Zero-regression hardening: close 2 RCEs + 70 correctness/robustness findings (ZRCS Steps 0-10) by aksOps · Pull Request #12 · RandomCodeSpace/unified-agent-manager

fix(security)!: ZRCS Steps 0-1 — RCE fixes + load validation + CI/safety-net

aksOps

committed

fix(app): atomic LoadSessions RMW + heal backfill + Closed=>Exited invariant (ZRCS F01,C1-1,F18)

aksOps

committed

fix(app,adapter): conditional store mutation on partial failure + orphan guards (ZRCS F03,F04,F19,C1-2,F32)

aksOps

and

claude

committed

fix(adapter): native --continue resume w/o prompt replay; drop vestigial SafeArgs (ZRCS C1-5,C2-5,F42)

aksOps

committed

fix(tmux): resilient list parse, server-config ordering, multiline send (ZRCS F10,F11,F12,F25,F56,F13)

aksOps

committed

fix(tui,cli): rename retarget/panic guards, multibyte input, reject flags after agent (ZRCS F27,C2-1,F29,C2-3)

aksOps

committed

fix(tui): width-aware render, PR/state glyphs, peek-follow, message TTL (ZRCS F28,F26,F30,F58,C2-2,F53,F55)

aksOps

committed

fix(store): v1 dead-session reclassify, schema-downgrade guard, enum normalize (ZRCS F07,F33,F44)

aksOps

committed

fix(store,app): collision-guard insert, quarantine-safe load, in-dir tempfile, PR owner/repo rehydrate (ZRCS F22,F43,F45,C2-7)

aksOps

committed

fix(app,store,tmux): startup prune, kill-all, pr.Check timeout + in-flight guard (ZRCS F20,F24,F02,F17)

aksOps

committed

perf(app,adapter,tmux): tiered refresh cadence, list cache, capture throttle, reorder debounce (ZRCS F16,F60,C2-11,F59,F34)

aksOps

committed

fix(app,cli): single-source adapters, reply mode, default-agent validation, wizard parity (ZRCS F14,F21,F36,C2-9,C2-8)

aksOps

committed

refactor(adapter,cli): drop dead interface methods/wrappers + cli input fixes (ZRCS F40,F41,C1-3,C1-6,C2-4,F54)

aksOps

committed

chore: testable hook seam, capture-error logging, %w error wrapping (ZRCS F51,F52,F57)

aksOps

committed

build: reproducible static build, vendor tree, pinned CI tools, dependabot/codeowners (ZRCS F48,F47,F49)

aksOps

committed

ci: use golangci-lint v2 to match the v2 .golangci.yml (fix build-vs-target Go skew)

aksOps

committed

build: drop vendored deps; build resolves from module proxy

aksOps

committed

ci: pin third-party GitHub Actions to commit SHAs

aksOps

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Zero-regression hardening: close 2 RCEs + 70 correctness/robustness findings (ZRCS Steps 0-10)#12

Zero-regression hardening: close 2 RCEs + 70 correctness/robustness findings (ZRCS Steps 0-10)#12
aksOps merged 18 commits into
mainfrom
worktree-zero-regression

Commits on May 29, 2026

fix(security)!: ZRCS Steps 0-1 — RCE fixes + load validation + CI/safety-net

fix(app): atomic LoadSessions RMW + heal backfill + Closed=>Exited invariant (ZRCS F01,C1-1,F18)

fix(app,adapter): conditional store mutation on partial failure + orphan guards (ZRCS F03,F04,F19,C1-2,F32)

fix(adapter): native --continue resume w/o prompt replay; drop vestigial SafeArgs (ZRCS C1-5,C2-5,F42)

fix(tmux): resilient list parse, server-config ordering, multiline send (ZRCS F10,F11,F12,F25,F56,F13)

fix(tui,cli): rename retarget/panic guards, multibyte input, reject flags after agent (ZRCS F27,C2-1,F29,C2-3)

fix(tui): width-aware render, PR/state glyphs, peek-follow, message TTL (ZRCS F28,F26,F30,F58,C2-2,F53,F55)

fix(store): v1 dead-session reclassify, schema-downgrade guard, enum normalize (ZRCS F07,F33,F44)

fix(store,app): collision-guard insert, quarantine-safe load, in-dir tempfile, PR owner/repo rehydrate (ZRCS F22,F43,F45,C2-7)

fix(app,store,tmux): startup prune, kill-all, pr.Check timeout + in-flight guard (ZRCS F20,F24,F02,F17)

perf(app,adapter,tmux): tiered refresh cadence, list cache, capture throttle, reorder debounce (ZRCS F16,F60,C2-11,F59,F34)

fix(app,cli): single-source adapters, reply mode, default-agent validation, wizard parity (ZRCS F14,F21,F36,C2-9,C2-8)

refactor(adapter,cli): drop dead interface methods/wrappers + cli input fixes (ZRCS F40,F41,C1-3,C1-6,C2-4,F54)

chore: testable hook seam, capture-error logging, %w error wrapping (ZRCS F51,F52,F57)

build: reproducible static build, vendor tree, pinned CI tools, dependabot/codeowners (ZRCS F48,F47,F49)

ci: use golangci-lint v2 to match the v2 .golangci.yml (fix build-vs-target Go skew)

build: drop vendored deps; build resolves from module proxy

ci: pin third-party GitHub Actions to commit SHAs