spawn/sh
A d046a9bfdf
fix: tighten character whitelist for cloud_headless_env values (#2890)
The env value whitelist allowed @, %, +, =, :, and , characters that
are unnecessary for cloud resource names (server names, regions, sizes)
and could be used as shell metacharacters in certain contexts. Restrict
to only [A-Za-z0-9._/-] which matches all legitimate cloud resource
identifiers.

Fixes #2883

Agent: code-health

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-23 08:41:50 +07:00
..
aws docs: add missing agent entries to all cloud READMEs (#2494) 2026-03-11 05:49:50 -04:00
cli feat(cli): add spawn uninstall command (#2724) 2026-03-17 16:33:09 -07:00
digitalocean fix(do): skip _run_with_restart in headless mode to prevent duplicate droplets (#2805) 2026-03-19 16:12:25 -07:00
docker feat: add junie Dockerfile for Docker image builds (#2601) 2026-03-13 19:40:51 -07:00
e2e fix: tighten character whitelist for cloud_headless_env values (#2890) 2026-03-23 08:41:50 +07:00
gcp feat(gcp): default boot disk to 40 GB, configurable via GCP_DISK_SIZE (#2867) 2026-03-22 11:21:05 +07:00
hetzner docs: add missing agent entries to all cloud READMEs (#2494) 2026-03-11 05:49:50 -04:00
local docs: add missing agent entries to all cloud READMEs (#2494) 2026-03-11 05:49:50 -04:00
shared fix: add sprite-keep-running.sh, remove Hetzner from Packer, cleanup on cancel (#2869) 2026-03-22 18:13:38 +00:00
sprite docs: add missing agent entries to all cloud READMEs (#2494) 2026-03-11 05:49:50 -04:00
test refactor: Remove dead code and stale references (#2062) 2026-03-01 11:45:24 -05:00