4.0.1 - #30
Merged
Merged
4.0.1#30
Conversation
…ev#22 + live xCloudDev#8 bugs Wrapper (scripts/xcloud.sh): - xCloudDev#14: refuse plaintext http:// base URLs without XCLOUD_ALLOW_INSECURE_HTTP=1 (local dev only); refuse non-http(s) schemes outright. - xCloudDev#15: redact the bearer token from all curl stderr (verbose traces) via literal string replacement — safe for any token content. - xCloudDev#16: deliver bodies to curl via stdin (--data-binary @-), never argv; new `-` body argument reads the wrapper's stdin for secret-bearing payloads. JSON-argument form unchanged for compatibility. - New offline suite scripts/tests/wrapper-test.sh (fake token + local echo server): 8 tests covering refusal paths, redaction, stdin/argv round-trips, and unchanged envelope/exit-code behavior. Skill docs (xCloudDev#16/xCloudDev#17): SSL custom-cert, sudo-user, and site-SSH password examples now build JSON with jq -n and pipe via stdin. Shared conventions: "Untrusted output" prompt-injection defense (xCloudDev#18) and a written high-risk-write confirmation policy with pre-authorized batch override, matching the MCP confirm contract on the REST path (xCloudDev#19). Auth guidance (xCloudDev#21): hosted-chat rules — scoped short-lived tokens only, never `*` in chat, plus compromise rotation/revocation steps. Legacy src/: - xCloudDev#17: xcloud-api.sh / xcloud-cli.sh payloads built with jq -n; new offline src/tests/json-safety-test.sh (8 tests: hostile quotes, control chars, field-injection attempts). - xCloudDev#22: xcloud_async.py state files written 0600 with secret fields masked; path expanduser + safe parent creation. - xCloudDev#8 BUG-02: poller readiness accepts live shapes (is_provisioned / status). - xCloudDev#8 BUG-03: CLI no longer crashes on empty extra_args under set -u. - xCloudDev#8 BUG-01: CLI ssl provider letsencrypt -> xcloud (both valid per current spec; xcloud is the managed default). CI (xCloudDev#20 partial, xCloudDev#26): version-consistency check across plugin.json, marketplace.json, .clawhubinfo.json, and root SKILL.md; both offline test suites; script-safety pattern check (no --data-raw in scripts, no unredacted curl -v in src/). claude.ai dist rebuilt from the updated sources. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RPGasDwB6UVZXsMR6ij4YU
…e-ge2x72 Security hardening: fix upstream issues xCloudDev#14–xCloudDev#22, xCloudDev#8 live bugs; partial xCloudDev#20/xCloudDev#26
Cut the security-hardening batch as its own release, ready to tag: - CHANGELOG: new [4.0.1] entry with a per-issue status table referencing xCloudDev/xcloud-agent-skills issues — Fixed: xCloudDev#14 xCloudDev#15 xCloudDev#16 xCloudDev#17 xCloudDev#18 xCloudDev#19 xCloudDev#21 xCloudDev#22; live bugs from xCloudDev#8 fixed (BUG-01/02/03, doc findings superseded); Partial: xCloudDev#20 (CI safety lint landed, runtime hooks deferred), xCloudDev#26 (version gate landed, directory submission is a maintainer action); Superseded: xCloudDev#6. The security section moved out of [4.0.0] into [4.0.1]. - Version 4.0.1 everywhere the version appears: plugin.json, marketplace.json, .clawhubinfo.json (+ v4.0.1 changelog block), root SKILL.md (frontmatter, heading, badge), README (badge + intro), conventions.md startup banner, SKILLS-GUIDE. - Release-readiness sweep for the new HTTPS enforcement: every local-dev instruction that sets http://xcloud.test now also sets XCLOUD_ALLOW_INSECURE_HTTP=1 (auth.md, ssl SKILL.md, .env.example, SKILLS-GUIDE install + smoke sections). - SKILLS-GUIDE: the databases example is now caveated as unavailable on the current public API (404 — see docs/API-COVERAGE.md) and its secret-bearing call uses the stdin form. - claude.ai dist rebuilt (banner shows v4.0.1). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RPGasDwB6UVZXsMR6ij4YU
…e-ge2x72 chore(release): v4.0.1 — version bumps, per-issue status, release readiness
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.