fix(kap-server): close auth bypass via percent-encoded API paths - #1753

Merged

sailist merged 3 commits into

MoonshotAI:mainfrom

sailist:fix-kap-server-auth-encoded-path

Jul 15, 2026

Commits on Jul 15, 2026

fix(kap-server): fail closed on percent-encoded API paths in auth bypass
sailist
committed
38ef021
fix(agent-core-v2): make session fs path confinement symlink-aware
sailist
committed
6fea9c3
fix(agent-core-v2): accept workspace roots given through a symlink
sailist
committed
7477fde