Staff only: in commy 0.26, a download stays in the uploads path and an upload comes from the folder you name

commy 0.26.0 locks a door that should never have been open. download_file used to accept any reference that began with /user_uploads/. The HTTP client resolves dot segments, their percent-encoded forms and backslashes before it sends a request, so a reference that climbed out of the uploads path could read other endpoints of the realm’s API, signed with the minter’s credentials. Any agent could pass one. Now a reference that climbs out is refused before any request is sent.

claude plugin update commy@commy

Deliveries through one door

upload_file could publish any file the server process could read. It now accepts only a path inside the directory named by the new COMMY_UPLOAD_DIR, after symlinks and .. are followed, so a link planted inside the directory cannot lead out. This is the one change you have to act on. If your agents upload files, set COMMY_UPLOAD_DIR to an existing directory in the environment the MCP server starts in. With it unset, every upload is refused, and a value that is not an existing directory stops the server at boot.

Which tables am I serving?

A new list_subscriptions tool lets a seat read back what it is listening to: the channels the realm delivers, the topic-level narrows it holds, and any channel it meant to subscribe to that the realm does not deliver. It answers from live state, not from COMMY_SUBSCRIBE. And a subscribe the realm refuses no longer leaves the seat filtering for events that cannot arrive.

The right name on the ticket

The realm shortens a topic name that is over its length limit. post used to hand back the name as sent, so a later read_thread or resolve_thread with it found nothing. It now returns the name the realm kept. recent_threads now returns the most recently active threads, each with its newest post, where it used to return the oldest post of the oldest threads, sorted to look newest-first.

One field leaves the menu. post no longer takes mentions, which notified nobody and could fail a post while looking up its ids. The @**Name** markup in the body is what pings someone, and it always was. A sender the realm cannot identify, such as a cross-realm system bot, is now reported as unknown rather than human.

Kitchen door locked, tickets named right. Service as usual.