fix: v0.8.0 pre-release hardening — command injection, UI-thread spawns, zero-warning build - #129

Merged

AThraen merged 6 commits into

mainfrom

fix/prerelease-review-round1

Sep 8, 2026

Commits on Sep 8, 2026

fix: pre-release review findings — command injection, UI-thread spawns, warnings

AThraen
and
claude
committed
9bed238
fix: round-2 review findings, including two in round 1's own fix

AThraen
and
claude
committed
835b1c7
fix: round-3 findings — ssh host injection, cmd-shaped drop quoting, CI blocker

AThraen
and
claude
committed
d4e4269
fix: round-4 — ssh remote command escaping, drop-payload bounds, sentinel hardening

AThraen
and
claude
committed
2241b69
fix: round-5 — close the last two ShellExecute/PTY inconsistencies

AThraen
and
claude
committed
193ecc9
docs(run): correct the send-to-Claude comment, which described the opposite

AThraen
and
claude
committed
f8ea4bf