security: bound fetch_url destination and redirects - #11015

Open

undivisible wants to merge 37 commits into

mainfrom

security/transport-egress

Commits on Aug 2, 2026

fix(backend): enforce fetch_url destination policy
undivisible
committed
50e6966
fix(fetch-url): require exact user-typed destinations
undivisible
committed
1fc1125
ci(release): align mobile cadence hygiene guard
undivisible
committed
58a6705
test(ci): make mobile cadence fixture hermetic
undivisible
committed
c503bfe
ci: refresh checks against corrected baseline
undivisible
committed
37f1e0e
security(fetch-url): canonicalize allowlist requests
undivisible
committed
910a4e1
security(fetch-url): bind requests to exact URLs
undivisible
committed
8661d75
security(agent-vm): remove unscoped URL tools
undivisible
committed
c6f8f59
ci(mobile): preserve stale-run cancellation
undivisible
committed
6cb6e69
security(fetch-url): include path parameters
undivisible
committed
690a15c
fix(ci): preserve active mobile dispatches
undivisible
committed
de6a2e2

Commits on Aug 3, 2026

fix(security): preserve exact user URL allowlists
undivisible
committed
36f700d
fix(ci): verify mobile dispatch guard coverage
undivisible
committed
6a2d618
Merge remote-tracking branch 'origin/main' into security/transport-egress
undivisible
committed
7912546
test(security): lock URL and release guard contracts
undivisible
committed
35e2f39
fix(ci): restore Dart formatting after main merge
undivisible
committed
911303b
fix(ci): match CI Dart formatting
undivisible
committed
7d7209a
fix(security): close URL and dispatch guard gaps
undivisible
committed
b40c61b
docs(agent): state removed VM fetch tool contract
undivisible
committed
68c4ebb

Commits on Aug 4, 2026

security: distinguish URL delimiter punctuation
undivisible
committed
00e7a6d
security: strip markdown URL delimiters
undivisible
committed
e8da789
security: harden URL and tool egress
undivisible
committed
b42916f

Commits on Aug 9, 2026

test(backend): restore the real memory-boundary module in the route-shape fixture (PR #11015)
undivisible
committed
e2d8b75

Commits on Aug 10, 2026

Commits on Aug 11, 2026

Commits on Aug 13, 2026