consvc · pull · Jun 16, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
diff --git a/Tools/SandboxTest.ps1 b/Tools/SandboxTest.ps1
@@ -23,6 +23,7 @@ param(
     [Parameter(HelpMessage = 'The folder to map in the Sandbox.')]
     [ValidateScript({
             if (-not (Test-Path -Path $_ -PathType Container)) { throw "$_ is not a folder." }
+            if ($_ -match '[''"<>&]') { throw "MapFolder path contains forbidden characters (' `" < > &): $_" }
             return $true
         })]
     [String] $MapFolder = $pwd,
@@ -31,6 +32,41 @@ param(
     [string] $WinGetVersion,
     # WinGetOptions
     [Parameter(HelpMessage = 'Additional options for WinGet')]
+    [ValidateScript({
+            # Parse allowed flags only from flag definition lines in winget install --help
+            # These lines start with whitespace followed by a dash (e.g., "  -h,--silent  ...")
+            if (-not (Get-Command 'winget.exe' -ErrorAction SilentlyContinue)) {
+                Write-Warning 'WinGet is not installed on the host. Skipping WinGetOptions validation.'
+                return $true
+            }
+            $helpLines = winget install --help 2>&1 | Where-Object { $_ -match '^\s+-' }
+            $allowedFlags = @()
+            foreach ($line in $helpLines) {
+                # Extract the flag portion before the description (everything up to two consecutive spaces)
+                $flagPart = ($line.Trim() -split '\s{2,}')[0]
+                $parsedTokens = $flagPart -split ',' | ForEach-Object { $_.Trim() }
+                Write-Debug "WinGetOptions: Parsed line '$($line.Trim())' -> flags: $($parsedTokens -join ', ')"
+                $allowedFlags += $parsedTokens
+            }
+            $allowedFlags = $allowedFlags | Where-Object { $_ } | Select-Object -Unique
+            if (-not $allowedFlags) {
+                throw 'Could not parse winget install flags from --help output. Ensure winget is installed.'
+            }
+            Write-Debug "WinGetOptions: Allow-list ($($allowedFlags.Count) flags): $($allowedFlags -join ', ')"
+            $tokens = $_ -split '\s+'
+            foreach ($token in $tokens) {
+                if ($token.StartsWith('-')) {
+                    $isAllowed = $token -in $allowedFlags
+                    Write-Debug "WinGetOptions: Checking token '$token' -> $(if ($isAllowed) { 'ALLOWED' } else { 'BLOCKED' })"
+                    if (-not $isAllowed) {
+                        throw "WinGetOptions contains disallowed flag: $token. Allowed flags: $($allowedFlags -join ', ')"
+                    }
+                } else {
+                    Write-Debug "WinGetOptions: Skipping value token '$token'"
+                }
+            }
+            return $true
+        })]
     [string] $WinGetOptions,
     # Switches
     [switch] $SkipManifestValidation,
@@ -872,19 +908,23 @@ Pop-Location
 # Create the WSB file
 # Although this could be done using the native XML processor, it's easier to just write the content directly as a string
 Write-Verbose 'Creating WSB file for launching the sandbox'
+$escapedTestDataFolder = [System.Security.SecurityElement]::Escape($script:TestDataFolder)
+$escapedPrimaryMappedFolder = [System.Security.SecurityElement]::Escape($script:PrimaryMappedFolder)
+$escapedSandboxWorkingDirectory = [System.Security.SecurityElement]::Escape($script:SandboxWorkingDirectory)
+$escapedSandboxBootstrapFile = [System.Security.SecurityElement]::Escape($script:SandboxBootstrapFile)
 @"
 <Configuration>
   <Networking>Enable</Networking>
   <MappedFolders>
     <MappedFolder>
-      <HostFolder>$($script:TestDataFolder)</HostFolder>
+      <HostFolder>$($escapedTestDataFolder)</HostFolder>
     </MappedFolder>
     <MappedFolder>
-      <HostFolder>$($script:PrimaryMappedFolder)</HostFolder>
+      <HostFolder>$($escapedPrimaryMappedFolder)</HostFolder>
     </MappedFolder>
   </MappedFolders>
   <LogonCommand>
-  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($script:SandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($script:SandboxBootstrapFile)'</Command>
+  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($escapedSandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($escapedSandboxBootstrapFile)'</Command>
   </LogonCommand>
   <AudioInput>Disable</AudioInput>
   <VideoInput>Disable</VideoInput>

diff --git a/manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.installer.yaml b/manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.installer.yaml
@@ -0,0 +1,18 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+InstallerType: portable
+Commands:
+- opencodereview
+ReleaseDate: 2026-06-15
+Installers:
+- Architecture: x64
+  InstallerUrl: https://github.com/alibaba/open-code-review/releases/download/v1.3.11/opencodereview-windows-amd64.exe
+  InstallerSha256: 267C6345DE3CE629A3809DEDEC380336467640BBEBB85977ECBEB08FF37AC738
+- Architecture: arm64
+  InstallerUrl: https://github.com/alibaba/open-code-review/releases/download/v1.3.11/opencodereview-windows-arm64.exe
+  InstallerSha256: 54B54BDC83AC901801B9D13893F507B2D4AE096C623C50C65E68AE4DE0E79234
+ManifestType: installer
+ManifestVersion: 1.12.0
diff --git a/manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.locale.en-US.yaml b/manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.locale.en-US.yaml
@@ -0,0 +1,34 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+PackageLocale: en-US
+Publisher: Alibaba
+PublisherUrl: https://github.com/alibaba
+PublisherSupportUrl: https://github.com/alibaba/open-code-review/issues
+PackageName: Open Code Review
+PackageUrl: https://github.com/alibaba/open-code-review
+License: Apache-2.0
+LicenseUrl: https://github.com/alibaba/open-code-review/blob/HEAD/LICENSE
+Copyright: Copyright 2026 Alibaba
+ShortDescription: The open source AI code review agent.
+Description: |-
+  Open Code Review is an AI-powered code review CLI tool. It originated as Alibaba Group's internal official AI code review assistant — over the past two years, it has served tens of thousands of developers and identified millions of code defects. After thorough validation at massive scale, we incubated it into an open source project for the community. Simply configure a model endpoint to get started.
+  It reads Git diffs, sends changed files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision. The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback.
+Tags:
+- ai
+- code
+- review
+ReleaseNotes: |-
+  What's Changed
+  - fix: remove non-existent Claude Sonnet 4.7 & 4.8 models by @hetaoBackend in https://github.com/alibaba/open-code-review/pull/133
+  - refactor: sort provider selection list by @MuoDoo in https://github.com/alibaba/open-code-review/pull/135
+  - feat(llm): add volcengine and kimi providers by @5wxwxwxw5 in https://github.com/alibaba/open-code-review/pull/134
+  New Contributors
+  - @hetaoBackend made their first contribution in https://github.com/alibaba/open-code-review/pull/133
+  - @5wxwxwxw5 made their first contribution in https://github.com/alibaba/open-code-review/pull/134
+  Full Changelog: https://github.com/alibaba/open-code-review/compare/v1.3.10...v1.3.11
+ReleaseNotesUrl: https://github.com/alibaba/open-code-review/releases/tag/v1.3.11
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0
diff --git a/manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.locale.zh-CN.yaml b/manifests/a/Alibaba/OpenCodeReview/1.3.11/Alibaba.OpenCodeReview.locale.zh-CN.yaml
@@ -0,0 +1,16 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.locale.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+PackageLocale: zh-CN
+ShortDescription: 开源的 AI 代码审查智能体。
+Description: |-
+  Open Code Review 是一款 AI 驱动的代码审查 CLI 工具。它的前身是阿里集团内部官方 AI 代码审查助手，过去两年在内部服务了数万开发者，识别了数百万个代码缺陷。经过大规模充分验证后，我们将其孵化为开源项目，对社区开放。只需配置一个模型端点即可使用。
+  它读取 Git diff，通过具备工具调用能力的 Agent 将变更文件发送至可配置的 LLM，生成具有行级精度的结构化审查意见。Agent 可以读取完整文件内容、搜索代码库、检查其他变更文件以获取上下文，从而进行深度审查——而非仅停留在表面的 diff 反馈。
+Tags:
+- 人工智能
+- 代码
+- 审查
+ManifestType: locale
+ManifestVersion: 1.12.0
diff --git a/...e/4.708/EmoteInteractive.RemoteMouse.yaml → ...Review/1.3.11/Alibaba.OpenCodeReview.yaml b/...e/4.708/EmoteInteractive.RemoteMouse.yaml → ...Review/1.3.11/Alibaba.OpenCodeReview.yaml
@@ -1,8 +1,8 @@
-# Automatically updated by the winget bot at 2026/May/26
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
-
-PackageIdentifier: EmoteInteractive.RemoteMouse
-PackageVersion: '4.708'
-DefaultLocale: en-US
-ManifestType: version
-ManifestVersion: 1.12.0
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
+
+PackageIdentifier: Alibaba.OpenCodeReview
+PackageVersion: 1.3.11
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.12.0
diff --git a/manifests/a/AmN/yasb/2.0.4/AmN.yasb.installer.yaml b/manifests/a/AmN/yasb/2.0.4/AmN.yasb.installer.yaml
@@ -0,0 +1,27 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+InstallerLocale: en-US
+InstallerType: msi
+Installers:
+- Architecture: x64
+  InstallerUrl: https://github.com/amnweb/yasb/releases/download/v2.0.4/yasb-2.0.4-x64.msi
+  InstallerSha256: 85E41D377E994F37EEB2CFCB38943BCC0204CC10F85822EAF0856FF903359345
+  ProductCode: '{0524DE13-FAAF-4DF5-BEE3-A13A479EEA97}'
+  AppsAndFeaturesEntries:
+  - DisplayName: YASB Reborn
+    ProductCode: '{0524DE13-FAAF-4DF5-BEE3-A13A479EEA97}'
+    UpgradeCode: '{3F620CF5-07B5-47FD-8E37-9CA8AD14B608}'
+- Architecture: arm64
+  InstallerUrl: https://github.com/amnweb/yasb/releases/download/v2.0.4/yasb-2.0.4-aarch64.msi
+  InstallerSha256: 5583F0355BEC890DB5CDE5285B92BB50A094B47B2EF3ECD76F031507579540A1
+  ProductCode: '{A370D0AA-AFD0-4E45-AFB8-E8D912EF93B9}'
+  AppsAndFeaturesEntries:
+  - DisplayName: YASB Reborn
+    ProductCode: '{A370D0AA-AFD0-4E45-AFB8-E8D912EF93B9}'
+    UpgradeCode: '{3F620CF5-07B5-47FD-8E37-9CA8AD14B608}'
+ManifestType: installer
+ManifestVersion: 1.12.0
+ReleaseDate: 2026-06-15
diff --git a/manifests/a/AmN/yasb/2.0.4/AmN.yasb.locale.en-US.yaml b/manifests/a/AmN/yasb/2.0.4/AmN.yasb.locale.en-US.yaml
@@ -0,0 +1,28 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+PackageLocale: en-US
+Publisher: AmN
+PublisherUrl: https://github.com/amnweb
+PublisherSupportUrl: https://github.com/amnweb/yasb/issues
+Author: AmN
+PackageName: yasb
+PackageUrl: https://github.com/amnweb/yasb
+License: MIT License
+LicenseUrl: https://github.com/amnweb/yasb/blob/HEAD/LICENSE
+Copyright: Copyright 2024 AmN. All rights reserved.
+CopyrightUrl: https://github.com/amnweb/yasb/blob/main/LICENSE
+ShortDescription: A configurable Windows status bar.
+Description: A configurable Windows status bar.
+Tags:
+- status bar
+- topbar
+ReleaseNotesUrl: https://github.com/amnweb/yasb/releases/tag/v2.0.4
+InstallationNotes: https://github.com/amnweb/yasb
+Documentations:
+- DocumentLabel: Wiki
+  DocumentUrl: https://github.com/amnweb/yasb/wiki
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0
diff --git a/...9.285.8979/XiaoweiCloud.CalendarTask.yaml → manifests/a/AmN/yasb/2.0.4/AmN.yasb.yaml b/...9.285.8979/XiaoweiCloud.CalendarTask.yaml → manifests/a/AmN/yasb/2.0.4/AmN.yasb.yaml
@@ -1,8 +1,8 @@
-# Automatically updated by the winget bot at 2026/Jun/04
+# Created using wingetcreate 1.12.8.0
 # yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
 
-PackageIdentifier: XiaoweiCloud.CalendarTask
-PackageVersion: 3.29.285.8979
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
 DefaultLocale: en-US
 ManifestType: version
 ManifestVersion: 1.12.0
diff --git a/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.installer.yaml b/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.installer.yaml
@@ -0,0 +1,48 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+InstallerType: nullsoft
+InstallerSwitches:
+  Upgrade: --updated
+FileExtensions:
+- azw
+- azw3
+- cb7
+- cbr
+- cbt
+- cbz
+- epub
+- fb2
+- mobi
+- pdf
+ProductCode: 233610fa-2bda-5a09-a37b-75e0bafa7920
+ReleaseDate: 2026-06-15
+Installers:
+- Architecture: x64
+  Scope: user
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-x64.exe
+  InstallerSha256: 4FADFE6DD441E77F758943230A293914DAD185D0A71C153AD46995B11883BBE6
+  InstallerSwitches:
+    Custom: /currentuser
+- Architecture: x64
+  Scope: machine
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-x64.exe
+  InstallerSha256: 4FADFE6DD441E77F758943230A293914DAD185D0A71C153AD46995B11883BBE6
+  InstallerSwitches:
+    Custom: /allusers
+- Architecture: arm64
+  Scope: user
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-arm64.exe
+  InstallerSha256: 6C755D23957A990E6C003C9EB54D3EE705BBC34928958F658DD0CD8AEBB572AC
+  InstallerSwitches:
+    Custom: /currentuser
+- Architecture: arm64
+  Scope: machine
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-arm64.exe
+  InstallerSha256: 6C755D23957A990E6C003C9EB54D3EE705BBC34928958F658DD0CD8AEBB572AC
+  InstallerSwitches:
+    Custom: /allusers
+ManifestType: installer
+ManifestVersion: 1.12.0
diff --git a/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.locale.en-US.yaml b/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.locale.en-US.yaml
@@ -0,0 +1,73 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+PackageLocale: en-US
+Publisher: App by Troye
+PublisherUrl: https://www.koodoreader.com/
+PublisherSupportUrl: https://www.koodoreader.com/en/support
+PrivacyUrl: https://www.koodoreader.com/en/privacy
+Author: Troye
+PackageName: Koodo Reader
+PackageUrl: https://www.koodoreader.com/
+License: AGPL-3.0
+LicenseUrl: https://github.com/koodo-reader/koodo-reader/blob/HEAD/LICENSE
+Copyright: © 2026 App by Troye. All rights reserved.
+CopyrightUrl: https://www.koodoreader.com/en/term
+ShortDescription: All-in-one ebook reader
+Description: Koodo Reader is an all-in-one eBook reader for Windows, macOS, Linux, and the web, supporting over 15 formats.
+Moniker: koodoreader
+Tags:
+- ebook
+- ebook-reader
+- epub
+- pdf
+- reader
+ReleaseNotes: |-
+  New Features
+  - The window title bar will display a black theme in Dark Mode
+  - Support for searching and matching book covers and metadata online
+  - Support for syncing notes and highlights with Siyuan Notes; Siyuan Notes must be running with the network serving feature enabled
+  - Support for importing books via URL using the book's download link
+  - Browser extension support for clipping web pages from the web and saving them to your library
+  - Support for importing articles via URL links from the web
+  - Web version now supports restoring the book library and full-screen reading
+  - Added automatic sync feature after importing books
+  - Support for returning to the previous reading position after clicking notes, highlights, bookmarks, or table of contents
+  - Added 6 preset book layouts
+  - (Mobile) Support for searching and matching book covers and metadata online
+  - (Mobile) Supports syncing notes and highlights with Siyuan Notes; Siyuan Notes must be running with network serving enabled
+  - (Mobile) Added automatic sync feature after importing books
+  - (Mobile version) Added 6 new preset book layouts
+  - (Mobile) Added scheduled sync feature with customizable sync intervals; go to Settings > Sync Options
+  - (Mobile) Support for syncing reading progress with KOReader. Go to Settings > Sync Options
+  - (Mobile) Support for syncing new vocabulary to Eudic and Anki. Go to Settings > Sync Options
+  - (Mobile) Support for swiping the screen to turn pages after disabling page-turn animations
+  - (Mobile) Free users can now use OPDS and reading statistics features
+  - (Mobile) iOS now supports update notifications
+  - (Mobile) Page-turning animations are now supported when volume buttons are enabled for page turning
+  - (Mobile) Send to Kindle now displays uploading progress
+  - (Mobile) Support for backing up and restoring the book library; go to Settings and scroll to the bottom
+  Fixes
+  - Fixed an issue where the text being read aloud did not sync with the current position while listening to TTS
+  - Fixed an issue where the password-protected page would pop up repeatedly in certain situations
+  - Fixed an issue where books, notes, and highlights links could not be opened when the app was not running
+  - (Mobile) Fixed an issue where the narration did not sync with the current position while using TTS
+  - (Mobile) Fixed an issue where the TTS feature malfunctioned in certain situations
+  - (Mobile) Fixed an issue where page-turning animations were not disabled in E-ink mode
+  - (Mobile) Fixed an error when sending files to Kindle that were too large
+  - (Mobile) Fixed an issue where changes to TTS settings did not take effect immediately
+  - (Mobile) Fixed an issue where importing large books via sharing or as a default opening method caused an error
+  - (Mobile) Fixed an issue where books could not be imported or opened on older versions of iOS (caused by WebView compatibility issues)
+  - (Mobile) TTS stopped unexpectedly after locking the screen
+  [!NOTE]
+  This version has been selected as the stable release candidate. It should work fine in most cases. If you have any concerns, please download the previous stable version
+  [!TIP]
+  You can also download the installation package for this version from the our self-hosted mirror.
+ReleaseNotesUrl: https://github.com/koodo-reader/koodo-reader/releases/tag/v2.3.7
+Documentations:
+- DocumentLabel: Document
+  DocumentUrl: https://www.koodoreader.com/en/document
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0