Mohamed Boudra 8a585e60f2 fix(security): shell injection, symlink escape, remove /pairing endpoint, harden defaults ...

- Replace all execAsync shell-interpolated git calls with execFileAsync + array args in session.ts
- Add symlink resolution in file-explorer resolveScopedPath to prevent workspace escape
- Remove /pairing HTTP endpoint from server; desktop now uses `paseo daemon pair --json` via CLI
- Disable MCP HTTP endpoint by default (opt-in via config)
- Correct SECURITY.md: fix cipher name (XSalsa20-Poly1305), accurate replay resistance claims, add local daemon trust boundary docs

2026-04-02 23:58:38 +07:00

..

app

chore(release): cut 0.1.43

2026-04-02 23:13:07 +07:00

cli

chore(release): cut 0.1.43

2026-04-02 23:13:07 +07:00

desktop

fix(security): shell injection, symlink escape, remove /pairing endpoint, harden defaults

2026-04-02 23:58:38 +07:00

expo-two-way-audio

chore(release): cut 0.1.43

2026-04-02 23:13:07 +07:00

highlight

chore(release): cut 0.1.43

2026-04-02 23:13:07 +07:00

relay

chore(release): cut 0.1.43

2026-04-02 23:13:07 +07:00

server

fix(security): shell injection, symlink escape, remove /pairing endpoint, harden defaults

2026-04-02 23:58:38 +07:00

website

chore(release): cut 0.1.43

2026-04-02 23:13:07 +07:00