Fix DeepSec security findings

[nicoalbanese]

Summary

Fixes the DeepSec report findings across agent tools and web API routes.

Changes

• Harden agent tools against local file reads through webFetch, workspace path
  traversal, symlinked .env access, unsafe .env writes, and weak bash approval
  detection.
• Fix hosted demo bypasses for repository-backed sessions and trial message
  limits.
• Add shared redirect sanitization for GitHub OAuth/App flows and related client
  redirect paths.
• Add lightweight per-user rate limiting and bot checks to expensive endpoints.
• Require session ownership for sandbox creation and remove the orphan ephemeral
  sandbox path.
• Mask internal error details in client responses.
• Fix code-editor launch races with a sandbox lock.
• Fix preference mass assignment, Vercel token revocation reporting, prompt
  snippet escaping, and trusted deployment URL extraction.
• Add/update tests for trial message replay, sandbox creation, and code-editor
  launch locking.

Validation

• bun run ci

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
open-agents	Ready	Preview	May 5, 2026 9:37am