Fix/bug hunt round 2#271

Merged

robdmac merged 10 commits into

mainfrom

fix/bug-hunt-round-2

Jul 17, 2026

Commits on Jul 17, 2026

test(desktop): smoke scripts support dynamic ports + grace-aware ghost reconcile

robdmac
and
claude
committed
fix(controlplane): bug-hunt round 2 — IDOR, input-validation 500s, races

robdmac
and
claude
committed
fix(sandbox): bug-hunt round 2 — browser orphan leak + races/leaks

robdmac
and
claude
committed
fix(desktop): bug-hunt round 2 — orcabot import tar zip-slip + symlink planting

robdmac
and
claude
committed
test(controlplane): update recipe fixtures for owner-scoped global recipes

robdmac
and
claude
committed
style(controlplane): tighten fix comments; drop internal references

robdmac
and
claude
committed
fix(controlplane): address review of the round-2 fixes

robdmac
and
claude
committed
fix(desktop): review — orcabot import stages then merges; cap decoder, stream files

robdmac
and
claude
committed
fix(sandbox): review — openat/O_NOFOLLOW workspace write walk; fix Linux build

robdmac
and
claude
committed
style: make fix comments succinct

robdmac
and
claude
committed