adamdotdevin
committed
5f42188
wip(ui): diff virtualization (#12693)
adamdotdevin
authored
ecb2742
chore: update nix node_modules hashes
opencode-agent[bot]
committed
9f9f0fb
feat: update to not post comment on workflows when no duplicates found (#13238)
R44VC0RP
authored
d723147
wip: zen
fwang
committed
d82d22b
core: allow model configurations without npm/api provider details
thdxr
committed
a115565
release: v1.1.61
opencode
committed
892bb75
chore: generate

opencode-agent[bot]
authored and
opencode
committed
85df106
wip: zen

fwang
authored and
opencode
committed
ae811ad
core: expose tool arguments in shell hook for plugin visibility
thdxr
committed
56ad2db
chore: refactor packages/app files (#13236)

authored
ff4414b
fix(app): more defensive session context metrics
adamdotdevin
committed
ed472d8
fix(app): more defensive code component
adamdotdevin
committed
a82ca86
zen: minimax m2.5
fwang
committed
658bf6f
wip: zen
fwang
committed
59a323e
fix(docs): correct `format` attribute in `StructuredOutputs` (#13340)
dtfiedler
authored
ecab692
fix: downgrade bun to 1.3.5 (#13347)
rekram1-node
authored
2db618d
chore: update nix node_modules hashes
opencode-agent[bot]
committed
847e06f
feat(tool): return image attachments from webfetch (#13331)
R44VC0RP
authored
ba54cee
ignore: document test fixtures for agents
thdxr
committed
789705e
chore(app): refactor for better solidjs hygiene (#13344)
adamdotdevin
authored
da95213
fix(app): preserve undo history for plain-text paste (#13351)
gitRasheed
authored
0771e3a
fix(app): project icons unloading
adamdotdevin
committed
ff0abac
release: v1.1.62
opencode
committed
aaee5fb
improve codex model list

thdxr
authored and
opencode
committed
e6e9c15
release: v1.1.63
opencode
committed
ac018e3
test: add more test cases for project.test.ts (#13355)

rekram1-node
authored and
opencode
committed
d1ee4c8
fix(app): remote http server connections
adamdotdevin
committed
958320f
fix(app): suggestion active state broken
adamdotdevin
committed
50f208d
chore: cleanup
adamdotdevin
committed
3696d1d
chore: cleanup
adamdotdevin
committed
81c623f
chore: cleanup
adamdotdevin
committed
e9b9a62
chore: cleanup
adamdotdevin
committed
7ccf223
chore: cleanup
adamdotdevin
committed
70303d0
fix(app): normalize oauth error messages
adamdotdevin
committed
ff3b174
feat(app): option to turn off sound effects
adamdotdevin
committed
4e0f509
fix(app): terminal pty isolation
adamdotdevin
committed
548608b
docs: update STACKIT provider documentation with typo fix (#13357)

amankalra172
and
amankalra172
authored
11dd281
chore: generate
opencode-agent[bot]
committed
20dcff1
do not open console on error (#13374)
kommander
authored
c0814da
feat: windows selection behavior, manual ctrl+c (#13315)
Hona
authored
a8f2884
fix: baseline CPU detection (#13371)
Hona
authored
4018c86
chore: update nix node_modules hashes
opencode-agent[bot]
committed
445e0d7
fix: look for recent model in fallback in cli (#12582)
smitchaudhary
authored
93eee0d
chore: generate
opencode-agent[bot]
committed
d475fd6
chore: cleanup flag code (#13389)
rekram1-node
authored
f66624f
fix: token substitution in OPENCODE_CONFIG_CONTENT (#13384)
ariane-emory
authored
29671c1
release: v1.1.64
opencode
committed
76db218

Commits on Feb 13, 2026

fix: resolve ACP hanging indefinitely in thinking state on Windows (#13222)

authored
991496a
desktop: only show loading window if sqlite migration is necessary
Brendonovich
committed
adb0c4d
fix(app): failed to create store
adamdotdevin
committed
0303c29
fix(app): worktree delete
adamdotdevin
committed
8da5fd0
chore: cleanup
adamdotdevin
committed
b525c03
fix(app): prompt input quirks
adamdotdevin
committed
7f95cc6
fix(app): notification should navigate to session
adamdotdevin
committed
c9719df
fix(app): emoji as avatar
adamdotdevin
committed
dec304a
cleanup desktop loading page
Brendonovich
committed
e0f1c3c
feat(app): toggle all provider models
adamdotdevin
committed
fb7b2f6
fix(app): reconnect event stream on disconnect
adamdotdevin
committed
dd296f7
ci: remove signpath policy
Brendonovich
committed
b06afd6
feat(hook): add tool.definition hook for plugins to modify tool description and parameters (#4956)
spoons-and-mirrors
authored
1608565
fix: ensure @-ing a dir uses the read tool instead of dead list tool (#13428)
rekram1-node
authored
98aeb60
Revert "fix: token substitution in OPENCODE_CONFIG_CONTENT" (#13429)
rekram1-node
authored
1fb6c0b
release: v1.1.65
opencode
committed
34ebe81
feat: update some ai sdk packages and uuse adaptive reasoning for opus 4.6 on vertex/bedrock/anthropic (#13439)
rekram1-node
authored
0d90a22
feat(cli): add --dir option to run command (#12443)
BlankParticle
authored
693127d
chore: update nix node_modules hashes
opencode-agent[bot]
committed
b8ee882
fix(desktop): performance optimization for showing large diff & files (#13460)
neriousy
authored
ebb907d
fix(web): sync docs locale cookie on alias redirects (#13109)
Seungjun0906
authored
9f20e0d
fix(app): remount SDK/sync tree when server URL changes (#13437)
ysm-dev
authored
ebe5a2b
docs: Fix zh-cn translation mistake in tools.mdx (#13407)
annopick
authored
b1764b2
chore: generate
opencode-agent[bot]
committed
f991a6c
fix(web): use prompt_async endpoint to avoid timeout over VPN/tunnel (#12749)
eytans
authored
e242fe1
fix(app): terminal resize
adamdotdevin
committed
1c71604
chore: cleanup
adamdotdevin
committed
4f51c09
docs(ko): polish Korean phrasing in acp, agents, config, and custom-tools docs (#13446)
Seungjun0906
authored
b8848cf
docs: add pacman installation option for Arch Linux alongside AUR (#13293)
G36maid
authored
88e2eb5
fix(test): move timeout config to CLI flag (#13494)

yanhao98
and
严浩
authored
bc1fd06
fix: standardize zh-CN docs character set and terminology (#13500)
niushuai1991
authored
72c09e1
fix(ui): support cmd-click links in inline code (#12552)
kitlangton
authored
d30e917

Commits on Feb 14, 2026

fix: prevent opencode run crash on malformed tool inputs (#13051)

0xK3vin
and
0xK3vin
authored
d018903
sqlite again (#10597)

authored
6d95f0d
chore: generate
opencode-agent[bot]
committed
afb04ed
desktop: remote OPENCODE_SQLITE env (#13545)
Brendonovich
authored
7d46872
chore: update nix node_modules hashes
opencode-agent[bot]
committed
d0dcffe
desktop: fix rust
Brendonovich
committed
0b9e929
release: v1.2.0
opencode
committed
ffc000d
zen: minimax m2.5 & glm5
fwang
committed
1e25df2
fix: tweak websearch tool description date info to avoid cache busts (#13559)
rekram1-node
authored
179c407
tui: show all project sessions from any working directory
thdxr
committed
b020758
release: v1.2.1
opencode
committed
cd775a2
ci: test-signing signpath policy

Brendonovich
authored and
opencode
committed
ed439b2
ci: move signpath policy
Brendonovich
committed
df3203d
bump vertex ai packages (#13625)
rekram1-node
authored
ef205c3
fix vercel gateway variants (#13541)
rekram1-node
authored
759ec10
chore: update nix node_modules hashes
opencode-agent[bot]
committed
306fc77
core: filter sessions at database level to improve session list loading performance
thdxr
committed
68bb8ce
core: add comprehensive test coverage for Session.list() filters
thdxr
committed
8631d6c
release: v1.2.2
opencode
committed
3b6b3e6
fix: ensure vercel variants pass amazon models under bedrock key (#13631)
rekram1-node
authored
933a491
chore: bump nixpkgs to get bun 1.3.9 (#13302)
albertov
authored
575f2cf
fix: add WAL checkpoint on database open (#13633)
thdxr
authored
67c985c
fix: ensure anthropic models on OR also have variant support (#13498)
rekram1-node
authored
839c5cd
chore: update nix node_modules hashes
opencode-agent[bot]
committed
7911cb6
chore: add dual-license structure (MIT + PolyForm Noncommercial)
badchars
committed
dda7669
chore: phase 0 - remove web/docs packages and add rebrand script
badchars
committed
897fd70
refactor: complete OpenCode → CyberStrike rebrand
badchars
committed
602ea22
refactor: rename CLI binary from opencode to cyberstrike
badchars
committed
e51db2a
refactor: fix remaining opencode references (camelCase, PascalCase, bare OPENCODE)
badchars
committed
1392fcd
fix: resolve typecheck errors after rebrand
badchars
committed
8e15907
Merge pull request #1 from CyberStrikeus/rebrand/opencode-to-cyberstrike
badchars
authored
58fb029

Commits on Feb 15, 2026

Commits on Feb 16, 2026

feat: add HackR browser, memory system, lazy tool registry (Phase 2)

badchars
and
claude
committed
74fdf3b
Merge pull request #4 from CyberStrikeus/security/phase-2-browser-memory
badchars
authored
4426871
feat: replace ASCII logo with CyberStrike figlet art

badchars
and
claude
committed
b76e68f
Merge pull request #5 from CyberStrikeus/security/phase-2-browser-memory
badchars
authored
eb7a915
feat: random gradient palette for ASCII logo on each startup

badchars
and
claude
committed
b4399f0
Merge pull request #6 from CyberStrikeus/security/phase-2-browser-memory
badchars
authored
9f7b98a
feat: add Claude Code CLI/API providers, cloud security agent, domain fix

badchars
and
claude
committed
c8e23fe
Merge branch 'feat/claude-cli-integration' into dev
badchars
committed
d282aa5

Commits on Feb 20, 2026

feat: port chunked compaction and pre-compaction memory flush from OpenClaw

badchars
and
claude
committed
2ea5a3e
fix: increase Claude CLI timeout to 15min and fix timer leak

badchars
and
claude
committed
559e3cc
fix: rebrand leftover — terminal title OC→CS, sidebar OpenCode→CyberStrike

badchars
and
claude
committed
5c30bff
feat: enable browser tool for default build and general agents

badchars
and
claude
committed
8359145
feat: add tool calling support to claude-cli provider

badchars
and
claude
committed
9c34c0a
fix: use correct AI SDK stream event types for tool calls

badchars
and
claude
committed
bbe86a7
fix: add session-id continuity for multi-turn tool calling

badchars
and
claude
committed
1782b42
fix: prevent infinite loop in claude-cli multi-step tool calling

badchars
and
claude
committed
522bf55
fix: enforce browser tool usage over bash in claude-cli provider

badchars
and
claude
committed
ff9078f
revert: remove broken tool-calling experiment from claude-cli provider

badchars
and
claude
committed
e26b6f9

Commits on Feb 28, 2026

feat: add MCP browser server for Claude CLI tool support

badchars
and
claude
committed
12034b3
feat: update packages with latest codebase

badchars
and
claude
committed
5e197cf

Commits on Mar 1, 2026

fix: add placeholder for empty endpoint migration

badchars
and
claude
committed
3524190
fix: use valid no-op SQL for empty endpoint migration

badchars
and
claude
committed
ca89b7c
feat: simplify ASCII logo and use theme colors

badchars
and
claude
committed
e86e566

Commits on Mar 6, 2026

fix: migration folder timestamps and loader validation

badchars
and
claude
committed
7ec506e
fix: default server port to 4096

badchars
and
claude
committed
2243680
chore: update .gitignore for temporary debug artifacts

badchars
and
claude
committed
6958b7f
feat: add vulnerability reporting and request normalization models

badchars
and
claude
committed
c7cccb0
feat: add web security testing infrastructure (credentials, roles, objects, functions)

badchars
and
claude
committed
9e33136
feat: add report_vulnerability tool with severity and impact tracking

badchars
and
claude
committed
41a2fd6
feat: add web proxy agent tools for endpoint analysis and credential management

badchars
and
claude
committed
232af19
feat: add vulnerability testing and proxy analysis agent prompts

badchars
and
claude
committed
18a320d
feat: extend agent definitions with proxy agents and vulnerability testers

badchars
and
claude
committed
6a1b5bf
feat: add vulnerability, request, and web context API endpoints

badchars
and
claude
committed
d454c44
feat: add request context prepending for vulnerability agents

badchars
and
claude
committed
30d3404
chore: register new web and vulnerability tools in tool registry

badchars
and
claude
committed
93777e7
chore: update config schema for report_vulnerability permission

badchars
and
claude
committed
e088406
feat: add vulnerability and web context views to TUI session sidebar

badchars
and
claude
committed
f81cd77
feat: add sync context handlers for vulnerability and web security data

badchars
and
claude
committed
eadd12f
feat: integrate vulnerability reporting into CLI commands

badchars
and
claude
committed
7e9e2a3
chore: regenerate SDK types and update storage schema exports

badchars
and
claude
committed
79d3def

Commits on Mar 15, 2026

feat: v1.0.8-beta.1 — agent architecture refactor + vulnerability testing agents

badchars
and
claude
committed
f6e8aba
fix: critical bug fixes for v1.0.8-beta.1 release

badchars
and
claude
committed
81db9b1
feat: local LLM provider support + CLI management + UI improvements

badchars
and
claude
committed
7c234d0

Commits on Mar 16, 2026

feat: Bolt client integration + browser tool cleanup

badchars
and
claude
committed
c07378f
fix: bolt sidebar display + lazy registry + sdk.fetch

badchars
and
claude
committed
3712a7a
fix: refresh lazy registry on ToolListChanged notification

badchars
and
claude
committed
7d84c8a
fix: defer Bus.subscribe to init() to avoid Instance context error

badchars
and
claude
committed
055a2ae
feat: bolt delete + auth error detection

badchars
and
claude
committed
56ea40b
fix: change bolt delete keybind from 'd' to 'ctrl+d'

badchars
and
claude
committed
f724075
ui: hide LSP section from sidebar

badchars
and
claude
committed
5e72cdf
fix: update @opentui/core 0.1.79 → 0.1.87

badchars
and
claude
committed
ea1ee9f
fix: work around opentui border rendering bug in prompt input

badchars
and
claude
committed
82cdeee

Commits on Mar 17, 2026

feat: v1.1.0 — MCP/Bolt management improvements

badchars
and
claude
committed
6f3a5b2
docs: rewrite README as offensive security platform — 23 languages + social preview

badchars
and
claude
committed
18e1cfc
docs: enhance README with community-focused narrative and feature showcase

badchars
and
claude
committed
2847ebd
docs: redesign social preview SVGs with enhanced visual design

badchars
and
claude
committed
ec3117f
fix: remove SVG filters for GitHub compatibility

badchars
and
claude
committed
01de8b1
docs: use actual CyberStrike logo in social preview SVGs

badchars
and
claude
committed
162ea38
chore: overhaul issue templates + fix Discord invite link

badchars
and
claude
committed
951e964
chore: improve PR template with security impact section

badchars
and
claude
committed
5145b8a
docs: update CONTRIBUTING.md — MCP ecosystem, fix dead refs, add community links

badchars
and
claude
committed
2b671dc
docs: rewrite SECURITY.md — fix domain, add Bolt/MCP sections, disclosure policy

badchars
and
claude
committed
9e84c58
docs: add CHANGELOG.md covering v0.1.0 → v1.1.0

badchars
and
claude
committed
d4ef2a2
chore: move CLAUDE.md to .claude/ and gitignore it

badchars
and
claude
committed
695c6af
Merge remote-tracking branch 'origin/main' into dev
badchars
committed
5c2a08a
Merge pull request #12 from CyberStrikeus/dev
badchars
authored
6730c3f
chore: add FUNDING.yml — GitHub Sponsors + Buy Me a Coffee

badchars
and
claude
committed
926c707
Merge pull request #13 from CyberStrikeus/dev
badchars
authored
aa14702
fix: use badchars for GitHub Sponsors (CyberStrikeus org not enrolled)

badchars
and
claude
committed
9757455
Merge pull request #14 from CyberStrikeus/dev
badchars
authored
6d8eba0
docs: add MCP Security Suite backlink table to all READMEs + remove BMC from FUNDING.yml

badchars
and
claude
committed
7b11de7
Merge pull request #15 from CyberStrikeus/dev
badchars
authored
a16590d
docs: add section navigation bar to all 23 READMEs

badchars
and
claude
committed
99ac70e
Merge pull request #16 from CyberStrikeus/dev
badchars
authored
5e467a5
docs: add Bolt section and nav link to all 23 READMEs

badchars
and
claude
committed
0766da9
Merge pull request #17 from CyberStrikeus/dev
badchars
authored
34482d8
feat: redesign SVG banners, reorder README headers, add NPM keywords

badchars
and
claude
committed
f62874d
Merge pull request #18 from CyberStrikeus/dev
badchars
authored
8873ee7
ci: replace Blacksmith runners with GitHub free runners

badchars
and
claude
committed
e7b6cb0
ci: make cyberstrike install non-fatal for first publish

badchars
and
claude
committed
c43723a
feat: migrate all NPM packages to @cyberstrike-io/ scope

badchars
and
claude
committed
42b0442
Merge pull request #19 from CyberStrikeus/dev
badchars
authored
066fc52
fix: handle missing cyberstrike binary in changelog generation

badchars
and
claude
committed
cb53b42
ci: allow publish to proceed when desktop builds fail

badchars
and
claude
committed
0aeff05
ci: fix publish job — fallback git config and NPM auth token

badchars
and
claude
committed
b40f522
fix: remove duplicate migration folders with invalid names

badchars
and
claude
committed
2384078
fix: use authenticated GitHub API requests in changelog

badchars
and
claude
committed
d2ef0fe
chore: add .cyberstrike/ and __MACOSX/ to gitignore

badchars
and
claude
committed
8132fe0
fix: update tests for opencode → cyberstrike agent rename

badchars
and
claude
committed
b75dfaf
fix: decouple publish from Tauri desktop builds

badchars
and
claude
committed
e3665df
fix: add fallback git config when GitHub App credentials missing

badchars
and
claude
committed
ac30808
fix: tool registry test should not require cowsay to be installed

badchars
and
claude
committed
650ec0f
fix: gracefully skip custom tools with missing dependencies

badchars
and
claude
committed
e464336
feat: remove Tauri desktop app (opencode legacy)

badchars
and
claude
committed
bc557c9
ci: remove Playwright e2e from test workflow

badchars
and
claude
committed
e4026ed
fix: lowercase Docker image tag for ghcr.io

badchars
and
claude
committed
21f9d8d
chore: remove 13 unused workflows inherited from opencode

badchars
and
claude
committed
3687f5e
fix: rename opencode → cyberstrike in Dockerfile + remove unused workflows

badchars
and
claude
committed
e01112d
chore: remove Docker from build pipeline

badchars
and
claude
committed
fb884a6
refactor: rename npm scope @cyberstrikeus → @cyberstrike-io

badchars
and
claude
committed
1ebb38c
release: v1.1.1
github-actions[bot]
committed
e77a353
chore: remove AUR and Homebrew from publish script

badchars
and
claude
committed
23af004
chore: generate
github-actions[bot]
committed
8efdab9
chore: publish only on manual trigger, not on every push

badchars
and
claude
committed
7596f28
fix: rename opencode → cyberstrike in bin launcher script

badchars
and
claude
committed
c286df8
release: v1.1.2
github-actions[bot]
committed
f086b4c

Commits on Mar 18, 2026

fix: add billing header for OAT token auth on Sonnet/Opus models

badchars
and
claude
committed
95db941
feat: add offensive security agent prompts and harden publish script

badchars
and
claude
committed
726ce8e
release: v1.1.3
github-actions[bot]
committed
6313e57
fix: correct npm install commands and domain references on website

badchars
and
claude
committed
a184936
fix: add --beta flag to install script, fix scoped package names in uninstall

badchars
and
claude
committed
85ad427
fix: auto-fallback to available port when default port is busy

badchars
and
claude
committed
5bc0873
fix: update @opentui/core and @opentui/solid to 0.1.88

badchars
and
claude
committed
26b36a2
release: vpatch
github-actions[bot]
committed
527fd08
release: v1.1.4
github-actions[bot]
committed
1f95685
fix: add schema reconciler to repair partially applied migrations

badchars
and
claude
committed
943be3a
chore: generate
github-actions[bot]
committed
369e471
chore: consolidate license to AGPL-3.0-only, fix Twitter and domain refs

badchars
and
claude
committed
d773494
fix: replace all cyberstrike.us references with cyberstrike.io

badchars
and
claude
committed
53ea9cc
Merge pull request #20 from CyberStrikeus/dev
badchars
authored
b227b8c
Update copyright year and holder in LICENSE file
badchars
authored
d6f76c5
Update copyright year and holder in LICENSE file
badchars
authored
5c1ca57
docs: rewrite README with intelligence layer, SEO optimization, and Bolt 1:N architecture

badchars
and
claude
committed
8fa901a
chore: generate
github-actions[bot]
committed
377d530
Merge pull request #21 from CyberStrikeus/dev
badchars
authored
a8dd983

Commits on Mar 19, 2026

fix(security): prevent SSRF via unvalidated GitHub Enterprise URL in Copilot plugin
Tejas Saubhage
committed
489b068