Jerry-Xin 6ec4e5cf4a fix: check effective UID (geteuid) in root guard ...

assertNotRoot only checked process.getuid(), so the guard was bypassed
when the CLI was launched with a non-root real UID but an effective UID
of 0 (e.g. via a setuid-root wrapper). In that context the process still
has root write privileges and can cause the same state/config corruption
the guard was added to prevent.

Now checks both getuid() and geteuid() — either being 0 triggers the
guard. Added three tests covering setuid-root scenarios.

2026-05-07 23:31:03 -04:00

..

acp

Implement ACP bridge lifecycle handlers (#78880)

2026-05-08 06:26:36 +10:00

agents

fix codex harness service tiers (#79152)

2026-05-08 12:10:41 +09:00

auto-reply

Fix Telegram model status Codex auth label (#79135)

2026-05-07 20:43:31 -04:00

bindings

…

bootstrap

…

channels

chore(channels): delete bluebubbles plugin package

2026-05-07 12:53:00 -07:00

chat

…

cli

fix: check effective UID (geteuid) in root guard

2026-05-07 23:31:03 -04:00

commands

fix: hide retired google gemini chat models

2026-05-07 22:20:07 -05:00

commitments

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

compat

…

config

fix: surface gateway version skew

2026-05-07 22:58:14 -04:00

context-engine

feat(plugin-sdk): add LLM completion API to plugin (#64294)

2026-05-07 19:27:48 -07:00

crestodian

Revert "Install Codex plugin on OpenAI model selection (#78799)" (#78878)

2026-05-07 18:13:59 +09:00

cron

fix: satisfy cron model selection checks

2026-05-07 22:47:04 +01:00

daemon

feat: add native sqlite Kysely dialect

2026-05-07 13:07:03 +01:00

docs

fix(docs): validate plugin json examples

2026-05-03 15:47:23 -07:00

flows

fix(test): align main channel assumptions

2026-05-07 13:03:49 -07:00

gateway

fix: hide retired google gemini chat models

2026-05-07 22:20:07 -05:00

hooks

test: generate hook install archives

2026-05-06 02:39:15 +01:00

i18n

…

image-generation

test: harden plugin and UI isolation checks

2026-05-04 11:46:05 +01:00

infra

fix: keep gateway watch sync tracing opt-in (#79110)

2026-05-07 16:40:35 -07:00

interactive

…

link-understanding

…

logging

feat(agents): implement state-aware failover and lane suspension

2026-05-07 18:34:05 -05:00

markdown

…

mcp

fix: resolve small triage issues

2026-05-04 07:38:42 +01:00

media

fix: share plugin runtime helpers

2026-05-08 00:28:43 +01:00

media-generation

fix(media): avoid provider listing for exact media defaults

2026-05-06 23:44:34 -07:00

media-understanding

refactor: stage external output writes through fs-safe

2026-05-07 06:05:24 +01:00

memory

…

memory-host-sdk

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

model-catalog

…

music-generation

…

node-host

fix: narrow Gateway proxy bypass target (#77018)

2026-05-06 14:40:31 +10:00

pairing

fix: repair iOS LAN pairing

2026-05-05 21:07:19 -05:00

plugin-sdk

fix: hide retired google gemini chat models

2026-05-07 22:20:07 -05:00

plugin-state

fix(plugin-state): preserve fresh evicted entries

2026-05-04 01:25:12 -07:00

plugins

feat(plugin-sdk): add LLM completion API to plugin (#64294)

2026-05-07 19:27:48 -07:00

process

feat(agents): implement state-aware failover and lane suspension

2026-05-07 18:34:05 -05:00

proxy-capture

fix: normalize debug proxy fetch headers

2026-05-06 15:40:33 +01:00

realtime-transcription

feat(voice-call): improve realtime Meet voice agent

2026-05-05 12:56:31 -07:00

routing

…

scripts

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

secrets

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

security

Clarify exec filesystem policy drift (#79153)

2026-05-07 20:05:19 -05:00

sessions

…

shared

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

status

fix: label claude cli oauth status

2026-05-07 05:52:12 +01:00

talk

fix(talk): add bounded lifecycle logging

2026-05-06 03:02:02 -07:00

tasks

fix: bound stale task reload blockers

2026-05-07 05:25:54 +01:00

terminal

…

test-helpers

…

test-utils

…

tools

…

trajectory

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

tts

refactor(runtime): add prepared runtime foundation (#78248)

2026-05-07 18:49:42 -03:00

tui

fix(openrouter): canonicalize auto selector refs

2026-05-07 05:48:14 +01:00

types

…

utils

Refactor file access to use fs-safe primitives (#78255)

2026-05-06 05:03:11 +01:00

video-generation

fix(video): recover generation parameter fallbacks

2026-05-04 22:26:58 -07:00

web

…

web-fetch

…

web-search

fix(web-search): scope explicit provider runtime loading

2026-05-03 23:47:35 -07:00

wizard

Revert "Install Codex plugin on OpenAI model selection (#78799)" (#78878)

2026-05-07 18:13:59 +09:00

browser-lifecycle-cleanup.test.ts

…

browser-lifecycle-cleanup.ts

…

docker-build-cache.test.ts

fix(docker): preserve functional image dependencies

2026-05-06 14:08:28 -07:00

docker-image-digests.test.ts

…

docker-setup.e2e.test.ts

fix(docker): pin container-side workspace and config dirs in compose

2026-05-04 16:03:51 -07:00

dockerfile.test.ts

fix(docker): normalize plugin build args

2026-05-04 15:16:22 -07:00

entry.compile-cache.test.ts

fix: clean up orphaned child processes (#77481)

2026-05-04 15:28:49 -07:00

entry.compile-cache.ts

fix: clean up orphaned child processes (#77481)

2026-05-04 15:28:49 -07:00

entry.respawn.test.ts

fix(tui): prevent orphaned terminal sessions (#77662)

2026-05-05 16:34:18 -07:00

entry.respawn.ts

fix(tui): prevent orphaned terminal sessions (#77662)

2026-05-05 16:34:18 -07:00

entry.test.ts

…

entry.ts

fix: add root guard to prevent CLI execution as root (#67478)

2026-05-07 23:31:03 -04:00

entry.version-fast-path.test.ts

…

entry.version-fast-path.ts

…

extensionAPI.ts

…

global-state.ts

…

globals.ts

…

index.test.ts

…

index.ts

fix: enforce root guard unconditionally on legacy entrypoint

2026-05-07 23:31:03 -04:00

install-sh-version.test.ts

…

library.test.ts

…

library.ts

…

logger.test.ts

…

logger.ts

…

logging.ts

test: add focused seams for faster isolated tests

2026-05-06 00:53:05 +01:00

param-key.ts

…

plugin-activation-boundary.test.ts

test: speed up changed test paths

2026-05-05 19:48:19 +01:00

poll-params.test.ts

…

poll-params.ts

…

polls.test.ts

…

polls.ts

…

runtime.ts

…

ui-app-settings.agents-files-refresh.test.ts

…

utils.test.ts

…

utils.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

version.test.ts

…

version.ts

…