From 1b5a742711359f7ece4345583614c29e2cb49674 Mon Sep 17 00:00:00 2001 From: dtzp555-max Date: Sun, 31 May 2026 13:19:10 +1000 Subject: [PATCH] =?UTF-8?q?chore(release):=20v3.17.1=20=E2=80=94=20code-au?= =?UTF-8?q?dit=20P1/P2=20hardening=20(crash=20fixes=20+=20multi-tenant=20g?= =?UTF-8?q?ates)=20(#107)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: dtzp555 --- CHANGELOG.md | 20 ++++++++++++++++++++ package.json | 2 +- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 800d790..b4d3f89 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,26 @@ ## Unreleased +## v3.17.1 — 2026-05-31 + +### Fix — code-audit P1/P2 hardening + +Fixes from a multi-agent code audit (3 P1 + 5 P2, adversarially verified). The single-user default path (`AUTH_MODE=none`, no TUI) is behavior-identical. + +**Availability / correctness (P1):** +- Guard `proc.stdin` against EPIPE — a fast-failing spawned `claude` (auth error, bad model, large prompt) no longer crashes the single-process daemon. +- Add `unhandledRejection`/`uncaughtException`/`clientError` safety nets + wrap all request-body read loops — a client aborting mid-upload no longer crashes the daemon. +- TUI transcript reader: only `turn_duration` is terminal (was also `tool_use`), which silently truncated any TUI turn that used a built-in tool. + +**Security gates / cache integrity (P2):** +- `AUTH_MODE=multi`: the default spawn now passes `--disallowedTools` (Bash/Read/Write/Edit/…) so a guest prompt cannot drive operator-filesystem tools. Single-user path unchanged. +- `/sessions` (DELETE), `/settings` (PATCH), `/logs`, `/usage`, `/status` are now admin-gated (were dispatched before the admin check). +- Streaming path no longer caches an `is_error` response as success (cache-poisoning fix). +- TUI fail-loud guard extended to `none`+`0.0.0.0` (unless `OCP_TUI_ALLOW_LAN=1`) and `+ PROXY_ANONYMOUS_KEY`. +- TUI `send-keys` paste uses `-l` (literal) so a prompt equal to a tmux key token (e.g. `C-c`) is typed, not interpreted. + +--- + ## v3.17.0 — 2026-05-31 ### Provider — default claude invocation ported to stream-json + `--system-prompt` (Phase 6c) diff --git a/package.json b/package.json index dec08ed..394c92a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "open-claude-proxy", - "version": "3.17.0", + "version": "3.17.1", "description": "OCP (Open Claude Proxy) — use your Claude Pro/Max subscription as an OpenAI-compatible API for any IDE. Works with Cline, OpenCode, Aider, Continue.dev, OpenClaw, and more.", "type": "module", "bin": {