script/js executes its `code` as host JavaScript (via new Function), and a step's
`code` is a *resolved* input — so it could be written as `{ $from: <chat-step> }`,
turning model/API output into the body of the executed function (untrusted data
-> arbitrary host code execution). Pipeline validation now requires script/js
`code` to be a literal string: any $from/expression-sourced code is rejected.
Authoring a literal script/js step remains supported (the pipeline file is the
trust boundary, like a shell/npm script). Combined with "dry-run never executes
$js", this closes the path where untrusted text reaches the JS sink.
Adds regression tests: $from-sourced code rejected, literal code accepted,
dry-run does not execute $js, getByJsonPointer blocks prototype/inherited keys,
and concurrency clamps to the maximum.
https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1
- expressions: never execute $js during planning/dry-run. `pipeline run --dry-run`
is the command a cautious user runs to preview an unfamiliar pipeline; it must
not run embedded JavaScript. Planning now returns the expression placeholder
instead of calling new Function.
- schema (getByJsonPointer): block __proto__/constructor/prototype and require
own properties, so a crafted $from/$input path cannot pull object internals
(e.g. constructor) out of step output and feed them downstream.
- scheduler: clamp --concurrency to a maximum (64) to bound fan-out so a single
run cannot launch an unbounded number of concurrent API calls / downloads.
Note: the runtime new Function sinks in script/js and $js (arbitrary host code
execution) are intentionally left unchanged here — remediating them is a design
decision (sandbox vs. literal-only code) for the maintainers; see PR notes.
https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1
- config set: mask api_key/access_token/access_key_id/access_key_secret in the
confirmation echo. It previously printed the stored secret verbatim to stdout
(CI logs, pipes, screen shares), unlike `config show` / `auth status` which
already maskToken().
- http / knowledge retrieve: use maskToken() in --verbose request logs instead
of printing the first 8 chars of the bearer token / AccessKey id.
- telemetry: write telemetry.jsonl with mode 0600 (was created world-readable
by default), matching the other credential-area writers.
- ensureConfigDir: chmod 0700 after mkdir, so a pre-existing ~/.bailian created
by an older build/another tool (where mkdir's mode is ignored) holding
cleartext credentials gets locked down too. Best-effort; never fatal.
https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1
Follow-up to 1.1.1.
- release.mjs: build packages before type checks so bailian-cli-core resolves on clean checkouts
- CHANGELOG: record the above under Fixed
- Reformat CONTRIBUTING / INSTALL / README / docs tables (prettier only, no content changes)
Documentation-only patch release.
- Add INSTALL.md for AI-Agent-driven installation
- Sync root and packages/cli READMEs (EN + CN)
- Drop unpkg links in favor of canonical sources
- release.mjs: assert README sync before publishing
若麒