gastown/crew/joe 18578b3030 fix(security): validate beads prefix to prevent command injection (gt-l1xsa) ...

Add isValidBeadsPrefix() to validate prefix format before passing to
exec.Command. Prefixes from config files (detectBeadsPrefixFromConfig)
are now validated to contain only alphanumeric and hyphen characters,
start with a letter, and be max 20 chars.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-01-05 00:02:43 -08:00

..

activity

Add 'gt dashboard' CLI command (hq-s1bg) (#65)

2026-01-03 11:49:42 -08:00

beads

Merge pull request #39 from cvsloane/fix/polecat-dispatcher-notification

2026-01-04 23:09:23 -08:00

boot

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

checkpoint

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

claude

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

cmd

Merge pull request #138 from greghughespdx/fix/sling-no-daemon

2026-01-05 00:01:17 -08:00

config

fix: Honor town default_agent for town-level agents (mayor, deacon)

2026-01-05 07:41:03 +01:00

connection

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

constants

Merge pull request #71 from michaellady/feature/convoy-dashboard

2026-01-04 13:45:54 -08:00

crew

fix: validate crew names to prevent path traversal (gt-wzxwm)

2026-01-05 00:01:39 -08:00

daemon

feat(rig): Add --branch flag for custom default branch

2026-01-04 14:01:02 -08:00

deacon

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

deps

…

doctor

feat(doctor): Add hooks-path-configured check

2026-01-05 00:01:07 -08:00

dog

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

events

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

feed

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

formula

fix: Allow polecat/* branches, remove hanoi test formulas

2026-01-04 23:31:40 -08:00

git

feat: Block internal PRs via pre-push hook and GitHub Action

2026-01-04 23:28:11 -08:00

keepalive

…

lock

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

mail

fix: handle crypto/rand.Read error in ID generation (gt-qysj9)

2026-01-04 23:58:37 -08:00

mq

…

mrqueue

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

polecat

fix: repair worktree starts from origin/<default-branch>

2026-01-04 14:46:36 -08:00

protocol

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

refinery

feat(rig): Add --branch flag for custom default branch

2026-01-04 14:01:02 -08:00

rig

fix(security): validate beads prefix to prevent command injection (gt-l1xsa)

2026-01-05 00:02:43 -08:00

session

fix(peek): Support cross-rig crew paths like beads/crew/dave

2026-01-04 15:16:56 -08:00

style

…

suggest

…

swarm

feat(rig): Add --branch flag for custom default branch

2026-01-04 14:01:02 -08:00

templates

refactor: use hq- prefix for role bead references

2026-01-04 13:17:39 -08:00

tmux

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

townlog

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

tui

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

util

…

web

test(dashboard): Add E2E tests with httptest.Server

2026-01-03 18:25:37 -08:00

wisp

fix: Address golangci-lint errors (errcheck, gosec) (#76)

2026-01-03 16:11:55 -08:00

witness

fix: Witness checks all remotes for merge verification (gt-ncq26)

2026-01-04 15:12:44 -08:00

workspace

fix: preserve symlink paths in workspace detection (#3) (#75)

2026-01-03 16:10:53 -08:00