This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+4 more
Affected surfaces
Summary
AI summaryRead-only file explorer added for session trees and home directory plus spawn by repo + branch support.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Limits global home explorer to read-only access, preventing unauthorized file exposure. Limits global home explorer to read-only access, preventing unauthorized file exposure. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | High |
Hardens repo-mode git cloning by rejecting option-smuggling, validating branches, and disabling submodules. Hardens repo-mode git cloning by rejecting option-smuggling, validating branches, and disabling submodules. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds read-only file explorer to browse session working tree and home directory. Adds read-only file explorer to browse session working tree and home directory. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds spawn by repo + branch capability with async cloning and durable catalog. Adds spawn by repo + branch capability with async cloning and durable catalog. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
Two features that make the board a place you can read code and start work from — each shipped with an adversarial security review, on top of the v0.10.0 audit release.
Added
- Read-only file explorer. Browse any session's working tree from its drawer (⌸ browse, and the file chips open the viewer), and browse your whole home directory from a new ⌸ Files button in the header. Per-directory tree that refreshes on expand, a line-numbered file view with a rendered-Markdown toggle, and search by content or file name (git roots use
git grep/git ls-files; non-git roots use a bounded walk). Caps are shown as truncated, never silently dropped. - Spawn by repo + branch. Give the spawn form a repo (a URL,
org/repo, a local path, or a name the fleet knows) and a branch instead of a cwd: the daemon clones if missing (intoFLEETDECK_REPOS_DIR, default~/projects, override persisted) and materializes the branch as its own worktree or in place — created fromorigin/HEADwhen new, tracking when remote-only. A durable repo catalog powers suggestions, and a 🗀 folder picker fills the path fields. Clones run async (202→ the card narrates cloning → live, or tombstones with git's error).
Security
- The global home explorer exposes read-only home-directory files (incl.
~/.ssh,~/.aws) to any bearer-token holder in LAN/standalone mode — loopback is unaffected. Same auth + Host walls and the same containment as every other data endpoint: root resolved server-side,../absolute refused, symlinks never followed out of root,.gitnever readable. - Repo-mode git is argv-only, refuses option-smuggling inputs (leading
-, a dash-host behinduser@, non-https/ssh schemes), validates branches viagit check-ref-format, runs clone/fetch withGIT_TERMINAL_PROMPT=0, never recurses submodules, and caps concurrent clones.
Full changelog: https://github.com/lacion/fleet-deck/blob/main/CHANGELOG.md#0110---2026-07-15
Security Fixes
- Global home explorer now enforces read‑only access, blocks path traversal (`..`), refuses absolute paths, never follows symlinks out of root, hides `.git`, and retains existing auth/host walls.
- Repo‑mode git cloning hardened: argv‑only, rejects option‑smuggling inputs (leading `-`, dash‑host syntax), validates branch names with `git check-ref-format`, disables terminal prompts (`GIT_TERMINAL_PROMPT=0`), never recurses submodules, and limits concurrent clones.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Fleet Deck
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]