deer-flow

mirror of https://github.com/bytedance/deer-flow.git synced 2026-10-26 21:26:39 +00:00

History

fix(lark): match broker subcommand denylist through separate option values (#6212 )

* fix(lark): match broker subcommand denylist through separate option values

The opt-in DEERFLOW_LARK_BROKER_DENY_SUBCOMMANDS check dropped only
`-`-prefixed tokens and compared the rest from the start, so the value in
`--profile work config show` became the leading positional and a
`config show` rule never matched. Real lark-cli 1.0.65 runs `config show`
for that shape and for `config --profile work show`.

The broker cannot know which options take a value, so a rule now matches
when its tokens appear in order among the non-flag tokens. A contiguous
match would still miss a value placed between the path tokens. Argument
values that spell a denied path in order are refused too (fail-closed).

* docs(changelog): reference #6212 for the lark broker denylist fix

* docs(lark): call denylist entries command paths, not prefixes

Entries are matched as in-order subsequences now, so the remaining
'prefix' wording in the BrokerConfig comment, the parse_deny_subcommands
and run_lark_cli docstrings, and the broker README undersold the rule.
Also rewrap the comment and docstring lines this PR had pushed past ~80
columns.

2026-10-03 15:58:01 +08:00

lark-cli-broker

fix(lark): match broker subcommand denylist through separate option values (#6212 )

2026-10-03 15:58:01 +08:00

lark-cli-init

docs(lark): drop dead link to uncommitted sandbox init spec (#4705 )

2026-08-08 20:46:36 +08:00

nginx

fix(nginx): canonicalize the loopback origin onto localhost (#6158 )

2026-10-02 19:06:23 +08:00

provisioner

fix(gateway): reject non-ASCII tokens instead of raising in constant-time compares (#6076 )