fix: security hardening batch 1 (SEC-002 through SEC-010) - #548

Merged

johntmyers merged 10 commits into

mainfrom

fix/security-hardening-batch-1

Mar 23, 2026

Commits on Mar 23, 2026

fix(l7): reject ambiguous HTTP framing in REST proxy (SEC-009)
johntmyers
committed
8084879
fix(server): harden shell_escape and command construction (SEC-002)
johntmyers
committed
ed9095d
fix(server): add command validation at SSH transport boundary (SEC-003)
johntmyers
committed
319de93
fix(sandbox): validate port range and extend loopback check in SSH (SEC-007)
johntmyers
committed
ea1a926
fix(sandbox): sanitize inference error messages returned to sandbox (SEC-008)
johntmyers
committed
13a55c6
fix(server): block internal IPs in SSH proxy target validation (SEC-006)
johntmyers
committed
d556e5a
fix(sandbox): add resource limits to chunked body parser (SEC-010)
johntmyers
committed
68044e9
fix(cli): double-escape command for SSH path, validate host and name (SEC-004)
johntmyers
committed
ef90799
fix(sandbox): add CIDR breadth warning and control-plane port blocklist (SEC-005)
johntmyers
committed
4ff0d12
test(e2e): update assertion for sanitized inference error message (SEC-008)
johntmyers
committed
25f34df