Merge security hardening from security_shield_v2 into master (retaining hdn-server configuration)

config/config.example.json

@@ -314,55 +314,7 @@
         "use_bm25": true,
         "use_regex": false
       },
-      "servers": {
+      "servers": {}
-        "context7": {
-          "enabled": false,
-          "type": "http",
-          "url": "https://mcp.context7.com/mcp",
-          "headers": {
-            "CONTEXT7_API_KEY": "ctx7sk-xx"
-          }
-        },
-        "filesystem": {
-          "enabled": false,
-          "command": "npx",
-          "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
-        },
-        "github": {
-          "enabled": false,
-          "command": "npx",
-          "args": ["-y", "@modelcontextprotocol/server-github"],
-          "env": {
-            "GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_TOKEN"
-          }
-        },
-        "brave-search": {
-          "enabled": false,
-          "command": "npx",
-          "args": ["-y", "@modelcontextprotocol/server-brave-search"],
-          "env": {
-            "BRAVE_API_KEY": "YOUR_BRAVE_API_KEY"
-          }
-        },
-        "postgres": {
-          "enabled": false,
-          "command": "npx",
-          "args": [
-            "-y",
-            "@modelcontextprotocol/server-postgres",
-            "postgresql://user:password@localhost/dbname"
-          ]
-        },
-        "slack": {
-          "enabled": false,
-          "command": "npx",
-          "args": ["-y", "@modelcontextprotocol/server-slack"],
-          "env": {
-            "SLACK_BOT_TOKEN": "YOUR_SLACK_BOT_TOKEN",
-            "SLACK_TEAM_ID": "YOUR_SLACK_TEAM_ID"
-          }
-        }
-      }
     },
     "exec": {
       "enabled": true,

config/config.json.azure

@@ -476,14 +476,7 @@
       "interval_minutes": 5
     },
     "mcp": {
-      "enabled": true,
+      "enabled": false,
-      "discovery": {
-        "enabled": false,
-        "ttl": 5,
-        "max_search_results": 5,
-        "use_bm25": true,
-        "use_regex": false
-      },
       "servers": {}
     },
     "whitelist": [
@@ -496,9 +489,7 @@
       "append_file",
       "message",
       "weather",
-      "summarize",
+      "summarize"
-      "github",
-      "search_tool"
     ],
     "whitelist_enabled": true,
     "append_file": {

pkg/agent/loop.go

@@ -529,6 +529,23 @@ func (al *AgentLoop) Run(ctx context.Context) error {
 
 			// Process message
 			func() {
+				defer func() {
+					// We've moved InvokeTypingStop to the end of the turn (runTurn)
+					// to ensure terminal signals match the actual turn completion.
+				}()
+				// TODO: Re-enable media cleanup after inbound media is properly consumed by the agent.
+				// Currently disabled because files are deleted before the LLM can access their content.
+				// defer func() {
+				// 	if al.mediaStore != nil && msg.MediaScope != "" {
+				// 		if releaseErr := al.mediaStore.ReleaseAll(msg.MediaScope); releaseErr != nil {
+				// 			logger.WarnCF("agent", "Failed to release media", map[string]any{
+				// 				"scope": msg.MediaScope,
+				// 				"error": releaseErr.Error(),
+				// 			})
+				// 		}
+				// 	}
+				// }()
+
 				drainCanceled := false
 				cancelDrain := func() {
 					if drainCanceled {
@@ -559,9 +576,6 @@ func (al *AgentLoop) Run(ctx context.Context) error {
 					if finalResponse != "" {
 						al.PublishResponseIfNeeded(ctx, msg.Channel, msg.ChatID, finalResponse)
 					}
-					if al.channelManager != nil {
-						al.channelManager.InvokeTypingStop(msg.Channel, msg.ChatID)
-					}
 					return
 				}
 
@@ -622,9 +636,6 @@ func (al *AgentLoop) Run(ctx context.Context) error {
 				if finalResponse != "" {
 					al.PublishResponseIfNeeded(ctx, target.Channel, target.ChatID, finalResponse)
 				}
-				if al.channelManager != nil {
-					al.channelManager.InvokeTypingStop(target.Channel, target.ChatID)
-				}
 			}()
 		}
 	}
@@ -1858,6 +1869,9 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er
 				FinalContentLen: ts.finalContentLen(),
 			},
 		)
+		if al.channelManager != nil {
+			al.channelManager.InvokeTypingStop(ts.channel, ts.chatID)
+		}
 	}()
 
 	al.emitEvent(