David Gageot ca4254f2d8 fix: lock down REST session API against CSRF and DNS rebinding ...

Require --auth-token on non-loopback listeners, enforce JSON
content-type and origin checks on every method (not just mutations),
and add --remote-auth-token so `run --remote` can talk to a
token-protected listener.

Assisted-By: docker-agent

2026-10-18 19:31:55 +02:00

..

testdata

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

a2a_test.go

feat(a2a): require explicit security for network listeners

2026-08-18 14:09:58 +02:00

a2a.go

feat(a2a): require explicit security for network listeners

2026-08-18 14:09:58 +02:00

acp.go

chore: remove agentcatalog references, use neutral myorg/agent placeholders

2026-07-23 13:06:52 +02:00

agent_picker_test.go

test(root): locate picker coordinates from rendered text

2026-10-17 16:32:23 +02:00

agent_picker_unix_test.go

fix: propagate HTTP error statuses in API tool

2026-07-18 21:01:06 +05:30

agent_picker.go

refactor(config): split agent sources so embedders link only the source types they use

2026-09-04 09:21:52 +02:00

alias_test.go

feat(safety): add restricted mode for unattended runs

2026-08-13 11:34:36 +02:00

alias.go

feat(safety): add restricted mode for unattended runs

2026-08-13 11:34:36 +02:00

api.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

askpass_test.go

feat(shell): add opt-in sudo askpass flow (#1551)

2026-06-18 15:45:28 +02:00

askpass.go

feat(shell): add opt-in sudo askpass flow (#1551)

2026-06-18 15:45:28 +02:00

backend_auth_test.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

backend_resume_test.go

enable t.Parallel() across the test suite, drop the TestParallel lint cop

2026-06-30 16:17:13 +02:00

backend.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

board.go

Improve the command categories

2026-07-08 10:12:39 +02:00

chat_test.go

feat(chat): harden network serving

2026-08-18 14:09:58 +02:00

chat.go

feat(chat): harden network serving

2026-08-18 14:09:58 +02:00

completion_test.go

fix: address remaining Windows test failures

2026-07-30 15:06:01 +02:00

completion.go

refactor(config): split agent sources so embedders link only the source types they use

2026-09-04 09:21:52 +02:00

config_dir_test.go

feat: add hooks.d drop-in directory and config-dir env override

2026-07-07 10:51:32 +02:00

data_dir_test.go

fix: expand ~ in --data-dir and forward it to sandbox

2026-10-01 17:37:29 +02:00

debug_auth_test.go

Add 'debug auth' command to inspect Docker Desktop JWT

2026-02-26 17:03:42 +01:00

debug_auth.go

feat(auth): mint Docker tokens from the stored access token

2026-08-09 16:13:30 +02:00

debug_oauth_test.go

fix(mcp): honor callback configuration in standalone OAuth login

2026-08-17 09:54:06 +02:00

debug_oauth.go

refactor(config): split agent sources so embedders link only the source types they use

2026-09-04 09:21:52 +02:00

debug_test.go

feat: add debug tool command to call tools directly

2026-10-01 10:16:07 +02:00

debug_tool_test.go

test(root): isolate debug tools from the host model catalog

2026-10-17 16:32:23 +02:00

debug_tool.go

feat: run tool_input_transform and post_tool_use hooks on debug tool calls

2026-10-05 12:15:01 +02:00

debug.go

feat: run tool_input_transform and post_tool_use hooks on debug tool calls

2026-10-05 12:15:01 +02:00

dmr_test.go

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

dmr.go

fix: route DMR through the selected Docker connection safely

2026-09-30 08:12:14 +02:00

doctor_test.go

fix(ci): update lint tooling for Go 1.27.2

2026-10-09 12:09:23 +02:00

doctor.go

fix(ci): update lint tooling for Go 1.27.2

2026-10-09 12:09:23 +02:00

eval_baseline_test.go

test(evaluation): exercise the real baseline file format

2026-08-08 22:04:38 +03:30

eval_test.go

feat(eval): add evaluator judge backend

2026-10-07 10:30:07 +02:00

eval.go

feat(eval): add evaluator judge backend

2026-10-07 10:30:07 +02:00

evaluator_preflight_test.go

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

flags_test.go

feat(#3996): persist absolute WorkingDir provenance at every local creation path

2026-09-09 17:55:34 +02:00

flags.go

fix: route DMR through the selected Docker connection safely

2026-09-30 08:12:14 +02:00

getting_started_test.go

feat(tui): interactive getting-started tour, offered on first run

2026-07-03 10:52:50 +02:00

getting_started.go

fix(tui): make the tour's tool step trigger a real confirmation

2026-07-03 11:07:30 +02:00

mcp_test.go

feat(mcp): support protocol revision 2026-07-28

2026-08-24 10:45:37 +02:00

mcp.go

feat(lint): prevent direct stdout writes in libraries

2026-09-14 11:59:31 +02:00

mock_script_test.go

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

models_test.go

fix(models): preserve custom and gateway provider filters

2026-10-07 10:53:00 +02:00

models.go

fix(models): preserve custom and gateway provider filters

2026-10-07 10:53:00 +02:00

new.go

Merge pull request #4546 from dgageot/fix/probe-image-support-before-tui

2026-10-07 19:07:32 +00:00

otel_test.go

test(telemetry): use test context for shutdown

2026-08-27 10:59:22 +02:00

otel.go

chore(deps): bump OpenTelemetry to v1.47.0

2026-10-08 17:11:53 +02:00

payload.go

feat(config): add YAML safety mode defaults

2026-07-28 15:35:55 +02:00

plans_test.go

feat(plan)!: remove the session_plan toolset

2026-09-08 09:56:04 +02:00

plans_unix_test.go

feat(plan)!: remove the session_plan toolset

2026-09-08 09:56:04 +02:00

plans.go

refactor: adopt errors.AsType in error handlers

2026-09-23 16:09:09 +02:00

pull_test.go

feat(share): sign a DSSE-wrapped in-toto statement, not just the YAML bytes

2026-09-11 16:33:59 +02:00

pull.go

feat(share): sign a DSSE-wrapped in-toto statement, not just the YAML bytes

2026-09-11 16:33:59 +02:00

push_test.go

test(share): cover env key fallback; document file:// as a literal prefix

2026-09-04 14:00:22 +02:00

push.go

fix: scope OCI cache references by registry

2026-09-07 10:52:07 +02:00

record_test.go

feat: route evaluators through the models gateway, add OpenAI Decisions

2026-10-07 12:36:48 +02:00

record_tui_test.go

feat(tui): generate a TUI e2e test from a --record session

2026-07-02 13:38:59 +02:00

record_tui.go

feat(tui): generate a TUI e2e test from a --record session

2026-07-02 13:38:59 +02:00

record.go

feat: route evaluators through the models gateway, add OpenAI Decisions

2026-10-07 12:36:48 +02:00

root.go

fix: expand ~ in --data-dir and forward it to sandbox

2026-10-01 17:37:29 +02:00

run_autodiscovery_test.go

fix: address review findings on config flavors

2026-07-21 12:04:33 +02:00

run_config_propagation_test.go

test: cover CLI and API runtime configuration propagation

2026-10-07 12:14:54 +02:00

run_event_hooks_test.go

enable t.Parallel() across the test suite, drop the TestParallel lint cop

2026-06-30 16:17:13 +02:00

run_event_hooks.go

chore: suppress intentional detached-context roots (Lint/ContextConnectivity)

2026-06-29 10:16:55 +02:00

run_last_test.go

feat: add --last flag for exec to print only the final answer

2026-10-04 16:04:46 +02:00

run_listen_test.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

run_listen.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

run_runtime_opts_test.go

refactor(runtime): require context for runtime construction and title generators

2026-06-29 10:17:44 +02:00

run_session_test.go

feat(safety): add restricted mode for unattended runs

2026-08-13 11:34:36 +02:00

run_theme_detect_test.go

feat(tui): add opt-in "auto" theme following the terminal light/dark background

2026-07-07 13:10:27 +02:00

run_theme_test.go

feat(tui): add opt-in "auto" theme following the terminal light/dark background

2026-07-07 13:10:27 +02:00

run_user_config_test.go

refactor(config): split agent sources so embedders link only the source types they use

2026-09-04 09:21:52 +02:00

run_user_settings_test.go

feat(config): add YAML safety mode defaults

2026-07-28 15:35:55 +02:00

run_working_dir_test.go

fix(tui): reuse explicit working directory for new sessions

2026-08-24 09:47:00 +02:00

run_worktree_order_test.go

feat(worktree): resume sessions into their original worktree

2026-06-15 10:19:28 +02:00

run_worktree_test.go

enable t.Parallel() across the test suite, drop the TestParallel lint cop

2026-06-30 16:17:13 +02:00

run.go

fix: lock down REST session API against CSRF and DNS rebinding

2026-10-18 19:31:55 +02:00

safety_test.go

refactor(cli): share safety flag validation

2026-08-18 10:06:16 +02:00

sandbox_cancel_test.go

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

sandbox_cloud_test.go

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

sandbox_cloud.go

feat(sandbox): add cloud mode and v3 kit support

2026-09-25 15:02:30 +02:00

sandbox_cmd_test.go

fix(paths): preserve native Windows home directory

2026-07-31 16:32:05 +02:00

sandbox_cmd.go

fix(userconfig): harden global config file management

2026-07-08 11:55:11 +02:00

sandbox_data_dir_test.go

test(root): reuse an immutable CLI fixture launcher

2026-10-17 16:32:22 +02:00

sandbox_test.go

feat(sandbox): add cloud mode and v3 kit support

2026-09-25 15:02:30 +02:00

sandbox.go

fix: expand ~ in --data-dir and forward it to sandbox

2026-10-01 17:37:29 +02:00

selfupdate_test.go

fix: detect help flags anywhere in args to skip self-update

2026-06-03 17:22:27 +02:00

serve.go

feat: add docker agent serve chat command (OpenAI-compatible API)

2026-04-27 15:46:10 +02:00

session_db_test.go

test(cli): guard session DB wiring; docs follow-ups from review

2026-07-07 12:25:01 +02:00

session_workingdir_root_test.go

fix(server): contain API session working directories

2026-08-05 17:17:06 +02:00

sessions_test.go

refactor(cli): make this sessions diff, and resolve session references

2026-08-08 22:46:10 +03:30

sessions.go

refactor(cli): make this sessions diff, and resolve session references

2026-08-08 22:46:10 +03:30

setup_test.go

chore(config): bump DefaultModels to current-generation values

2026-09-03 08:39:01 +00:00

setup.go

feat(lint): prevent direct stdout writes in libraries

2026-09-14 11:59:31 +02:00

share.go

Move pull and push under cagent share (breaking change)

2026-02-17 07:51:51 +01:00

toolsets_cmd_test.go

test(cmd/root/toolsets_cmd_test.go): add toolsets command tests

2026-07-13 19:26:49 +03:30

toolsets_test.go

enable t.Parallel() across the test suite, drop the TestParallel lint cop

2026-06-30 16:17:13 +02:00

toolsets.go

feat(cmd/root/toolsets.go): add toolsets commandinto amazing docker agent

2026-07-13 19:26:49 +03:30

version.go

Add desktop_uuid in telemetry (next to user_uuid)

2026-03-30 12:59:14 +02:00