clawpanel

mirror of https://github.com/qingchencloud/clawpanel.git synced 2026-06-23 00:24:03 +08:00

Files

Cursor Agent 08dbf4b661 fix(security): block Hermes FS traversal and revoked token reuse

- Reject ParentDir (..) in Hermes file manager paths and validate via
  canonical ancestors instead of non-canonical starts_with prefix checks
- Rotate operator tokens when revokedAtMs is set instead of silently
  re-issuing the same revoked token during auto-pair normalization

Fixes path traversal allowing reads/writes outside ~/.hermes and
revocation bypass introduced in the v0.18.1 pairing upgrade path.

Co-authored-by: 晴天 <1186258278@users.noreply.github.com>

2026-06-13 12:19:57 +00:00