Fix/bug hunt round 2 - #271

Merged

robdmac merged 10 commits into

mainfrom

fix/bug-hunt-round-2

Jul 17, 2026

Commits on Jul 17, 2026

test(desktop): smoke scripts support dynamic ports + grace-aware ghost reconcile

robdmac
and
claude
committed
72fe576
fix(controlplane): bug-hunt round 2 — IDOR, input-validation 500s, races

robdmac
and
claude
committed
f8c5ba8
fix(sandbox): bug-hunt round 2 — browser orphan leak + races/leaks

robdmac
and
claude
committed
23d80bb
fix(desktop): bug-hunt round 2 — orcabot import tar zip-slip + symlink planting

robdmac
and
claude
committed
60bd271
test(controlplane): update recipe fixtures for owner-scoped global recipes

robdmac
and
claude
committed
0957d15
style(controlplane): tighten fix comments; drop internal references

robdmac
and
claude
committed
f22c4af
fix(controlplane): address review of the round-2 fixes

robdmac
and
claude
committed
4fb3ca3
fix(desktop): review — orcabot import stages then merges; cap decoder, stream files

robdmac
and
claude
committed
ecb3de8
fix(sandbox): review — openat/O_NOFOLLOW workspace write walk; fix Linux build

robdmac
and
claude
committed
fe7a650
style: make fix comments succinct

robdmac
and
claude
committed
b1034bf