Kodiqa Agent

v3.6.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ai-coding-agent claude cli coding-assistant developer-tools ollama

+2 more

openai python

Affected surfaces

rce_ssrf auth

Summary

AI summary

Fixed OpenAI token handling, made OLLAMA_BIN cross‑platform, corrected multi_edit parsing, limited _stop_ollama scope, prevented SQLite parallel errors, closed streaming leaks, patched hook injection, hardened command blocklist.

Full changelog

Medium-tier audit fixes (cross-platform, correctness, stability, security).

Fixed

OpenAI o-series (o3/o3-mini/o4-mini) now send max_completion_tokens instead of max_tokens (the o-series 400 on the latter).
OLLAMA_BIN was macOS-only — resolved via $OLLAMA_BIN → PATH → app bundle, so /pull, /delete, and update checks work on Linux/Windows.
multi_edit failed in Ollama text mode — JSON-string edits are now parsed; no longer burns an undo slot on a no-op.
_stop_ollama killed all Ollama processes — now stops only the one Kodiqa started and reaps it; added an atexit handler to clean up spawned MCP/LSP/Ollama children even on crash.
memory_search could fail under parallel dispatch — SQLite opened with check_same_thread=False.
Streaming connection leak — all three chat loops resp.close() in finally.

Security

Hook command injection — hook {param} values are shlex.quoted before substitution.
Blocklist hardening — run_command normalizes whitespace before matching BLOCKED_COMMANDS (rm -rf / is now caught).

Tests

Regressions for o-series body, multi_edit JSON-string, and blocklist normalization (300 total).

Security Fixes

Hook command injection mitigated by shlex.quoting `{param}` values before substitution
Blocklist hardened: `run_command` normalizes whitespace to catch commands like `rm -rf /`

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Kodiqa Agent

Get notified when new releases ship.

About Kodiqa Agent

All releases →