Fleet Deck

v0.10.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 11d Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

agents ai-agents claude claude-code claude-code-plugin web

+4 more

developer-tools multi-agent orchestration tmux

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 11d

The release closes a proxy‑auth token bypass and hardens mail keystroke injection; it also enforces owner‑only permissions on state files and fixes spawn parsing.

Why it matters: These security fixes (proxy‑auth bypass, mail injection) have high severity scores (>70); adopt v0.10.0 immediately to protect authentication flows and input handling.

Summary

AI summary

Proxy-auth token bypass closed, mail keystroke injection hardened, state files made owner‑only, and spawn parsing fixed.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Proxy-auth token bypass closed; loopback requests now check Host authority. Proxy-auth token bypass closed; loopback requests now check Host authority. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Mail-to-pane keystroke injection hardened by stripping bracketed-paste markers and control bytes. Mail-to-pane keystroke injection hardened by stripping bracketed-paste markers and control bytes. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	State files (`fleetd.db`, WAL, SHM) set to owner‑only permissions (0600); `FLEETDECK_HOME` set to 0700. State files (`fleetd.db`, WAL, SHM) set to owner‑only permissions (0600); `FLEETDECK_HOME` set to 0700. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Spawn prompts are no longer parsed as `claude` flags; supervisor pidfile verified by process identity; `service.env` values validated. Spawn prompts are no longer parsed as `claude` flags; supervisor pidfile verified by process identity; `service.env` values validated. Source: llm_adapter@2026-07-15 Confidence: high	—
Deprecation	Low	Removed legacy `/plain` board and `board.html`, reducing npm package size by −22 KB; dead exports also dropped. Removed legacy `/plain` board and `board.html`, reducing npm package size by −22 KB; dead exports also dropped. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Worktree removal no longer races with revive; `/clear` succession cannot mis‑assign an heir. Worktree removal no longer races with revive; `/clear` succession cannot mis‑assign an heir. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Mail/rc prevents auto‑submission into a pane that becomes busy mid‑delivery. Mail/rc prevents auto‑submission into a pane that becomes busy mid‑delivery. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Board answer‑hotkeys are suppressed when a modal is active. Board answer‑hotkeys are suppressed when a modal is active. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Enforced true 50‑file paste cap. Enforced true 50‑file paste cap. Source: llm_adapter@2026-07-15 Confidence: high	—
Refactor	Low	Dropped redundant per‑session `mail_pending` field from `/state`; top‑level `mail_pending` map and `mail_meta` remain. Dropped redundant per‑session `mail_pending` field from `/state`; top‑level `mail_pending` map and `mail_meta` remain. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

A full security / reliability / quality audit of the daemon and board — findings fixed and pinned by regression tests, each fix cross-reviewed. Suite 484/484 (and under FLEETDECK_TEST_WAIT_SCALE=3).

Security

Proxy-auth token bypass closed — a loopback request through a trusted reverse proxy with no Origin and no token could be auto-authorized (including POST /api/spawn) under the default FLEETDECK_PROXY_AUTH=token. The loopback exemption now also consults the Host authority; local hooks and trust mode are unaffected.
Mail-to-pane keystroke injection hardened — owned-pane paste strips bracketed-paste markers and control bytes.
State files owner-only — fleetd.db/WAL/SHM → 0600, FLEETDECK_HOME → 0700.
Spawn prompts never parsed as claude flags (passed after a -- terminator); supervisor pidfile verified by process identity; service.env values validated.

Correctness

Worktree removal no longer races a revive; /clear succession can't mis-assign an heir; mail//rc don't auto-submit into a pane that went busy mid-delivery; board answer-hotkeys are suppressed under a modal; a true 50-file paste cap.

Cleanup

Removed the legacy /plain board + board.html (−22 KB from the npm package) and dead exports; internal dedups (config.mjs, exec.mjs); the redundant per-session mail_pending was dropped from /state (the top-level mail_pending map and mail_meta remain).

Full changelog: https://github.com/lacion/fleet-deck/blob/main/CHANGELOG.md

Security Fixes

Proxy-auth token bypass closed — loopback requests now also check Host authority when FLEETDECK_PROXY_AUTH=token
Mail-to-pane keystroke injection hardened — owned‑pane paste strips bracketed‑paste markers and control bytes
State files (fleetd.db, WAL, SHM) set to 0600; FLEETDECK_HOME set to 0700 for owner‑only access

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Fleet Deck

Get notified when new releases ship.

About Fleet Deck

All releases →

Related context

Related tools

Earlier breaking changes

v0.13.0 Agents poller no longer uses a shell; runs via execFile with argv split on whitespace.
v0.6.0 Adds nullable columns `ticket`, `ticket_source`, `prev_callsign` to `sessions` table via schema migration.