mathias

mathias commented on issue mathias/hyperguild#169

2026-10-04 20:38:18 +00:00

brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write

Correction: the line "a grep found no other unvalidated caller path" was wrong. The PR #170 review checked it by execution and found two more handlers with the same class of bug:

**brain_upd…

mathias pushed to fix/tunnel-traversal at mathias/hyperguild

2026-10-04 20:38:09 +00:00

87fa28e2c8 fix(update,session): brain_update and session_log confine caller paths (#169)

mathias pushed to fix/graph-wiki-root-157 at mathias/hyperguild

2026-10-04 20:34:48 +00:00

d90ce66fb2 fix(brainfs): refuse an in-brain file swapped in behind a symlink; in-brain test targets (#157)

mathias created pull request mathias/tapir#62

2026-10-04 20:32:02 +00:00

feat(uploads): choose the language of a recording; Swedish default, Other = auto (#61 interim)

mathias pushed to sprint/language at mathias/tapir

2026-10-04 20:31:45 +00:00

cc6fe7083d refactor(web): drop a length check the closed-set parse already makes (#61)

0338b18a17 feat(uploads): choose the language of a recording; record it, show it, carry it to the engines (#61)

ed9d76b0cf feat(transcribe): a non-Swedish upload skips the Swedish-only base engine and is not reconciled (#61)

0b807c6bcd feat(transcribe): the gateway sends language=sv, omits it for auto, and refuses anything else (#61)

8e4872d2e7 feat(domain): Language, a closed set carried to the engines on the context (#61)

Compare 5 commits »

mathias created branch sprint/language in mathias/tapir

2026-10-04 20:31:45 +00:00

mathias commented on issue mathias/hyperguild#157

2026-10-04 20:26:44 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

Gatekeeper review of PR #168 (slice 4: graphsync, wiki inventory/index; head c7a6429): BLOCK. Details are in review id 4 on the PR.

The static cases hold: outside links, in-brain file links,…

mathias commented on pull request mathias/hyperguild#168

2026-10-04 20:26:35 +00:00

fix(graph,wiki): read the brain through brainfs (#157, slice 4)

pr-gatekeeper verdict: BLOCK (PR #168 @ c7a6429). Not merged.

mathias commented on issue mathias/hyperguild#167

2026-10-04 20:25:07 +00:00

brainfs: fd-relative walk to close the directory-swap race (accepted residual from #157)

One more instance of the same in-brain swap residual, found while writing PR #170. brainfs.ReadRegular Lstats the final component and then opens it, and os.Root.OpenFile **follows an in-root…

mathias commented on issue mathias/hyperguild#169

2026-10-04 20:25:05 +00:00

brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write

Log check, 2026-10-04. Loki query `{namespace="supervisor"}

mathias created pull request mathias/hyperguild#170

2026-10-04 20:24:13 +00:00

fix(tunnel): brain_tunnel cannot write outside the wiki or through symlinks (#169)

mathias opened issue mathias/hyperguild#169

2026-10-04 20:24:01 +00:00

brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write

mathias pushed to fix/tunnel-traversal at mathias/hyperguild

2026-10-04 20:23:46 +00:00

9eb3d2456d fix(tunnel): brain_tunnel cannot write outside the wiki or through symlinks

mathias created branch fix/tunnel-traversal in mathias/hyperguild

2026-10-04 20:23:46 +00:00

mathias created pull request mathias/hyperguild#168

2026-10-04 20:18:01 +00:00

fix(graph,wiki): read the brain through brainfs (#157, slice 4)

mathias commented on issue mathias/hyperguild#158

2026-10-04 20:18:01 +00:00

Writes under brain/raw/ follow symlinks: processed/, rejected/, .processed markers, tunnel-candidates

One more write path that follows symlinks, found while doing #157 slice 4: wiki.RebuildIndex (ingestion/internal/wiki/index.go) writes wiki/index.md with os.WriteFile. If wiki/index.md…

mathias pushed to fix/graph-wiki-root-157 at mathias/hyperguild

2026-10-04 20:17:45 +00:00

c7a6429bae fix(graph,wiki): read the brain through brainfs (#157, slice 4)

mathias created branch fix/graph-wiki-root-157 in mathias/hyperguild

2026-10-04 20:17:45 +00:00

mathias commented on issue mathias/tapir#61

2026-10-04 07:10:18 +00:00

Uploads: choose the transcription language (Swedish / other / auto-detect), route to the right engine

Correction to my previous comment. I wrote that "Klang's own table: KB-Whisper large beats the general one on Swedish". That table (brain note on pianissimo, infra) compares KB-Whisper large…

mathias commented on issue mathias/tapir#61

2026-10-04 07:10:12 +00:00

Uploads: choose the transcription language (Swedish / other / auto-detect), route to the right engine

Finding, 2026-10-04 (answers the owner's "could we run whisper large locally too?"): it already runs. iguana has com.mathias.mlx-whisper as a LaunchAgent (KeepAlive), serving `mlx-community…