Orb 1.9.1: attention hardening
A small security-hardening follow-up to 1.9, from an adversarial review of the new attention/notification feature. No change to how Orb looks or behaves.
A small security-hardening follow-up to 1.9, from an adversarial review of the new attention/notification feature. No change to how Orb looks or behaves.
Fixed
- Session titles are sanitized (invisible control/formatting characters stripped, length capped) before they can appear in a notification banner or the menu bar, so terminal-supplied text can't disguise itself there.
- The session-completion hook is hardened against a symlink trick on its temporary marker file.