mweinbach6/9/2026, 6:42:37 PM

- read: stat() images before reading them into memory so a workspace-planted
  multi-GB "image" cannot OOM the process before the size check.
- edit: cap oldString/newString (2 MB) and reject files >10 MB by stat().
- webFetch: cap the inline response body on the decoded stream (decompression-
  bomb guard); bound the download filename-suffix loop; honor a no-network
  sandbox policy; frame fetched content as untrusted (carried from P2).
- webSearch: honor a no-network sandbox policy.
- exa/parallel: add a 30s per-request timeout so a hung endpoint can't stall
  the turn.
- antigravity runtime: validate model-supplied tool args against the Zod schema
  before execute() (mirrors the pi runtime) so malformed Gemini calls can't
  bypass read/write/edit bounds.
- bwrap: add --unshare-ipc (covert-channel hardening) + probe.
- bash redactSecrets: cover UPPER_CASE *_API_KEY/TOKEN/SECRET assignments and
  gh*/github_pat/npm/slack/AWS token formats.
- todoWrite: remove the dead module-global todo store/listeners (a cross-session
  footgun in the server); todos route per-session via ctx.updateTodos.

Adds regression tests for the edit cap, webFetch inline cap + network guard,
and --unshare-ipc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Parentd9a59c0