Peter Steinberger 66a939526e fix(skills): bound installer downloads (#129630) ...

* fix(skills): bound installer downloads

Direct skill dependency response bodies are capped at 256 MiB while streaming, preventing headerless or broken endpoints from consuming unbounded staging disk while preserving supported bundled artifacts.

Refs #81817

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: Andrii Furmanets <furmanets.andriy@gmail.com>

* fix(skills): reject oversized declared downloads

Cancel trustworthy identity Content-Length values above the shared 256 MiB
ceiling before opening the staging writer. Keep encoded or malformed
declarations on the authoritative decoded-stream byte cap.

Refs #81817

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: Andrii Furmanets <furmanets.andriy@gmail.com>

---------

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Co-authored-by: Andrii Furmanets <furmanets.andriy@gmail.com>

2026-08-25 17:17:35 -07:00

..

acp-agents-setup.md

fix: surface Codex input prompts across runtimes (#126387)

2026-08-19 15:25:33 -07:00

acp-agents.md

fix: surface Codex input prompts across runtimes (#126387)

2026-08-19 15:25:33 -07:00

agent-send.md

docs(cli): cross-link agent exec from automation and policy pages (#114034)

2026-07-26 01:19:11 -04:00

apply-patch.md

fix(agents): apply_patch destroys an existing file when a patch creates that path (#114911)

2026-07-29 20:17:54 +08:00

ask-user.md

fix(ui): keep stable chat rows in insertion order and only sort live tool/stream items by timestamp (#113266)

2026-07-27 02:08:22 -04:00

brave-search.md

…

browser-control.md

docs: replace retired config keys with canonical schema keys (#121330)

2026-08-09 20:30:43 -07:00

browser-linux-troubleshooting.md

…

browser-login.md

…

browser-wsl2-windows-remote-cdp-troubleshooting.md

feat(docs-ci): validate docs config examples against the schema (#121336)

2026-08-10 07:57:56 -07:00

browser.md

fix(browser): keep guarded CDP sockets on validated endpoints [AI] (#114506)

2026-08-12 16:16:12 +05:30

btw.md

fix: simplify session companion grounding

2026-08-12 03:26:33 +01:00

capability-cookbook.md

…

chrome-extension.md

fix(browser): support Chrome Web Store native bootstrap (#124775)

2026-08-16 14:20:47 -07:00

clawhub.md

…

code-execution.md

…

code-mode.md

fix: agents continue after Code Mode tool and JavaScript errors (#128088)

2026-08-23 14:51:00 -07:00

creating-skills.md

fix: keep always within OS compatibility (#123731)

2026-08-14 17:54:42 +01:00

custodian-skills.md

fix(agents): consolidate ambient owner resolution (#126504)

2026-08-19 18:54:32 -07:00

diffs.md

refactor(canvas): make the panel a widget presenter (#126030)

2026-08-19 08:21:07 -07:00

duckduckgo-search.md

feat(plugins): externalize DuckDuckGo search (#116740)

2026-07-31 18:49:07 +08:00

elevated.md

…

exa-search.md

…

exec-approvals-advanced.md

refactor(infra): move exec approvals into the shared SQLite state DB (#114063)

2026-07-26 06:39:23 -04:00

exec-approvals.md

feat(approvals): scoped standing grants make recurring cron automations approvable once (#129526)

2026-08-25 16:17:58 -07:00

exec.md

fix(exec): align Guardian approvals for bound compound plans (#128279)

2026-08-23 22:07:14 -07:00

firecrawl.md

…

gemini-search.md

feat(google): allow operator headers on Gemini web search (#115549)

2026-08-02 01:41:09 +10:00

goal.md

fix(inference): harden Codex streaming, cancellation, and live QA (#116012)

2026-07-31 21:29:33 -07:00

grok-search.md

…

image-generation.md

docs: explain OpenRouter image route compatibility (#101367)

2026-08-15 20:41:41 +01:00

index.md

fix(agents): enforce session permissions for shared terminal input (#129604)

2026-08-25 15:59:28 -07:00

kimi-search.md

…

llm-task.md

feat(agents): add tool-free isolated completion (#114343)

2026-07-30 13:24:45 -05:00

lobster.md

refactor(plugins)!: remove OpenProse (#128494)

2026-08-24 10:39:46 +05:30

loop-detection.md

docs: repair spellcheck and anchor drift (#122960)

2026-08-12 20:50:56 -07:00

mcp.md

fix(mcp): listen on the OAuth loopback redirect during mcp login (#120433)

2026-08-07 19:29:13 -07:00

media-overview.md

docs: add cross-client media playback guide (#116005)

2026-07-29 13:00:40 -04:00

minimax-search.md

…

multi-agent-sandbox-tools.md

fix(google): align unsupported CLI auth paths (#118034)

2026-08-03 00:13:19 +08:00

music-generation.md

docs: replace retired config keys with canonical schema keys (#121330)

2026-08-09 20:30:43 -07:00

ollama-search.md

…

parallel-search.md

…

pdf.md

docs: replace retired config keys with canonical schema keys (#121330)

2026-08-09 20:30:43 -07:00

permission-modes.md

fix: surface Codex input prompts across runtimes (#126387)

2026-08-19 15:25:33 -07:00

perplexity-search.md

…

plugin.md

feat(ui): review install policy warnings (#120900)

2026-08-15 13:07:02 +10:00

progress-card.md

fix(ui): show accessible last activity on session progress cards (#129520)

2026-08-25 15:47:56 -07:00

reactions.md

…

screen.md

docs: repair spellcheck and anchor drift (#122960)

2026-08-12 20:50:56 -07:00

searxng-search.md

fix(security): prevent blocked SearXNG refs from using ambient URLs (#126214)

2026-08-19 00:02:58 -07:00

self-learning.md

fix(skills): fork the foreground session for lean experience review (#129282)

2026-08-25 20:27:25 +05:30

show-widget.md

fix(dashboard): open widget links through the host instead of sandbox popups (#128125)

2026-08-23 08:47:04 -07:00

skill-workshop.md

fix(skills): fork the foreground session for lean experience review (#129282)

2026-08-25 20:27:25 +05:30

skills-config.md

feat(skills): custodian-only skill library (first wave) (#126186)

2026-08-19 00:33:02 -07:00

skills.md

fix(skills): bound installer downloads (#129630)

2026-08-25 17:17:35 -07:00

slash-commands.md

refactor(plugins)!: remove OpenProse (#128494)

2026-08-24 10:39:46 +05:30

steer.md

…

subagents.md

feat(sessions): expose sidebar category controls (#126074)

2026-08-18 19:41:35 -06:00

swarm.md

fix(agents): preserve Swarm collector errors (#123468)

2026-08-13 22:05:10 -07:00

tavily.md

…

thinking.md

refactor(agents): remove redundant heartbeat system prompts (#129642)

2026-08-25 16:10:22 -07:00

tokenjuice.md

…

tool-search.md

feat(tools): support batched tool search queries (#118623)

2026-08-05 16:28:10 +10:00

trajectory.md

…

tts.md

feat(docs-ci): validate docs config examples against the schema (#121336)

2026-08-10 07:57:56 -07:00

video-generation.md

docs: replace retired config keys with canonical schema keys (#121330)

2026-08-09 20:30:43 -07:00

web-fetch.md

feat(cron): add webhook SSRF policy (#118237) (#118286)

2026-08-02 17:02:20 -07:00

web.md

fix(codex): enforce hosted search domains for web fetch (#125574)

2026-08-17 21:49:35 -07:00