mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-02-14 00:35:02 -05:00
- Long-running tools (create_agent) now run in background and return immediately with an operation_id. Add check_operation MCP tool for polling results. Prevents 3+ min blocking and survives page refresh. - Fix CodeQL path traversal alert: use normpath+startswith sanitizer in _make_sdk_cwd() instead of assert. - Tighten _read_file_handler: restrict from ~/.claude/ to only ~/.claude/projects/**/tool-results/ (sentry review feedback). - Fix bash redirect bypass: strip quoted strings before checking for unquoted > operator, catches `echo hello>file` (sentry review).