Michael e018c7cf6c fix(cookbook): accept $(find) subshells in serve command validation ...

Allow the generated Cookbook mmproj lookup command substitution while keeping serve-command validation constrained to explicit safe subshell patterns.

Preserves the existing safe printf substitution, allowlists the generated find/sort/head mmproj lookup shape, and adds negative regression coverage for unrelated substitutions and pipelines.

Fixes #4772.

2026-06-28 14:00:49 +01:00

..

gallery

refactor(routes): move gallery domain into routes/gallery subpackage (#4903)

2026-06-28 10:40:34 +01:00

__init__.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

_validators.py

fix(hwfit): validate remote SSH detection targets (#3718)

2026-06-11 00:43:49 +02:00

admin_wipe_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

api_token_routes.py

fix(api): normalize non-object JSON bodies to empty dict in token PATCH (#3976)

2026-06-15 18:05:15 +01:00

assistant_routes.py

fix(auth): centralize password and username validation constants (#4120)

2026-06-16 09:52:15 +02:00

auth_routes.py

fix(auth): tie remember-me cookie lifetime to TOKEN_TTL (#4472)

2026-06-18 21:15:48 +02:00

backup_routes.py

fix: backup import dropping a user's skill on cross-tenant title/id collision (#2057)

2026-06-09 08:04:22 +02:00

calendar_routes.py

fix(calendar): accept time-first datetimes in _parse_dt

2026-06-27 18:51:18 +01:00

chat_helpers.py

fix: improve uploaded document retrieval and deep research reuse (#4784)

2026-06-27 19:24:17 +01:00

chat_routes.py

fix: improve uploaded document retrieval and deep research reuse (#4784)

2026-06-27 19:24:17 +01:00

chatgpt_subscription_routes.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

cleanup_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

codex_routes.py

fix: improve uploaded document retrieval and deep research reuse (#4784)

2026-06-27 19:24:17 +01:00

compare_routes.py

fix(endpoint): scope secondary endpoint lookups by owner

2026-06-08 11:51:55 +01:00

contacts_routes.py

fix: vCard parser drops folded continuation lines, corrupting emails (#1870)

2026-06-27 14:41:57 +01:00

cookbook_helpers.py

fix(cookbook): accept $(find) subshells in serve command validation

2026-06-28 14:00:49 +01:00

cookbook_output.py

fix(cookbook): report dead finished downloads as completed instead of stopped (#4025)

2026-06-15 15:26:55 +09:00

cookbook_routes.py

fix(cookbook): treat local Windows as Windows for serve commands (#3975)

2026-06-26 13:13:01 +01:00

copilot_routes.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

device_flow.py

feat: add ChatGPT Subscription provider (#2876)

2026-06-08 10:19:18 +02:00

diagnostics_routes.py

feat(ui): add real-time diagnostic logs console (#974)

2026-06-15 10:32:51 +02:00

document_helpers.py

fix: document read fails with 403 when auth is disabled (#4623)

2026-06-22 21:01:11 +02:00

document_routes.py

fix: document read fails with 403 when auth is disabled (#4623)

2026-06-22 21:01:11 +02:00

editor_draft_routes.py

Ignore invalid editor draft payloads (#1533)

2026-06-03 14:07:03 +09:00

email_helpers.py

fix(email): don't probe IMAP for send-only (SMTP-only) accounts (#4830)

2026-06-27 21:52:26 +01:00

email_pollers.py

fix: email poller marks calendar extraction processed on LLM failure (#4622)

2026-06-23 20:32:30 +02:00

email_routes.py

fix(email): don't probe IMAP for send-only (SMTP-only) accounts (#4830)

2026-06-27 21:52:26 +01:00

embedding_routes.py

feat(paths): abstract runtime path logic for frozen distribution packages (#969)

2026-06-15 17:44:10 +01:00

emoji_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

font_routes.py

Keep compact font family names together (#1263)

2026-06-03 14:24:30 +09:00

gallery_helpers.py

refactor(routes): move gallery domain into routes/gallery subpackage (#4903)

2026-06-28 10:40:34 +01:00

gallery_routes.py

refactor(routes): move gallery domain into routes/gallery subpackage (#4903)

2026-06-28 10:40:34 +01:00

history_routes.py

fix(sessions): copy message metadata when forking a session (#3409)

2026-06-08 20:49:15 +02:00

hwfit_routes.py

CodeQL hardening for cookbook sync

2026-06-22 02:39:18 +00:00

mcp_routes.py

fix(mcp): share oauth redirect URI (#4087)

2026-06-15 15:15:53 +09:00

memory_routes.py

fix(routes): normalize session owner fallback helpers (#4313)

2026-06-16 06:07:42 +01:00

model_routes.py

fix(models): accept bare-list /models responses (Together AI) (#4761)

2026-06-27 16:25:15 +01:00

note_routes.py

fix(security): redact credential-bearing URLs and PII from logs (#4750)

2026-06-22 23:12:39 +02:00

personal_routes.py

fix(personal): scope RAG file delete to the caller's own upload dir (#4602)

2026-06-20 00:50:15 +02:00

prefs_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

preset_routes.py

fix(ai): offload model resolution from async paths

2026-06-28 00:48:35 +01:00

research_routes.py

refactor(auth): centralize the internal-tool pseudo-username into a constant (#4333)

2026-06-16 13:13:00 +02:00

search_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

session_routes.py

fix(auth): clean up rename and null-owner ownership (#4340)

2026-06-16 03:33:02 +01:00

shell_routes.py

fix(cookbook): load user-site pth hooks for runtime installs

2026-06-28 01:01:44 +01:00

signature_routes.py

Constrain signature uploads to PNG data (#2844)

2026-06-05 13:17:43 +02:00

skills_routes.py

fix(security): prevent ReDoS in verdict-prose and continuation matchers (#4943)

2026-06-28 11:42:20 +01:00

stt_routes.py

refactor(uploads): centralize upload byte-limits in upload_limits.py (#3364) (#3518)

2026-06-09 01:24:30 +02:00

task_routes.py

refactor(auth): centralize the internal-tool pseudo-username into a constant (#4333)

2026-06-16 13:13:00 +02:00

tts_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

upload_routes.py

fix(upload): handle corrupt uploads index and malformed vision JSON

2026-06-27 18:59:28 +01:00

vault_routes.py

refactor(constants): single source of truth for data dir (#3368)

2026-06-08 09:58:52 +02:00

webhook_routes.py

fix(models): accept bare-list /models responses (Together AI) (#4761)

2026-06-27 16:25:15 +01:00

workspace_routes.py

feat(agent): confine agent file/shell tools to a selectable workspace (#3665)

2026-06-11 18:17:54 +02:00