📡 2026-07-07 10:48 UTC
📝 Commits to main (38 new)
⚠️ Relevant to our work
- ⚠️
a00e9fc2 fix(ssrf): block loopback addresses for trusted hostname origins (#100835) (#100835)
- ⚠️
a2a68d15 fix(agent): preserve explicit recipient sessions (#101507) (#101507)
Other commits (36)
c2cc50c9 fix(codex): use UTF-16-safe truncation for approval display paths (#100177) (#100177)040ac315 fix: route direct outbound polls through channel adapters (#99950) (#99950)5511b6fc fix(status): keep issue message truncation UTF-16 safe (#101503) (#101503)846195c6 fix(codex): handle app-server stdio stream errors (#101505) (#101505)942b4496 fix(exec): keep pending approval warnings truthful (#101561) (#101561)036686ab refactor(memory): localize host SDK helpers (#101568) (#101568)cd5c3fc3 fix(mcp): reject non-object tool call arguments (#99180) (#99180)cba20f9a docs(changelog): credit Discord thread title fix (#101566) (#101566)903a09ab fix(android): bound link preview image cache (#101560) (#101560)9fb24032 fix(discord): keep thread title prompts UTF-16 safe (#101551) (#101551)f14eb97a fix(codex): honor Pro reasoning effort contracts (#101484) (#101484)6e792f08 fix(ios): serialize screen recording finalization (#101550) (#101550)61dce7cb fix: forward pending timeout snapshot in waitForAgentJob fallback timer (#89367) (#89367)079a704d fix(voice-call): keep realtime context truncation UTF-16 safe (#101304) (#101304)395fbb8e fix(ui): send approvals past busy chat queue (#101532) (#101532)6b76a306 fix(zalo): accept opaque string chat IDs (#101548) (#101548)5a234d61 feat(ui): redesign dashboard chrome with tiny top bar and sidebar search (#101497) (#101497)24048717 fix(web-fetch): keep spill content truncation UTF-16 safe (#101312) (#101312)037412ec ci(mantis): add web UI chat proof lane (#100472) (#100472)354a1515 feat(gateway): archive-gated session deletes give Android delete parity (#101522) (#101522)9133d552 fix: block mixed-case cron shell jobs from agent tool [AI] (#101350) (#101350)7e995cbf refactor(ui): remove stale helper exports (#101549) (#101549)b84ae420 fix(agents): keep prompt data truncation UTF-16 safe (#101303) (#101303)d01015b2 Fix UTF-16-safe audit context truncation (#101298) (#101298)6125dd95 feat(android): og:image thumbnails on link preview cards (#101396) (#101396)0f775fa2 fix(msteams): bound Microsoft Graph API response reads in graph-upload to prevent OOM (#97784) (#97784)9cd29dcb test(android): stabilize saved gateway reconnect proof (#101519) (#101519)78399a19 refactor(agent-core): localize exec timeout helper (#101523) (#101523)508296f1 feat(ios): og:image thumbnails on link preview cards (#101387) (#101387)bc5a82b2 fix(android): auto-detect the Android SDK when fresh worktrees lack local.properties (#101273) (#101273)ccbd9eb2 fix(qqbot): keep bounded previews UTF-16 safe (#101516) (#101516)ef985ecd fix(gateway): reset channel restart counter after a stable run (#101413) (#101413)13c1d3c4 fix(backup): close archive stream before retry cleanup (#101464) (#101464)2e4e982f refactor(memory): localize host SDK internals (#101508) (#101508)c1f9087e fix(cli): accept parent options placed after lazy subcommands (#55563 regression 1) [AI-assisted] (#94431) (#94431)24330a82 fix(mattermost): reject oversized websocket events (#99366) (#99366)
📁 Areas touched
- extensions/ (99 files)
- ui/ (80 files)
- src/ (65 files)
- packages/ (20 files)
- apps/ (15 files)
- CHANGELOG.md/ (7 files)
- docs/ (5 files)
- test/ (5 files)
- scripts/ (3 files)
- .github/ (2 files)
- package.json/ (1 files)
⚠️ Capped at 50 commits (total: 62)
📡 2026-07-07 10:48 UTC
📝 Commits to main (38 new)
a00e9fc2fix(ssrf): block loopback addresses for trusted hostname origins (#100835) (#100835)a2a68d15fix(agent): preserve explicit recipient sessions (#101507) (#101507)Other commits (36)
c2cc50c9fix(codex): use UTF-16-safe truncation for approval display paths (#100177) (#100177)040ac315fix: route direct outbound polls through channel adapters (#99950) (#99950)5511b6fcfix(status): keep issue message truncation UTF-16 safe (#101503) (#101503)846195c6fix(codex): handle app-server stdio stream errors (#101505) (#101505)942b4496fix(exec): keep pending approval warnings truthful (#101561) (#101561)036686abrefactor(memory): localize host SDK helpers (#101568) (#101568)cd5c3fc3fix(mcp): reject non-object tool call arguments (#99180) (#99180)cba20f9adocs(changelog): credit Discord thread title fix (#101566) (#101566)903a09abfix(android): bound link preview image cache (#101560) (#101560)9fb24032fix(discord): keep thread title prompts UTF-16 safe (#101551) (#101551)f14eb97afix(codex): honor Pro reasoning effort contracts (#101484) (#101484)6e792f08fix(ios): serialize screen recording finalization (#101550) (#101550)61dce7cbfix: forward pending timeout snapshot in waitForAgentJob fallback timer (#89367) (#89367)079a704dfix(voice-call): keep realtime context truncation UTF-16 safe (#101304) (#101304)395fbb8efix(ui): send approvals past busy chat queue (#101532) (#101532)6b76a306fix(zalo): accept opaque string chat IDs (#101548) (#101548)5a234d61feat(ui): redesign dashboard chrome with tiny top bar and sidebar search (#101497) (#101497)24048717fix(web-fetch): keep spill content truncation UTF-16 safe (#101312) (#101312)037412ecci(mantis): add web UI chat proof lane (#100472) (#100472)354a1515feat(gateway): archive-gated session deletes give Android delete parity (#101522) (#101522)9133d552fix: block mixed-case cron shell jobs from agent tool [AI] (#101350) (#101350)7e995cbfrefactor(ui): remove stale helper exports (#101549) (#101549)b84ae420fix(agents): keep prompt data truncation UTF-16 safe (#101303) (#101303)d01015b2Fix UTF-16-safe audit context truncation (#101298) (#101298)6125dd95feat(android): og:image thumbnails on link preview cards (#101396) (#101396)0f775fa2fix(msteams): bound Microsoft Graph API response reads in graph-upload to prevent OOM (#97784) (#97784)9cd29dcbtest(android): stabilize saved gateway reconnect proof (#101519) (#101519)78399a19refactor(agent-core): localize exec timeout helper (#101523) (#101523)508296f1feat(ios): og:image thumbnails on link preview cards (#101387) (#101387)bc5a82b2fix(android): auto-detect the Android SDK when fresh worktrees lack local.properties (#101273) (#101273)ccbd9eb2fix(qqbot): keep bounded previews UTF-16 safe (#101516) (#101516)ef985ecdfix(gateway): reset channel restart counter after a stable run (#101413) (#101413)13c1d3c4fix(backup): close archive stream before retry cleanup (#101464) (#101464)2e4e982frefactor(memory): localize host SDK internals (#101508) (#101508)c1f9087efix(cli): accept parent options placed after lazy subcommands (#55563 regression 1) [AI-assisted] (#94431) (#94431)24330a82fix(mattermost): reject oversized websocket events (#99366) (#99366)📁 Areas touched