fix: security hardening batch 1 (SEC-002 through SEC-010)#548

Merged

johntmyers merged 10 commits intomainfrom

fix/security-hardening-batch-1

Mar 23, 2026

Commits on Mar 23, 2026

fix(l7): reject ambiguous HTTP framing in REST proxy (SEC-009)
johntmyers
committed
fix(server): harden shell_escape and command construction (SEC-002)
johntmyers
committed
fix(server): add command validation at SSH transport boundary (SEC-003)
johntmyers
committed
fix(sandbox): validate port range and extend loopback check in SSH (SEC-007)
johntmyers
committed
fix(sandbox): sanitize inference error messages returned to sandbox (SEC-008)
johntmyers
committed
fix(server): block internal IPs in SSH proxy target validation (SEC-006)
johntmyers
committed
fix(sandbox): add resource limits to chunked body parser (SEC-010)
johntmyers
committed
fix(cli): double-escape command for SSH path, validate host and name (SEC-004)
johntmyers
committed
fix(sandbox): add CIDR breadth warning and control-plane port blocklist (SEC-005)
johntmyers
committed
test(e2e): update assertion for sanitized inference error message (SEC-008)
johntmyers
committed