Soulter 59fa9fdeaa fix(core): security fix - restrict send_message_to_user to current session only ...

Closes #7822

SECURITY: Remove the user-controlled 'session' parameter from the
send_message_to_user tool. Previously, a regular user could ask the
LLM to send messages to any arbitrary session (group chat) by
providing a crafted session string, which is a high-risk
vulnerability.

Changes:
- Remove 'session' parameter from tool schema (LLM can no longer
  propose it)
- Always use context.context.event.unified_msg_origin as the target
  session
- Update description to clearly state that messages can only be sent
  to the current user's session

2026-04-27 02:07:52 +08:00

..

api

feat: add on_agent_begin, on_using_llm_tool, on_llm_tool_respond, on_agent_done event hooks (#7540)

2026-04-14 18:55:05 +08:00

builtin_stars

feat: re-establishing /provider as a built-in command (#7691)

2026-04-21 22:41:31 +08:00

cli

chore: bump version to 4.23.5

2026-04-23 22:28:40 +08:00

core

fix(core): security fix - restrict send_message_to_user to current session only

2026-04-27 02:07:52 +08:00

dashboard

perf: improve provider config ui (#7772)

2026-04-24 20:46:45 +08:00

utils

fix: stabilize packaged runtime pip/ssl behavior and mac font fallback (#5007)

2026-02-10 16:42:43 +09:00

__init__.py

…