- Update default embed model from nomic-embed-text to all-MiniLM-L6-v2
in Ollama LLM provider
- Fix 15 test files with hardcoded 768-dim references
- Update mock model names in Ollama health checks
- Update comments referencing old model name
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update ADRs 075-079 with implementation details, revise the
multi-language GOAP implementation plan, add test generators and
parser test fixtures for Go, Rust, Java, C#, Swift, Python.
Include skill validation schema updates and v2→v3 migration skill.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Resource blocking with presets (functional/visual/performance) and tracker/ad domain lists
- Adaptive locator with similarity-based element matching for resilient E2E selectors
- Browser page pool for concurrent page management with async acquire/release
- Stealth browser client via Patchright for bot-protected test environments
- Integrated adaptive locator into click/type step executors with fallback chain
- Wired resource blocking into browser orchestrator launch lifecycle
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Prototype pollution (2 alerts): Replace bracket traversal
`current = current[part]` with `Object.getOwnPropertyDescriptor`
in goap-planner and plan-executor. This makes own-property-only
access explicit to CodeQL's flow analysis.
- Hostname regex (1 alert): Replace regex-based memory key assertion
with direct string equality check — no regex involved at all.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Prototype pollution (5 alerts): Replace direct property assignment with
Object.defineProperty in workflow-orchestrator, goap-planner, plan-executor.
The dangerousKeys guard already prevented exploitation, but CodeQL couldn't
track the flow — Object.defineProperty is unambiguously safe.
- Incomplete hostname regex (1 alert): Pass pre-compiled RegExp to
expectMemoryStored instead of raw string containing dots.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HIGH severity:
- #158: Fix DOM XSS in sorter.js — replace innerHTML with createElement/appendChild
- #151: Fix weak password hash in test fixture — SHA-512 → scryptSync
- #152,#153: Fix incomplete URL sanitization in OAuth test — .includes() → exact match
- #154: Fix incomplete hostname regexp — escape regex special chars in expectMemoryStored
MEDIUM severity:
- #155,#156,#157: Fix prototype pollution flags — replace Object.defineProperty with
direct assignment on validated, null-prototype objects (guards already existed)
- #150: Delete obsolete publish-v3-alpha.yml workflow (dead since v3.7.5 flatten)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Profa