[validation-only] SpaceApp #181 integration with upstream 14117daa

.github/workflows/ci.yml

@@ -42,8 +42,8 @@ jobs:
         working-directory: ${{ runner.temp }}/spaceapp-public-export
         run: npm ci
 
-      - name: Install ripgrep (the file search tests run the real rg)
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep
+      - name: Install ripgrep and ffmpeg (the file search tests run the real rg, the Nous attachment tests make media with ffmpeg)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep ffmpeg
 
       - name: Public release tests
         working-directory: ${{ runner.temp }}/spaceapp-public-export

.github/workflows/release.yml

@@ -117,8 +117,8 @@ jobs:
         working-directory: ${{ runner.temp }}/spaceapp-public-export
         run: npm audit --audit-level=high
 
-      - name: Install ripgrep (the file search tests run the real rg)
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep
+      - name: Install ripgrep and ffmpeg (the file search tests run the real rg, the Nous attachment tests make media with ffmpeg)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep ffmpeg
 
       - name: Test candidate
         working-directory: ${{ runner.temp }}/spaceapp-public-export

.github/workflows/security.yml

@@ -71,8 +71,8 @@ jobs:
 
       - run: npm ci
       - run: npm audit --audit-level=high
-      - name: Install ripgrep (the file search tests run the real rg)
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep
+      - name: Install ripgrep and ffmpeg (the file search tests run the real rg, the Nous attachment tests make media with ffmpeg)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq ripgrep ffmpeg
 
       - run: npm run test:public
       - run: npm run public:export:verify

CHANGELOG.md

@@ -5,12 +5,27 @@ Semantic Versioning.
 
 ## [Unreleased]
 
-## [1.1.6] - 2026-10-16
+## [1.1.6] - 2026-10-18
 
-Source: sanitized Space app @ eebf761963 (4362 files). Adds install telemetry
+Source: sanitized Space app @ f8803d5d96 (4595 files). Adds install telemetry
 for owners who opt in and the remaining fixes from the independent reviews of
 1.1.5; open items are listed in `docs/quality/KNOWN_LIMITATIONS.md`.
 
+### Pilot rehearsal fixes and team accounts
+
+- Codex sandboxes each command in the CLI container (Docker's default seccomp
+  profile plus user namespaces, no AppArmor profile) on Docker Desktop and on
+  Linux hosts that allow unprivileged user namespaces. Ubuntu 23.10 and later
+  restrict them, so there the container keeps Docker's defaults and Codex still
+  asks before each command.
+- `restore` prints workspace paths in plain quotes (Windows paths no longer show
+  doubled backslashes).
+- Team accounts, off until the owner runs `user enable`: each invited user gets
+  a CLI container of their own (own keys, logins, Space Memory and workspaces),
+  `credentials set`, `workspace add` and `provider install` take `--user`, and
+  backups keep each user's CLI settings and Space Memory. See "Team accounts" in
+  `docs/operations.md`.
+
 ### Telemetry (only after the owner answers Yes)
 
 - The install wizard lists what telemetry sends before it asks; the default is
@@ -28,7 +43,13 @@ for owners who opt in and the remaining fixes from the independent reviews of
 
 ### Security
 
-- WebSocket handshakes (VNC stream, shared chat) check the Origin.
+- A signed-out session token can no longer be reused: session tokens must have
+  exactly two segments, so a revoked token with an extra segment is refused.
+- Session revocations fail closed until the saved ones are loaded after a
+  restart, and sign-out reports an error when the revocation could not be saved.
+- WebSocket handshakes (VNC stream, shared chat, harness) check the Origin.
+- Stored database passwords need a full 16-byte authentication tag, and the
+  Admin Mode delete guard also compares real paths.
 - The app is sent with `frame-ancestors 'self'`, `object-src 'none'` and
   `X-Frame-Options: SAMEORIGIN`.
 - Every API child process, including the Space screenshot engine, starts

Dockerfile

@@ -100,7 +100,11 @@ COPY --chown=root:root starter-memory/AGENTS.md /etc/AGENTS.md
 COPY --chown=root:root starter-memory/installation-guide.md /etc/spaceapp-installation-guide.md
 RUN chmod 0644 /etc/AGENTS.md
 ARG TARGETARCH
-RUN npm install --global --no-audit --no-fund opencode-ai@1.18.4 \
+# python3-minimal (about 13 MB): agents often check their work with a short python3 script (pilot F18).
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends python3-minimal \
+    && rm -rf /var/lib/apt/lists/* \
+    && npm install --global --no-audit --no-fund opencode-ai@1.18.4 \
     && install -d -o spaceapp -g spaceapp -m 0700 /var/lib/spaceapp-cli/vendor \
     && npm cache clean --force \
     && install -d -o spaceapp -g spaceapp -m 0700 \