v1.1 security audit remediation

.github/workflows/deploy-pages.yml

@@ -34,7 +34,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: Run tests
         run: python3 -m unittest discover -s tests -v
       - name: Compile Python sources
@@ -57,18 +59,20 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Build online packages
         run: |
           cp install.sh pages/install.sh
           cp scripts/install.ps1 pages/install.ps1
           python3 scripts/build-online.py
       - name: Upload site artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: pages
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/release.yml

@@ -8,13 +8,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: Validate tag and version
         shell: bash
         run: |
@@ -27,14 +29,16 @@ jobs:
   online:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: Build online packages
         run: |
           cp install.sh pages/install.sh
           cp scripts/install.ps1 pages/install.ps1
           python3 scripts/build-online.py
           cp install.sh scripts/install.ps1 VERSION pages/
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: online
           path: |
@@ -46,7 +50,9 @@ jobs:
   offline-linux:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: Build verified Codex offline package
         run: AGENTS=codex PLATFORMS=linux-x64 TAG="v$(cat VERSION)" sh scripts/build-offline.sh
       - name: Smoke install, execute, and uninstall
@@ -63,15 +69,17 @@ jobs:
           test ! -e "$root/home/.agentboot/agents/codex"
           mv "dist/AgentBoot-offline-${tag}-linux-x64.tar.gz" "dist/AgentBoot-offline-${tag}-linux-x64-codex.tar.gz"
           mv "dist/AgentBoot-offline-${tag}-linux-x64-sfx.sh" "dist/AgentBoot-offline-${tag}-linux-x64-codex-sfx.sh"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: offline-linux
           path: dist/AgentBoot-offline-*-linux-x64-codex*
 
   offline-windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: Build verified Codex offline package
         shell: powershell
         run: .\scripts\build-offline.ps1 -Tag ('v' + (Get-Content VERSION -Raw).Trim()) -Platforms win-x64 -Agents codex
@@ -80,7 +88,7 @@ jobs:
         run: |
           $root = Join-Path $env:RUNNER_TEMP 'agentboot-smoke'
           $extract = Join-Path $root 'extract'
-          $smokeHome = Join-Path $root 'home'
+          $smokeHome = Join-Path $root '测试-home'
           New-Item -ItemType Directory -Path $extract, $smokeHome -Force | Out-Null
           $tag = 'v' + (Get-Content VERSION -Raw).Trim()
           tar -xf "dist\AgentBoot-offline-$tag-win-x64.zip" -C $extract
@@ -93,17 +101,42 @@ jobs:
           python "$env:LOCALAPPDATA\AgentBoot\app\core\menu.py" uninstall codex
           if (Test-Path "$smokeHome\.agentboot\agents\codex") { throw 'Codex payload not removed' }
           Move-Item "dist\AgentBoot-offline-$tag-win-x64.zip" "dist\AgentBoot-offline-$tag-win-x64-codex.zip"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: offline-windows
           path: dist/AgentBoot-offline-*-win-x64-codex.zip
 
+  macos-smoke:
+    runs-on: macos-15-intel
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Build and smoke native macOS Codex package
+        shell: bash
+        run: |
+          AGENTS=codex PLATFORMS=darwin-x64 TAG="v$(cat VERSION)" sh scripts/build-offline.sh
+          root="$(mktemp -d)"
+          mkdir -p "$root/extract" "$root/home"
+          tag="v$(cat VERSION)"
+          tar -xzf "dist/AgentBoot-offline-${tag}-darwin-x64.tar.gz" -C "$root/extract"
+          HOME="$root/home" sh "$root/extract/AgentBoot/install-offline.sh" codex
+          HOME="$root/home" AGENTBOOT_HOME="$root/home/.agentboot" "$root/home/.agentboot/bin/codex" --version
+          HOME="$root/home" AGENTBOOT_HOME="$root/home/.agentboot" python3 "$root/home/.agentboot/app/core/menu.py" uninstall codex
+          test ! -e "$root/home/.agentboot/agents/codex"
+
   publish:
-    needs: [validate, online, offline-linux, offline-windows]
+    needs: [validate, online, offline-linux, offline-windows, macos-smoke]
     if: github.ref_type == 'tag'
     runs-on: ubuntu-latest
+    environment: release-production
+    permissions:
+      contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: release
           merge-multiple: true
@@ -113,12 +146,17 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release create "$GITHUB_REF_NAME" release/* \
-            --repo "$GITHUB_REPOSITORY" \
-            --title "AgentBoot $GITHUB_REF_NAME" \
-            --prerelease \
-            --generate-notes \
-            --verify-tag
+          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$GITHUB_REF_NAME" release/* --repo "$GITHUB_REPOSITORY" --clobber
+            gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --prerelease --latest=false
+          else
+            gh release create "$GITHUB_REF_NAME" release/* \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "AgentBoot $GITHUB_REF_NAME" \
+              --prerelease \
+              --generate-notes \
+              --verify-tag
+          fi
       - name: Wait for Pages deployment
         env:
           GH_TOKEN: ${{ github.token }}

CHANGELOG.md

@@ -16,6 +16,15 @@
 - 修复 Windows CMD shim 百分号格式、npm 真实入口解析和便携 Node 路径，Linux/Windows 均通过原生安装→启动→卸载矩阵。
 - Worker 支持 Range/If-Range 与真实资产健康探测；发布采用 prerelease→Pages/Worker live verify→Latest 的协调状态机。
 - 修正 Node engine 范围、离线资产名、相对链接、vLLM 文案、移动端表格溢出、触摸目标和旧性能固定数字。
+- 安全模式改为可信系统路径的固定 argv 执行，禁止 shell grammar、路径伪装与未知确认策略放行。
+- 截断/畸形 SSE 不再产生可执行工具调用；模型密钥仅发送到 HTTPS，网页工具默认拒绝内网/元数据地址。
+- 配置与会话使用 0700/0600 原子持久化，命令超时终止整个进程树，安装状态更新加入跨进程锁。
+- CoCo 卸载拒绝 symlink 根目录，私有 Node 在最终目录部署；Hermes uv、Node 与 Python 载荷完整校验。
+- Release/Pages Actions 固定 commit、最小权限、显式源码清单；离线 Agent 更新与应用/launcher 事务支持回滚。
+- Aider 改为 AgentBoot 私有 venv 安装；OpenCode 暂停离线声明，npm 离线入口按 JS/native/CMD 类型执行。
+- Agent配置、代理、会话和安装清单改为私密原子持久化；并发安装状态加锁，命令超时终止整棵进程树。
+- 在线/离线应用、launcher与Agent payload提交边界支持回滚；Windows中文路径、PowerShell 3哈希和批处理错误码修复。
+- 发布矩阵新增Intel macOS原生Codex smoke；同源安装包增加成员/大小检查，离线构建只复制显式文件清单。
 
 ## v1.0.0 (2026-08-29)
 

README.en.md

@@ -51,7 +51,7 @@ Two commands after install:
 | 📦 **Choose what to install** | 14 mainstream agents, multi-select in the menu |
 | 🛟 **Built-in fallback agent** | `ab`: zero third-party dependencies, Agnes by default, offline Linux knowledge base, session persistence |
 | 🧠 **Model provider manager** | Named custom providers, Ollama/LM Studio presets, failover order, connectivity test |
-| 🇨🇳 **China network adaptive** | npmmirror / Node mirrors / Tsinghua PyPI, four-source downloads, proxy support |
+| 🇨🇳 **China network adaptive** | npmmirror / Node mirrors / Tsinghua PyPI, Worker/Pages/Release fallback, proxy support |
 | 📴 **Verified offline packages** | Releases provide Codex slim packs tested through install/run/uninstall; menu `[7]` builds other Agents on their target platform |
 | ➕ **Custom agents** | Add anything beyond the registry (npm / pip / script), stored in your home dir |
 | 🧹 **Safe uninstall** | Menu `[9]` or `agentboot uninstall <id>`; removes owned program files and preserves user data by default |
@@ -63,7 +63,7 @@ Two commands after install:
 | # | Agent | Command | Vendor | Offline |
 |---|---|---|---|---|
 | 1 | CoCo Agent | `coco` | BitCook | Linux/macOS |
-| 2 | OpenCode | `opencode` | opencode.ai | ✓ |
+| 2 | OpenCode | `opencode` | opencode.ai | online only (postinstall not yet offline-verified) |
 | 3 | Hermes Agent | `hermes` | Hermes | ✓ (needs Git) |
 | 4 | Cline CLI | `cline` | Cline | ✓ |
 | 5 | CodeBuddy CLI | `codebuddy` | Tencent | ✓ |

README.md

@@ -50,7 +50,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -Command "iex ((New-Object Net.Web
 | 📦 **菜单自选安装** | 14 个主流 Agent 按需勾选（见下表），支持命令行指定 |
 | 🛟 **内置保底 Agent** | `ab` 零第三方依赖 Python 核心：Agnes 开箱即用、离线 Linux 知识库、工具调用、会话持久化 |
 | 🧠 **提供商管理器** | Agnes 预设 + 自定义提供商命名管理 + Ollama/LM Studio 本地模型 + 故障切换顺序 |
-| 🇨🇳 **中国网络自适应** | npmmirror / Node 镜像 / 清华 PyPI 自动切换；四源下载容错；代理一键配置 |
+| 🇨🇳 **中国网络自适应** | npmmirror / Node 镜像 / 清华 PyPI 自动切换；Worker / Pages / Release 三源容错；代理一键配置 |
 | 📴 **可验证离线包** | Release 提供经安装/启动/卸载冒烟的 Codex 精简包；菜单 `[7]` 可按目标平台自建其他 Agent 包 |
 | ➕ **自定义 Agent** | 菜单向导或 `add-agent` 添加注册表之外的任意 Agent（npm / pip / 脚本），用户目录保存、升级不丢 |
 | 🧹 **安全卸载** | 菜单 `[9]` 或 `agentboot uninstall <id>`；精确清理程序，默认保留配置、认证与会话 |
@@ -63,7 +63,7 @@ powershell -NoProfile -ExecutionPolicy Bypass -Command "iex ((New-Object Net.Web
 | # | Agent | 命令 | 厂商 | 离线 | 备注 |
 |---|---|---|---|---|---|
 | 1 | CoCo Agent | `coco` | BitCook | Linux/macOS | 官方脚本安装 |
-| 2 | OpenCode | `opencode` | opencode.ai | ✓ | |
+| 2 | OpenCode | `opencode` | opencode.ai | 仅在线 | postinstall 尚未纳入离线验证 |
 | 3 | Hermes Agent | `hermes` | Hermes | ✓ | 需 Git；国内自动镜像 |
 | 4 | Cline CLI | `cline` | Cline | ✓ | |
 | 5 | CodeBuddy CLI | `codebuddy` | Tencent | ✓ | |
@@ -146,7 +146,7 @@ AgentBoot/
 ## 文档与链接
 
 - [安装指南](安装指南.md) —— 一键安装 / 离线部署 / 自定义构建 / 模型配置 / 故障排查
-- [Releases](https://github.com/bit-cook/AgentBoot/releases) —— 在线包 / 三平台离线包 / 源码包
+- [Releases](https://github.com/bit-cook/AgentBoot/releases) —— 在线包 / 已验证 Linux、Windows Codex 离线包 / 源码包
 - 分发入口：[boot.ide.pub](https://boot.ide.pub)（Cloudflare）· [GitHub Pages](https://bit-cook.github.io/AgentBoot/)
 
 ## 安全说明

agents/registry.json

@@ -24,7 +24,7 @@
       "method": "npm",
       "npm": "opencode-ai",
       "node": ">=18",
-      "offline": true,
+      "offline": false,
       "npm_install_flags": ["--ignore-scripts"],
       "script": "https://opencode.ai/install",
       "notes": ["已预置 Agnes 免费模型（~/.config/opencode/opencode.json），安装即用", "也可用官方脚本安装：curl -fsSL https://opencode.ai/install | bash"]
@@ -169,11 +169,11 @@
       "vendor": "Aider AI",
       "desc": "经典 AI 结对编程 CLI（Python/pip 生态，暂不支持离线）",
       "bin": "aider",
-      "method": "pip",
-      "pip": "aider-install",
+      "method": "venv",
+      "pip": "aider-chat",
       "node": null,
       "offline": false,
-      "notes": ["通过 aider-install 安装，需要本机 Python 3.8+", "pip 包的离线分发需要按平台打包 wheel，暂未支持"]
+      "notes": ["安装到 AgentBoot 私有 venv，不污染系统 Python", "需要 Python 3.10+；暂不支持离线"]
     }
   ]
 }