3 Commits

Author	SHA1	Message	Date
James Feng	70bc47eadc	fix(security): Phase 4 — fix remaining reachable CodeQL alerts ... Command injection (real fix): - which.ts: switch to array-args execa, remove shell:true - execFileNoThrowPortable/execSyncWrapper/imagePaste/execFileNoThrow: security comments Log injection: - handlers/mcp.tsx: security comments (secrets already redacted) ReDoS: - debugFilter.ts: split regex, add input length guard Sanitization bypass: - stripHtml.ts: loop-based script/style removal - claudemd.ts: loop-based HTML comment stripping - sedEditParser.ts: single-pass char scan replaces chained replaces - bingAdapter.ts: URL.hostname comparison instead of string includes Tests: 3068 pass, 0 fail	2026-06-03 19:51:17 +08:00
James Feng	a249bbe9a6	fix(security): extract shared stripHtmlToText() utility (fixes #18-24) ... - Create src/utils/stripHtml.ts with he-based HTML-to-text conversion - Replace bingAdapter's inline regex+decodeHtmlEntities with stripHtmlToText() - Replace WebBrowserTool's inline regex chain with stripHtmlToText() - Add stripHtml.test.ts with 6 test cases - Update bingAdapter test expectation for whitespace normalization Test: 3068 pass, 0 fail	2026-06-03 17:05:49 +08:00
James Feng	39ba9a56fd	feat: pull in Vite build system + complete packages/builtin-tools/ ... - Add Vite as alternative build (vite.config.ts, scripts/vite-plugin-*) - Add dab04af7 RSS fix (distRoot, ripgrep path, post-build) - Pull in packages/builtin-tools/ (+354 files) - Pull in packages/agent-tools/, mcp-client/, acp-link/, weixin/ - Copy defines.ts from upstream for Vite compatibility - Update package.json with Vite scripts and deps	2026-06-01 18:18:03 +08:00