fix: path confinement, error sanitization, secret redaction - #1

Merged

piotrlaczkowski merged 28 commits into

mainfrom

claude/production-readiness-audit-dhkcgw

Aug 25, 2026

Commits on Aug 24, 2026

fix(langchain): preserve message fidelity across checkpoints, REST, and streaming
claude
committed
929c4de
fix(security,storage,pipelines,optimize,deploy): production-readiness pass
claude
committed
e36952b
fix(security): close Studio API auth bypass and control-plane disable gap
claude
committed
0184928
fix: repair LangChain history/tool-call plumbing, CLI run, and OpenAPI hygiene
claude
committed
8f85dae
fix(security): confine ingestion paths, sanitise API errors, redact stack secrets
claude
committed
e9dd0bc
fix(templates): repair broken plugin scaffold and make all 16 render lint-clean
claude
committed
f6dcd1c
fix(scaffold,studio): stop leaking server paths, fix resume crash, quiet OTel
claude
committed
00d8aec
fix(plugins): make scaffolded ML plugins actually serve, and stop silent dead plugins
claude
committed
c785447
fix(logging,storage): one log line per request, one separator, one DDL pass
claude
committed
9c6bc57
fix(cli): honour --dir as a parent directory for `new`, clarify query vs current_query
claude
committed
88905dc
security: sweep the two bypass classes exhaustively, not by inspection
claude
committed
8b25f1f
security: close the async-path exception leaks the first sanitisation pass missed
claude
committed
b8909de
fix(api): store-dependent routes returned a bare 500 when no store is configured
claude
committed
248ed14
fix(api,studio): two more unhandled 500s, and sweep every route so they can't recur
claude
committed
a0ac17d
fix(studio,api): repair a checkpoint regression and five more error leaks
claude
committed
e557237
fix(studio): stop the run stream emitting two lifecycle events per run
claude
committed
dc48981
fix(cli,core): survive a version-skewed image and honour log_level at build
claude
committed
1f07c31
fix(deploy): make the distroless image actually start
claude
committed
6b5e741
docs(storage): correct the checkpointer serialization note
claude
committed
429a567
docs(langgraph): say when Studio's State and History panels stay empty
claude
committed
8208eba
fix(a2a,cli): stop dropping A2A message text, and name the deepagent dependency
claude
committed
a59aa62
test: sweep every route in the store-backed posture too
claude
committed
dedcb8d
fix(auth): make require_auth_globally with an API key a working configuration
claude
committed
9a4e0a0
feat(auth): let AUTH__JWKS_URL and the stack actually configure JWT verification
claude
committed
8ea26c2
fix(pipelines): discover the layout the CLI actually scaffolds
claude
committed
8188325
docs(rate-limit): state where the proxy-header trust boundary actually is
claude
committed
b9a1cda
test: stop requiring the openai extra to run the suite
claude
committed
3388434
build: pin hatchling below the metadata version twine rejects
claude
committed
54b5dc3

Navigation Menu

Uh oh!

Uh oh!

fix: path confinement, error sanitization, secret redaction - #1

fix: path confinement, error sanitization, secret redaction#1
piotrlaczkowski merged 28 commits into
mainfrom
claude/production-readiness-audit-dhkcgw

Commits on Aug 24, 2026

fix(langchain): preserve message fidelity across checkpoints, REST, and streaming

fix(security,storage,pipelines,optimize,deploy): production-readiness pass

fix(security): close Studio API auth bypass and control-plane disable gap

fix: repair LangChain history/tool-call plumbing, CLI run, and OpenAPI hygiene

fix(security): confine ingestion paths, sanitise API errors, redact stack secrets

fix(templates): repair broken plugin scaffold and make all 16 render lint-clean

fix(scaffold,studio): stop leaking server paths, fix resume crash, quiet OTel

fix(plugins): make scaffolded ML plugins actually serve, and stop silent dead plugins

fix(logging,storage): one log line per request, one separator, one DDL pass

fix(cli): honour --dir as a parent directory for `new`, clarify query vs current_query

security: sweep the two bypass classes exhaustively, not by inspection

security: close the async-path exception leaks the first sanitisation pass missed

fix(api): store-dependent routes returned a bare 500 when no store is configured

fix(api,studio): two more unhandled 500s, and sweep every route so they can't recur

fix(studio,api): repair a checkpoint regression and five more error leaks

fix(studio): stop the run stream emitting two lifecycle events per run

fix(cli,core): survive a version-skewed image and honour log_level at build

fix(deploy): make the distroless image actually start

docs(storage): correct the checkpointer serialization note

docs(langgraph): say when Studio's State and History panels stay empty

fix(a2a,cli): stop dropping A2A message text, and name the deepagent dependency

test: sweep every route in the store-backed posture too

fix(auth): make require_auth_globally with an API key a working configuration

feat(auth): let AUTH__JWKS_URL and the stack actually configure JWT verification

fix(pipelines): discover the layout the CLI actually scaffolds

docs(rate-limit): state where the proxy-header trust boundary actually is

test: stop requiring the openai extra to run the suite

build: pin hatchling below the metadata version twine rejects