Fix all 7 issues identified in the ChatGPT audit of transformation work:
1. Android build break: Remove duplicate normalizeMainKey/isCanonicalMainSessionKey
from NodeGatewaySync.kt (they're already in SessionKey.kt). Align both Android
and iOS implementations to use "main" as canonical (case-insensitive match).
2. Rate limiting: Wire rateLimiter through GatewayRequestContext and enforce:
- Auth failure backoff (recordAuthFailure on auth failure, clearAuthFailure on success)
- Request rate limiting before handleGatewayRequest
- Channel message rate limiting in send handler
- Add TOO_MANY_REQUESTS error code
3. Injection defenses: Call sanitizeIncomingMessage in chat.send and chat.inject
handlers to detect prompt injection attempts.
4. RBAC enforcement: Add canAccessAgent check in chat.send handler and
canExecuteCommand check in node-host runner for exec commands.
5. WhatsApp encrypted backup restore: Update maybeRestoreCredsFromBackup to
handle encrypted backup files (.bak.enc -> .json.enc restoration).
6. Exec blocklist bypass: Add evaluateBlocklist check in argv-only code path
in runner.ts (previously only checked for rawCommand path).
7. iOS voice transcript: Fix line 329 in NodeAppModel.swift to use computed
'key' variable instead of original 'sessionKey' parameter.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(sessions): add channelIdleMinutes config for per-channel session idle durations
Add new `channelIdleMinutes` config option to allow different session idle
timeouts per channel. For example, Discord sessions can now be configured
to last 7 days (10080 minutes) while other channels use shorter defaults.
Config example:
sessions:
channelIdleMinutes:
discord: 10080 # 7 days
The channel-specific idle is passed as idleMinutesOverride to the existing
resolveSessionResetPolicy, integrating cleanly with the new reset policy
architecture.
* fix
* feat: add per-channel session reset overrides (#1353) (thanks @cash-echo-bot)
---------
Co-authored-by: Cash Williams <cashwilliams@gmail.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
- Enhanced error handling in image reference detection to skip malformed file URLs without crashing.
- Updated media loading logic to throw an error for invalid file URLs, ensuring better feedback for users.
- Added support for detecting file URLs in prompts using fileURLToPath for accurate path resolution.
- Updated image loading logic to default to JPEG format for optimized image processing.
- Improved error handling in image optimization to continue processing on failures.
- Added handling for file URLs using fileURLToPath for proper resolution.
- Updated logic to skip relative path resolution if ref.resolved is already absolute.
- Enhanced cap calculation for image loading to handle undefined maxBytes more gracefully.
