wenjie 8c2a9332c6 fix(security): harden unauthenticated tool-exec paths (#1360) ...

* fix(security): harden unauthenticated tool-exec paths (GHSA-pv8c-p6jf-3fpp)

- Exec tool: channel-based access control (default deny remote)
- Cron tool: command scheduling restricted to internal channels
- Web fetch: SSRF defense-in-depth (pre-flight + dial-time + redirect checks)
- File permissions: session/state dirs 0700, files 0600
- Registry: inject __channel/__chat_id into tool args (replaces racy SetContext)

28 new security regression tests.

(cherry picked from commit 191446ae19021604d3d5b0d9376b9655ab749105)

* fix(exec): revalidate working_dir before command start

* test(web): allow local oversized payload fixture

---------

Co-authored-by: xj <gh-xj@users.noreply.github.com>

2026-03-11 19:22:20 +08:00

..

state_test.go

fix(security): harden unauthenticated tool-exec paths (#1360)

2026-03-11 19:22:20 +08:00

state.go

fix(security): harden unauthenticated tool-exec paths (#1360)

2026-03-11 19:22:20 +08:00