All pull requests

Pull requests

• Fix flaky ModelManagerSuggestedTests: skip launch-time HF fetch under xctest

  #16·mimeding opened May 27, 2026Owner·3 of 9 tasks·

  ·

• Security: restrict dev-proxy.json to DEBUG + loopback-only targets

  #15·mimeding opened May 27, 2026Owner·4 of 9 tasks·

  ·

• Perf: ToolSearch loads only candidate rows from tool_index, not the whole table

  #14·mimeding opened May 27, 2026Owner·5 of 9 tasks·

  ·

• Perf: debounce Insights filter + stats so search-typing doesn't restall the UI

  #13·mimeding opened May 27, 2026Owner·5 of 9 tasks·

  ·

• Security: /pair lacks replay defense + per-IP rate limit — LAN flood / signature replay

  #12·mimeding opened May 27, 2026Owner·4 of 9 tasks·

  ·

• Security: validate extracted archive trees against ZIP-slip / symlink-escape

  #11·mimeding opened May 27, 2026Owner·4 of 9 tasks·

  ·

• Security: WorkFolderTools.resolvePath ignores symlinks — escape via symlink possible

  #10·mimeding opened May 27, 2026Owner·4 of 9 tasks·

  ·

• Security: plugin SSRF guard runs once — redirects bypass it

  #9·mimeding opened May 27, 2026Owner·2 of 9 tasks·

  ·

• Perf: drop O(n²) string accumulation in agent SSE response loop

  #8·mimeding opened May 27, 2026Owner·3 of 9 tasks·

  ·

• Fix: ChatEngine never actually throws 503 — every routing failure becomes 404

  #7·mimeding opened May 27, 2026Owner·4 of 9 tasks·

  ·

• Fix: extend ChatEngine HTTP-status mapping to Anthropic /messages and Open Responses /responses

  #6·mimeding opened May 27, 2026Owner·2 of 9 tasks·

  ·

• Perf/privacy: gate hot-path stream print() statements behind #if DEBUG

  #5·mimeding opened May 27, 2026Owner·3 of 9 tasks·

  ·

• Fix: /memory/ingest hardcodes source_mode=chat, partially defeats #877 partition

  #4·mimeding opened May 26, 2026Owner·4 of 9 tasks·

  ·

• Security: redact paired API key from Insights log ring buffer

  #3·mimeding opened May 26, 2026Owner·2 of 9 tasks·

  ·

• Fix: /chat/completions logs status 500 even when the wire status is 404/503

  #2·mimeding opened May 26, 2026Owner·2 of 9 tasks·

  ·

• Fix: memory-context cache survives invalidation, leaking stale snapshots

  #1·mimeding opened May 26, 2026Owner·4 of 9 tasks·

  ·