Claude d24f203d68 fix(security): encode URL path segments and bound SSE buffering ...

- endpoints: encodeURIComponent the id segments (task_id, app_id, node_id,
  schema_id) interpolated into request URLs. task_id in particular comes from
  the server's async-submit response and is fetched back with the bearer token
  attached, so an unencoded value could steer the authenticated follow-up
  request to a different path on the host.
- stream (SSE parser): cap the in-memory buffer (16 MiB). A stream that never
  emits a newline, or that builds one enormous event from many data: lines,
  could otherwise grow the buffer without bound and exhaust process memory.

https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1

2026-05-29 12:34:22 +00:00

..

cli

fix(security): stop leaking credentials and tighten on-disk permissions

2026-05-29 12:34:19 +00:00

core

fix(security): encode URL path segments and bound SSE buffering

2026-05-29 12:34:22 +00:00