fix(security): harden command permissions and credential handling - #2074

Open

YOMXXX wants to merge 10 commits into

XiaomiMiMo:mainfrom

YOMXXX:fix/delete-command-confirmation

Commits on Aug 10, 2026

fix(security): require confirmation for delete commands, including cmd /c del
YOMXXX
committed
4339ab6
fix(security): route cmd /c delete commands through the confirmation gate
YOMXXX
committed
53f1c54
fix(security): normalize cmd.exe /c delete wraps too
YOMXXX
committed
a9e1954

Commits on Aug 11, 2026

fix(security): redact MCP access tokens from debug output
YOMXXX
committed
1532b88
fix(security): use timing-safe HTTP API password comparison
YOMXXX
committed
bacecf3
docs(security): point advisory link to MiMo Code
YOMXXX
committed
4649b37
fix(security): guard PowerShell output paths
YOMXXX
committed
42260dc
fix(compaction): reuse parent prefix for cache efficiency
YOMXXX
committed
38151da
fix(tui): align autocomplete labels by display width
YOMXXX
committed
1820f33
fix(websearch): route Xiaomi provider variants to MiMo backend
YOMXXX
committed
421e852