Coy Geek 3509f7613e fix: audit and repair hooks token reuse with Gateway auth ...

Keep startup non-breaking for existing installs when hooks.token reuses Gateway auth, but surface a startup warning, critical security audit finding, and doctor --fix repair that rotates persisted hooks.token.

Closes #87376.

Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>

2026-06-02 08:58:40 -04:00

..

audit-channel-account-metadata.test.ts

test: tighten security audit assertions

2026-05-09 23:52:39 +01:00

audit-channel-dm-policy.test.ts

test: tighten security audit assertions

2026-05-09 23:52:39 +01:00

audit-channel-readonly-resolution.test.ts

test: clear weak assertion scan

2026-05-08 21:11:12 +01:00

audit-channel-readonly-setup-fallback.test.ts

chore(lint): enable stricter oxlint rules

2026-05-31 18:59:02 +01:00

audit-channel-source-config-discord.test.ts

test: tighten security audit source assertions

2026-05-09 23:06:28 +01:00

audit-channel-source-config-slack.test.ts

test: tighten security audit source assertions

2026-05-09 23:06:28 +01:00

audit-channel-test-helpers.ts

test: share channel audit plugin fixtures

2026-04-23 18:29:32 +01:00

audit-channel.collect.runtime.ts

…

audit-channel.ts

refactor: extract normalization core package

2026-05-31 01:33:00 +01:00

audit-config-basics.test.ts

Add security audit suppressions (#76949)

2026-05-16 22:57:04 +01:00

audit-config-include-perms.test.ts

test: tighten security config audit assertions

2026-05-09 23:05:04 +01:00

audit-config-symlink.test.ts

test: tighten security config audit assertions

2026-05-09 23:05:04 +01:00

audit-deep-code-safety.ts

fix(cycles): bulk extract leaf type surfaces

2026-04-11 13:26:50 +01:00

audit-deep-probe-findings.ts

fix(cycles): reduce remaining static import seams

2026-04-11 02:46:41 +01:00

audit-exec-safe-bins.test.ts

test: clear weak assertion scan

2026-05-08 21:11:12 +01:00

audit-exec-sandbox-host.test.ts

…

audit-exec-surface.test.ts

fix(security): audit Claude permission overrides under YOLO (#86557)

2026-05-25 18:18:51 +01:00

audit-extra.async.test.ts

refactor: centralize skills subsystem

2026-05-29 17:35:02 +01:00

audit-extra.async.ts

chore(lint): enable stricter error rules

2026-06-01 01:12:21 +01:00

audit-extra.summary.ts

chore(lint): tighten lint exception coverage

2026-05-31 10:42:59 +01:00

audit-extra.sync.test.ts

fix(security): honor model tool denies in audit

2026-05-10 07:21:23 +01:00

audit-extra.sync.ts

fix: audit and repair hooks token reuse with Gateway auth

2026-06-02 08:58:40 -04:00

audit-filesystem-windows.test.ts

fix(security): classify broad Windows SIDs as world principals

2026-05-13 15:19:02 -05:00

audit-fs.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

audit-gateway-auth-selection.test.ts

test: clear weak assertion scan

2026-05-08 21:11:12 +01:00

audit-gateway-config.ts

chore(lint): enable stricter oxlint rules

2026-05-31 18:59:02 +01:00

audit-gateway-exposure.test.ts

chore(lint): enable stricter oxlint rules

2026-05-31 18:59:02 +01:00

audit-gateway-http-auth.test.ts

fix: Hook ingress token unlocks password-mode gateway auth (#86453)

2026-05-25 13:39:56 +00:00

audit-gateway-tools-http.test.ts

perf(test): isolate gateway audit tests

2026-04-20 18:58:10 +01:00

audit-gateway.test.ts

fix: Hook ingress token unlocks password-mode gateway auth (#86453)

2026-05-25 13:39:56 +00:00

audit-hooks-routing.test.ts

fix: audit and repair hooks token reuse with Gateway auth

2026-06-02 08:58:40 -04:00

audit-loopback-logging.test.ts

…

audit-model-hygiene.test.ts

refactor: unify OpenAI provider identity (#88451)

2026-05-31 00:29:44 +01:00

audit-model-refs.ts

fix(security): resolve model aliases before audit classification (#74532)

2026-04-29 19:26:02 +01:00

audit-node-command-findings.test.ts

Require canonical node platform IDs [AI] (#81880)

2026-05-15 14:46:46 +05:30

audit-plugin-code-safety.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

audit-plugin-readonly-scope.test.ts

test: dedupe security audit mock read

2026-05-13 04:52:25 +01:00

audit-plugins-trust.test.ts

Persist plugin install index in SQLite (#88794)

2026-05-31 20:51:33 -04:00

audit-plugins-trust.ts

chore(lint): enable stricter error rules

2026-06-01 01:12:21 +01:00

audit-probe-failure.test.ts

test: tighten security audit helpers

2026-05-08 21:12:58 +01:00

audit-sandbox-browser.test.ts

chore(lint): enable no-promise-executor-return

2026-05-31 23:06:13 +01:00

audit-sandbox-docker-config.test.ts

test: tighten sandbox docker audit assertions

2026-05-10 00:04:53 +01:00

audit-small-model-risk.test.ts

fix(security): honor model tool denies in audit

2026-05-10 07:21:23 +01:00

audit-summary.test.ts

test: detail audit surface summary

2026-05-12 18:56:08 +01:00

audit-synced-folder.test.ts

…

audit-tool-policy.ts

…

audit-trust-model.test.ts

test: tighten security trust helpers

2026-05-08 21:14:43 +01:00

audit.deep.runtime.ts

…

audit.nondeep.runtime.ts

refactor: centralize skills subsystem

2026-05-29 17:35:02 +01:00

audit.runtime.ts

…

audit.ts

fix: audit and repair hooks token reuse with Gateway auth

2026-06-02 08:58:40 -04:00

audit.types.ts

Add security audit suppressions (#76949)

2026-05-16 22:57:04 +01:00

channel-metadata.ts

refactor: extract normalization core package

2026-05-31 01:33:00 +01:00

config-regex.ts

…

context-visibility.test.ts

…

context-visibility.ts

…

core-dangerous-config-flags.ts

Add security audit suppressions (#76949)

2026-05-16 22:57:04 +01:00

dangerous-config-flags-core.ts

test: move pure hotspots to fast lane

2026-04-28 07:56:40 +01:00

dangerous-config-flags-current-snapshot.test.ts

test: type current plugin metadata snapshot mock

2026-05-27 03:44:27 +01:00

dangerous-config-flags-current.ts

perf(gateway): defer startup warning fallback imports

2026-05-27 03:45:42 +01:00

dangerous-config-flags.test.ts

Add security audit suppressions (#76949)

2026-05-16 22:57:04 +01:00

dangerous-config-flags.ts

perf(gateway): defer startup warning fallback imports

2026-05-27 03:45:42 +01:00

dangerous-tools.ts

refactor: keep plugin login policy out of core

2026-04-22 06:39:48 +01:00

dm-policy-shared.ts

refactor: extract normalization core package

2026-05-31 01:33:00 +01:00

exec-filesystem-policy.ts

Clarify exec filesystem policy drift (#79153)

2026-05-07 20:05:19 -05:00

external-content-source.ts

refactor: extract normalization core package

2026-05-31 01:33:00 +01:00

external-content.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

external-content.ts

fix: sanitize LLM special tokens in external content

2026-04-21 20:29:02 +01:00

fix.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

fix.ts

chore(lint): enable stricter error rules

2026-06-01 01:12:21 +01:00

installed-plugin-dirs.ts

refactor: extract normalization core package

2026-05-31 01:33:00 +01:00

safe-regex.test.ts

test: tighten safe regex assertions

2026-05-08 21:05:09 +01:00

safe-regex.ts

fix(logging): redact persisted transcript text

2026-04-26 12:12:44 -07:00

scan-paths.test.ts

fix(security): 7 P1 hardening fixes — scan-paths, windows-acl, audit-extra (#67003)

2026-04-16 13:40:05 -04:00

scan-paths.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

secret-equal.ts

docs: clarify inline code comments

2026-05-31 14:37:41 +01:00

system-tags.ts

fix(events): sanitize queued system markers (#87094)

2026-05-26 20:07:39 -07:00

test-temp-cases.ts

test: share security audit temp fixtures

2026-04-23 18:29:32 +01:00

windows-acl.test.ts

fix: update fs-safe fallback dependency

2026-05-20 19:35:08 +01:00

windows-acl.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00