Skip to content

Fleet Deck

v0.5.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 13d Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agents ai-agents claude claude-code claude-code-plugin web
+4 more
developer-tools multi-agent orchestration tmux

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 11d

The release fixes a critical CSRF and WebSocket hijack vulnerability by enforcing an allowlist for Origin/Host/Sec‑Fetch headers and requiring application/json.

Why it matters: Addresses a severity 90 CSRF/WebSocket hijack affecting /ws and /api/spawn endpoints; immediate mitigation required for exposed services.

Summary

AI summary

Critical CSRF/WebSocket hijack fixed and LAN token hardened.

Changes in this release

Security Critical

Fixes critical CSRF / WebSocket hijack by enforcing Origin/Host/Sec-Fetch allowlist and application/json requirement.

Fixes critical CSRF / WebSocket hijack by enforcing Origin/Host/Sec-Fetch allowlist and application/json requirement.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Medium

Hardens LAN token: removes it from WebSocket broadcast and logs, sets log/capture permissions to 0600, restricts remote.url to https://claude.ai, anonymizes mDNS instance name.

Hardens LAN token: removes it from WebSocket broadcast and logs, sets log/capture permissions to 0600, restricts remote.url to https://claude.ai, anonymizes mDNS instance name.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Adds accessibility improvements: ARIA-legal cards, modal focus traps, and keyboard tile focus.

Adds accessibility improvements: ARIA-legal cards, modal focus traps, and keyboard tile focus.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Performance Medium

Improves performance via broadcast coalescing, tiered transcript reads, memoized board/clock context, idle poll backoff, batched PTY output, and prepared‑statement cache.

Improves performance via broadcast coalescing, tiered transcript reads, memoized board/clock context, idle poll backoff, batched PTY output, and prepared‑statement cache.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes Node 24 compatibility issue where HOME‑lock owner check misidentified fleetd due to `/proc/<pid>/comm` rename.

Fixes Node 24 compatibility issue where HOME‑lock owner check misidentified fleetd due to `/proc/<pid>/comm` rename.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes four spawn‑lifecycle bugs: /clear no longer condemns live pane, retention verifies tmux before assuming dead, re‑validates gone spawns with hysteresis, and mail now bounds at 4000 chars.

Fixes four spawn‑lifecycle bugs: /clear no longer condemns live pane, retention verifies tmux before assuming dead, re‑validates gone spawns with hysteresis, and mail now bounds at 4000 chars.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Low

Reliability hardening: prevents unsafe worktree removal without --force, avoids tombstoning live fleet on tmux timeout, stops cross-agent mail bleed via unique paste buffers, adds UTF-8 correctness, WS keepalive/backpressure, bounded DB/caches, global unhandledRejection handler.

Reliability hardening: prevents unsafe worktree removal without --force, avoids tombstoning live fleet on tmux timeout, stops cross-agent mail bleed via unique paste buffers, adds UTF-8 correctness, WS keepalive/backpressure, bounded DB/caches, global unhandledRejection handler.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Splits derive.mjs into a composition root plus 13 focused modules (2955 → 314 lines) and refactors App.jsx into hooks and a Header component (763 → 433 lines), preserving behavior.

Splits derive.mjs into a composition root plus 13 focused modules (2955 → 314 lines) and refactors App.jsx into hooks and a Header component (763 → 433 lines), preserving behavior.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Full changelog

Fleet Deck installs as a Claude Code plugin — there is nothing to download here. Get it with:

claude plugin marketplace add lacion/fleet-deck
claude plugin install fleetdeck@fleetdeck

A deep security / reliability / performance / quality audit of the daemon and
board, run as a multi-agent effort with cross-provider adversarial review of
every change. See docs/AUDIT-2026-07.md for the full report.

Security

  • Fixed a critical CSRF / cross-site WebSocket hijack: loopback was auto-trusted with no Origin/Host/Content-Type check, so any web page you visited could read the /ws snapshot, drive /ws/term, and POST /api/spawn. State-changing routes and both WS upgrades now enforce an Origin/Host/Sec-Fetch allowlist plus an application/json requirement (this also closes DNS rebinding), without breaking the zero-config loopback board.
  • Hardened the LAN token: it no longer rides the WebSocket broadcast or gets logged; fleetd.log and hook-payload capture are now mode 0600 (capture off by default); remote.url is restricted to https://claude.ai; the mDNS instance name is anonymized.

Fixed

  • Node 24 compatibility: the HOME-lock owner check identified fleetd via /proc/<pid>/comm, which Node 24 renames to MainThread — a second daemon could misread a live owner as a recycled PID, steal the lock, and open its SQLite alongside it. The check now resolves the /proc/<pid>/exe symlink. Caught by the new CI's Node 22/24 matrix on its first run.
  • Four production spawn-lifecycle bugs (reported over the fleet board after they lost every live terminal): /clear no longer condemns a live pane; retention verifies a pane via tmux before presuming a silent-but-live agent dead; pane-dead/gone spawns are re-validated and resurrected with hysteresis, and revive() adopts a live pane instead of 409-deadlocking; mail no longer silently truncates at 500 chars (now bounded at 4000, surrogate-safe, and signalled).
  • Reliability hardening: worktree removal no longer rm -rfs uncommitted work without --force; boot reconciliation no longer tombstones the live fleet on a tmux timeout; per-paste unique tmux buffers stop cross-agent mail bleed; plus byte-correct UTF-8 request bodies, WS keepalive and backpressure, bounded DB and caches, and a global unhandledRejection handler.

Changed

  • Performance: broadcast coalescing, tiered transcript reads, memoized board and clock context, idle poll backoff, batched PTY output, and a prepared-statement cache.
  • Structure: derive.mjs (2955 lines) was split into a 314-line composition root plus 13 focused modules, and App.jsx (763 → 433 lines) into hooks plus a Header component — both verified behavior-preserving. Accessibility: ARIA-legal cards, modal focus traps, and keyboard tile focus.

Security Fixes

  • Fixed critical CSRF/cross‑site WebSocket hijack: enforced Origin/Host/Sec‑Fetch allowlist plus application/json requirement on state‑changing routes and WS upgrades (closes DNS rebinding).
  • Hardened LAN token by removing it from WebSocket broadcast, disabling logging, setting log file mode to 0600, restricting remote.url to https://claude.ai, and anonymizing mDNS instance name.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Fleet Deck

Get notified when new releases ship.

Sign up free

About Fleet Deck

All releases →

Related context

Earlier breaking changes

  • v0.13.0 Agents poller no longer uses a shell; runs via execFile with argv split on whitespace.
  • v0.6.0 Adds nullable columns `ticket`, `ticket_source`, `prev_callsign` to `sessions` table via schema migration.

Beta — feedback welcome: [email protected]