DottaandPaperclip 45f591120d fix(runner): bound encoded Hermes attachment messages ...

Count serialized message, attachments, and metadata before turn admission. Keep TypeScript and Rust on a 7 MiB encoded content allowance within the existing encrypted frame bound. Validate before active-turn state changes, and prove accepted images and escaped documents traverse the secure PRP command frame.

Validation: 28 attachment/permission tests, two encrypted-frame regressions, the Rust encoded-admission regression, and Runner TypeScript compilation passed.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-10-07 10:37:34 -05:00

..

adapter-utils

feat(runner): add native Hermes ACP qualification candidate

2026-10-07 10:29:19 -05:00

adapters

fix(hermes): keep managed instructions out of resumed user turns (#15439)

2026-10-07 07:07:32 -05:00

db

feat: enforce private task permissions across execution and data (#10633)

2026-10-07 07:06:40 -05:00

google-sheets-mcp-server

build(deps-dev): bump vitest from 4.1.11 to 5.0.3 (#12969)

2026-10-06 12:13:46 -07:00

kv-demo-mcp-server

build(deps-dev): bump vitest from 4.1.11 to 5.0.3 (#12969)

2026-10-06 12:13:46 -07:00

mcp-server

build(deps-dev): bump vitest from 4.1.11 to 5.0.3 (#12969)

2026-10-06 12:13:46 -07:00

paperclip-eval-kernel

…

paperclip-runner

fix(runner): bound encoded Hermes attachment messages

2026-10-07 10:37:34 -05:00

plugins

feat: add durable storage for private tasks (#14717)

2026-10-07 06:53:20 -05:00

shared

feat(runner): add native Hermes ACP qualification candidate

2026-10-07 10:29:19 -05:00

skills-catalog

Shorten planning skills and measure task decomposition (#15296)

2026-10-06 09:36:01 -05:00

tailscale-https-broker

build(deps-dev): bump vitest from 4.1.11 to 5.0.3 (#12969)

2026-10-06 12:13:46 -07:00

teams-catalog

fix(agents): reduce hiring templates to role descriptions (#14985)

2026-10-02 17:56:42 -05:00