opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge security hardening from security_shield_v2 into master (retaining hdn-server configuration)

Browse source
This commit is contained in:
stevef 2026-04-14 10:50:30 +02:00
commit 06fca7574e
3 changed files with 23 additions and 66 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
config/config.example.json
View file

@ -314,55 +314,7 @@
"use_bm25": true,
"use_regex": false
},
"servers": {
"context7": {
"enabled": false,
"type": "http",
"url": "https://mcp.context7.com/mcp",
"headers": {
"CONTEXT7_API_KEY": "ctx7sk-xx"
}
},
"filesystem": {
"enabled": false,
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
},
"github": {
"enabled": false,
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_TOKEN"
}
},
"brave-search": {
"enabled": false,
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-brave-search"],
"env": {
"BRAVE_API_KEY": "YOUR_BRAVE_API_KEY"
}
},
"postgres": {
"enabled": false,
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-postgres",
"postgresql://user:password@localhost/dbname"
]
},
"slack": {
"enabled": false,
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-slack"],
"env": {
"SLACK_BOT_TOKEN": "YOUR_SLACK_BOT_TOKEN",
"SLACK_TEAM_ID": "YOUR_SLACK_TEAM_ID"
}
}
}
"servers": {}
},
"exec": {
"enabled": true,

13
config/config.json.azure
View file

@ -476,14 +476,7 @@
"interval_minutes": 5
},
"mcp": {
"enabled": true,
"discovery": {
"enabled": false,
"ttl": 5,
"max_search_results": 5,
"use_bm25": true,
"use_regex": false
},
"enabled": false,
"servers": {}
},
"whitelist": [
@ -496,9 +489,7 @@
"append_file",
"message",
"weather",
"summarize",
"github",
"search_tool"
"summarize"
],
"whitelist_enabled": true,
"append_file": {

26
pkg/agent/loop.go
View file

@ -529,6 +529,23 @@ func (al *AgentLoop) Run(ctx context.Context) error {
// Process message
func() {
defer func() {
// We've moved InvokeTypingStop to the end of the turn (runTurn)
// to ensure terminal signals match the actual turn completion.
}()
// TODO: Re-enable media cleanup after inbound media is properly consumed by the agent.
// Currently disabled because files are deleted before the LLM can access their content.
// defer func() {
// if al.mediaStore != nil && msg.MediaScope != "" {
// if releaseErr := al.mediaStore.ReleaseAll(msg.MediaScope); releaseErr != nil {
// logger.WarnCF("agent", "Failed to release media", map[string]any{
// "scope": msg.MediaScope,
// "error": releaseErr.Error(),
// })
// }
// }
// }()
drainCanceled := false
cancelDrain := func() {
if drainCanceled {
@ -559,9 +576,6 @@ func (al *AgentLoop) Run(ctx context.Context) error {
if finalResponse != "" {
al.PublishResponseIfNeeded(ctx, msg.Channel, msg.ChatID, finalResponse)
}
if al.channelManager != nil {
al.channelManager.InvokeTypingStop(msg.Channel, msg.ChatID)
}
return
}
@ -622,9 +636,6 @@ func (al *AgentLoop) Run(ctx context.Context) error {
if finalResponse != "" {
al.PublishResponseIfNeeded(ctx, target.Channel, target.ChatID, finalResponse)
}
if al.channelManager != nil {
al.channelManager.InvokeTypingStop(target.Channel, target.ChatID)
}
}()
}
}
@ -1858,6 +1869,9 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er
FinalContentLen: ts.finalContentLen(),
},
)
if al.channelManager != nil {
al.channelManager.InvokeTypingStop(ts.channel, ts.chatID)
}
}()
al.emitEvent(