Repository navigation
fix: the server's sockets, files, ssh and typed messages hold their limits when a pane pushes on them - #180
Merged
Merged
Conversation
…imits when a pane pushes on them - A connection whose process or ancestors cannot be read at connect is refused like one from a pane: a program that writes stop and exits at once no longer passes as outside. - Plugins do not start when the server's own plugin socket did not bind. - A line over the protocol limit ends the connection instead of the rest being read as the next message; the client drops a paste that large, as the server did. - ssh to a machine forwards no agent and no display; what it prints is kept to 1 MiB per pipe. - Private files never follow a link planted at their temp name; hook settings keep their mode. - config.json keeps keys this build does not know. - A remote session does not make this Mac's terminal reload. - Checkout paths with a newline are read whole; a non-UTF-8 path never enters a sandbox profile. - A fetched catalog whose links leave its folder on disk is refused. - State words have a budget of their own on the message socket. - Nothing is typed into a pane, and no Enter sent, while the agent's numbered question is on screen. - A This-folder-only pane cannot reach the server's sockets when NERD_SOCKET puts them outside the state root. - The docs say what reaches the remote nerd and the terminal, that the catalog is unsigned, that temp folders are shared, what the proxy sees, and that an agent route is a label. Part of GHSA-jr8q-vrww-r6hm fix: a menu worktree runs no hook of the repository, an old git shows no status, and a typed message is never typed twice - New worktree and Delete worktree checkout run git with the read-only git's limits (no fsmonitor, lazy fetch or index refresh), the repository's own filters off and core.hooksPath=/dev/null; config hooks (hook.<name>.command) of the repository are disabled too, since core.hooksPath does not reach them. Removing reads the checkout's own config. Both are refused when the repository's own config includes other files (include.path, includeIf), which could name a filter only in the new checkout's context; a refused delete keeps its space open. A new checkout's notice names the filters git did not run in it. docs/isolation.md names what stays: the user's own git in that folder still runs a hook a pane planted, and a pane swapping .git/config between nerd's read and git's (a ceiling: at filters_off). - A git before 2.31 ignores GIT_CONFIG_COUNT, so the filters could not be kept off: filters_off now refuses it, and status, diff, review and menu worktrees are skipped, with one log line; a version that cannot be read is said so. install.rs shares the version parse. - A typed message whose Enter meets a question is held for as long as the question shows, never queued again; once it goes, Enter only if the agent is idle and in front and nobody typed into the pane since, otherwise it stays delivered as "typed, not submitted". A restart no longer requeues a message that was already pasted. Text nerd types for the owner (Open in editor, Insert path, cd) counts as the owner typing. - docs/privacy-and-security.md: --install-hook, --uninstall-hook and --preset are not refused from a pane, and what limits them there. Part of GHSA-jr8q-vrww-r6hm Co-Authored-By: Claude <noreply@anthropic.com>
nyxene
pushed a commit
that referenced
this pull request
Nov 7, 2026
Release pull request, maintained by release-please. Merging it creates the tag and a draft GitHub release; then run `scripts/publish-binary.sh vX.Y.Z` from a terminal to attach the macOS binary and publish the release. --- ## [0.19.1](v0.19.0...v0.19.1) (2026-11-07) ### Fixed * a preview picture goes while the notice card is drawn over it ([#169](#169)) ([6ca3a7f](6ca3a7f)) * caches whose contents run later stay read-only in a pane isolated to its folder ([#176](#176)) ([dda6fdb](dda6fdb)) * Check for a new release leaves a release already installed to Update ([#175](#175)) ([7552294](7552294)) * isolated panes cannot ask macOS to start programs, and Ctrl+click opens files only in an app chosen at the click ([#181](#181)) ([02d8db3](02d8db3)) * only the release commit is signed, and an installer refuses a nerd of another version ([#178](#178)) ([a74be79](a74be79)) * Servers says why a machine cannot be listed, and offers a terminal only when ssh wanted a prompt ([#171](#171)) ([5519b1e](5519b1e)) * the server's sockets, files, ssh and typed messages hold their limits when a pane pushes on them ([#180](#180)) ([6bcc4cf](6bcc4cf)) * what a pane prints is bounded in the server's memory and time ([#182](#182)) ([126df17](126df17)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fixes, merged in order with the other ghsa/ steps.
Part of #177
🤖 Generated with Claude Code