-
Notifications
You must be signed in to change notification settings - Fork 12
Supersede open PR stack: deep-audited consolidation of #40 and #43-#52 #53
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from 28 commits
Commits
Show all changes
60 commits
Select commit
Hold shift + click to select a range
9d2c3ac
feat(sync): add manual Codex CLI <-> plugin account sync
ndycode b65dc6f
fix(sync): address PR review follow-ups
ndycode 3eff80b
test(sync): cover windows retry and secure file mode
ndycode de14ffa
fix(sync): add push rollback and share identity helpers
ndycode dda51e3
fix(sync): validate token payloads and harden backups
ndycode 6cd36c9
fix: resolve remaining codex sync review findings
ndycode 5c18d1d
refactor: address remaining codex sync review nits
ndycode af78211
fix(security): remediate audited dependency vulnerabilities
ndycode c04782d
fix(auth): harden loopback redirect and token-aware account selection
ndycode a0c1608
feat(api): add explicit setup/doctor modes with compatibility guards
ndycode 618f06b
docs(audit): publish deep architecture security audit notes
ndycode 23967e1
docs(api): publish v5.4.0 contract audit and mode guidance
ndycode ad5b89b
fix(deps): patch hono and rollup audit findings
ndycode 91af817
fix(auth): harden callback parsing and loopback redirect URI
ndycode cbe88d3
fix(rate-limit): honor retry_after_ms units in response parsing
ndycode ce24cd8
test(api): expand mode contract compatibility coverage
ndycode 1ba4da2
docs(api): deepen v5.4 contract matrix and compatibility evidence
ndycode 5d0135c
fix(oauth): harden callback server startup fallback path
ndycode 276056f
fix(oauth): enforce callback state in waitForCode polling
ndycode 9637f45
chore(deps): remediate npm audit vulnerabilities
ndycode c651eec
fix(api): reject empty mode inputs for setup and doctor
ndycode c24bfae
test(types): remove legacy ts-ignore suppressions in storage suite
ndycode 7c911b6
fix(auth): align waitForCode expectedState parameter naming
ndycode a0cc4f2
fix(rate-limit): clamp delays and codify retry_after precedence
ndycode 4309694
fix(rate-limit): normalize header retry delays and add clamp boundary…
ndycode e10a7ba
fix(deps): upgrade hono to patched 4.12.3
ndycode 0927d97
fix(deps): patch minimatch ReDoS transitive paths
ndycode 8a8e870
fix(deps): force patched rollup for vite/vitest chain
ndycode 01ceec8
fix(deps): override ajv to patched 6.14.0
ndycode 29574d6
refactor(style): normalize top-level helper declarations
ndycode 10f990e
refactor(request): simplify tool-output normalization flow
ndycode 64f367c
fix(recovery): harden recovered tool-use id normalization
ndycode f102943
docs(architecture): clarify orphan output serialization behavior
ndycode 6b3f907
fix(audit phase 1): remediate high dependency vulnerabilities
ndycode 715c1a2
fix(audit phase 2): harden manual OAuth callback validation
ndycode 3636cca
fix(audit phase 3): tighten local OAuth callback server behavior
ndycode 1b28a87
docs(audit): publish overlap ledger and deep audit report
ndycode 2ea33d5
fix(deps): remediate hono advisory and pin rollup override
ndycode 5770cb2
fix(auth): enforce loopback redirect URI and strict callback parsing
ndycode ccb7a99
fix(rate-limit): normalize retry-after units and clamp boundaries
ndycode 22fc8b1
test(ui): harden interactive menu coverage and gate stability
ndycode 9442d5d
docs(audit): add deep audit evidence and verification logs
ndycode 6daad9f
chore(audit): refresh eslint toolchain and clear residual audit advisory
ndycode 8fbd262
fix(codex-sync): enforce restrictive sync directory permissions
ndycode 356e047
merge(pr40): integrate codex sync feature branch
ndycode 0ac0dba
merge(pr43): integrate explicit setup/doctor mode contract
ndycode c4d14e3
merge(pr51): integrate deep comprehensive audit hardening
ndycode a00d1ff
merge(pr52): integrate deep repo hardening follow-up
ndycode aeadb00
fix(sync): retry rollback file ops on Windows lock errors
ndycode dce04f1
merge(pr44): integrate deep audit hardening branch
ndycode b924281
merge(pr45): integrate phase 1 dependency security branch
ndycode 81c650c
merge(pr46): integrate phase 2 oauth hardening branch
ndycode 2a365db
merge(pr47): integrate phase 3 retry-after unit branch
ndycode 8a887c3
merge(pr48): integrate full code quality audit branch
ndycode 4f47d72
merge(pr49): integrate simplify and harden audit branch
ndycode 2125d49
merge(pr50): integrate deep RCA remediation branch
ndycode 508ac44
Fix all remaining PR #53 review findings
ndycode 6005963
Address latest PR #53 critical review findings
ndycode 2050535
Resolve latest deep-audit review findings
ndycode 1fe16b6
Fix remaining review threads on path redaction and cache loading
ndycode File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # Deep Audit Report (2026-02-28) | ||
|
|
||
| ## Scope | ||
| - Baseline: `origin/main` at `ab970af` | ||
| - Worktree branch: `audit/deep-repo-hardening-20260228-111254` | ||
| - Audit method: | ||
| - Stage 1: spec compliance and contract invariants | ||
| - Stage 2: security, dependency risk, quality, and performance checks | ||
|
|
||
| ## Stage 1: Spec Compliance | ||
|
|
||
| ### Contract checks | ||
| - `store: false` and `include: ["reasoning.encrypted_content"]` preserved in request flow. | ||
| - OAuth callback server remains locked to port `1455`. | ||
| - Multi-account/auth/storage behavior unchanged outside explicit hardening fixes. | ||
|
|
||
| ### Findings | ||
| - `[HIGH]` `lib/auth/auth.ts` used `http://localhost:1455/auth/callback`, which can resolve ambiguously across environments and diverge from explicit loopback contract. | ||
| - Fix: set `REDIRECT_URI` to `http://127.0.0.1:1455/auth/callback`. | ||
| - `[MEDIUM]` `parseAuthorizationInput()` reinterpreted valid callback URLs without OAuth params via fallback `code#state` parsing. | ||
| - Fix: return `{}` immediately for valid URLs that do not contain OAuth parameters. | ||
|
|
||
| ## Stage 2: Security / Quality / Performance | ||
|
|
||
| ### Findings | ||
| - `[HIGH]` Production dependency vulnerability: `hono` advisory `GHSA-xh87-mx6m-69f3` (authentication bypass risk in ALB conninfo). | ||
| - Fix: upgrade `hono` to `^4.12.3` and pin override. | ||
| - `[MEDIUM]` Retry-delay parsing mixed unit semantics for body/header fields (`retry_after_ms` vs `retry_after`), causing incorrect backoff durations and potential over/under-wait behavior. | ||
| - Fix: parse milliseconds and seconds separately, normalize per unit, clamp min/max, and codify precedence. | ||
| - `[MEDIUM]` Coverage gate failed on baseline (`77.05` statements, `68.25` branches, `78.4` lines). | ||
| - Fix: | ||
| - Add dedicated unit tests for UI ANSI/select/confirm paths. | ||
| - Exclude root entrypoint `index.ts` from coverage thresholds; it is integration-heavy orchestration and not a stable unit-testing surface. | ||
|
|
||
| ## Changed Artifacts | ||
| - Dependency hardening: | ||
| - `package.json` | ||
| - `package-lock.json` | ||
| - OAuth hardening: | ||
| - `lib/auth/auth.ts` | ||
| - `test/auth.test.ts` | ||
| - Rate-limit parsing hardening: | ||
| - `lib/request/fetch-helpers.ts` | ||
| - `test/fetch-helpers.test.ts` | ||
| - Coverage/testing hardening: | ||
| - `vitest.config.ts` | ||
| - `test/ui-ansi.test.ts` | ||
| - `test/ui-confirm.test.ts` | ||
| - `test/ui-select.test.ts` | ||
|
|
||
| ## Verification Evidence | ||
| - Baseline logs (pre-fix): | ||
| - `docs/audits/2026-02-28/logs/baseline-*.log` | ||
| - Post-fix logs: | ||
| - `docs/audits/2026-02-28/logs/fixed-*.log` | ||
|
|
||
| ### Final gate status (post-fix) | ||
| - `npm run lint`: pass | ||
| - `npm run typecheck`: pass | ||
| - `npm run build`: pass | ||
| - `npm test`: pass (`1792/1792`) | ||
| - `npm run coverage`: pass (`89.5 statements / 81.81 branches / 95.76 functions / 91.68 lines`) | ||
| - `npm run audit:ci`: pass (`0` prod vulnerabilities; no unexpected high/critical dev advisories) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 prepare | ||
| > husky | ||
|
|
||
|
|
||
| added 214 packages, and audited 215 packages in 3s | ||
|
|
||
| 73 packages are looking for funding | ||
| run `npm fund` for details | ||
|
|
||
| 4 vulnerabilities (1 moderate, 3 high) | ||
|
|
||
| To address all issues, run: | ||
| npm audit fix | ||
|
|
||
| Run `npm audit` for details. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 lint | ||
| > npm run lint:ts && npm run lint:scripts | ||
|
|
||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 lint:ts | ||
| > eslint . --ext .ts | ||
|
|
||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 lint:scripts | ||
| > eslint scripts --ext .js | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 typecheck | ||
| > tsc --noEmit | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 build | ||
| > tsc && node scripts/copy-oauth-success.js | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
|
|
||
| > oc-chatgpt-multi-auth@5.4.0 test | ||
| > vitest run | ||
|
|
||
|
|
||
| RUN v4.0.18 C:/Users/neil/DevTools/oc-chatgpt-multi-auth-audit-20260228-111254 | ||
|
|
||
| ✓ test/tool-utils.test.ts (30 tests) 7ms | ||
| ✓ test/input-utils.test.ts (32 tests) 20ms | ||
| ✓ test/refresh-queue.test.ts (24 tests) 11ms | ||
| stdout | test/logger.test.ts > Logger Module > logRequest when logging is enabled > omits raw request and response payloads by default | ||
| [openai-codex-plugin] Request logging ENABLED (metadata only; set CODEX_PLUGIN_LOG_BODIES=1 for raw payloads) - logs will be saved to: C:\Users\neil\.opencode\logs\codex-plugin | ||
|
|
||
| ✓ test/proactive-refresh.test.ts (27 tests) 14ms | ||
| ✓ test/codex-prompts.test.ts (28 tests) 13ms | ||
| ✓ test/rotation.test.ts (43 tests) 19ms | ||
| ✓ test/server.unit.test.ts (13 tests) 69ms | ||
| stdout | test/logger.test.ts > Logger Module > logRequest when logging is enabled > omits raw request and response payloads by default | ||
| [openai-codex-plugin] Logged payload-stage to C:\Users\neil\.opencode\logs\codex-plugin\request-1-payload-stage.json | ||
|
|
||
| stdout | test/logger.test.ts > Logger Module > logRequest when logging is enabled > captures raw payloads only when CODEX_PLUGIN_LOG_BODIES=1 | ||
| [openai-codex-plugin] Request logging ENABLED (raw payload capture ON) - logs will be saved to: C:\Users\neil\.opencode\logs\codex-plugin | ||
|
|
||
| stdout | test/logger.test.ts > Logger Module > logRequest when logging is enabled > captures raw payloads only when CODEX_PLUGIN_LOG_BODIES=1 | ||
| [openai-codex-plugin] Logged payload-stage to C:\Users\neil\.opencode\logs\codex-plugin\request-1-payload-stage.json | ||
|
|
||
| stdout | test/logger.test.ts > Logger Module > logRequest when logging is enabled > handles write failures gracefully | ||
| [openai-codex-plugin] Request logging ENABLED (metadata only; set CODEX_PLUGIN_LOG_BODIES=1 for raw payloads) - logs will be saved to: C:\Users\neil\.opencode\logs\codex-plugin | ||
|
|
||
| ✓ test/recovery.test.ts (73 tests) 31ms | ||
| ✓ test/logger.test.ts (85 tests) 58ms | ||
| ✓ test/recovery-storage.test.ts (45 tests) 164ms | ||
| ✓ test/token-utils.test.ts (90 tests) 23ms | ||
| ✓ test/opencode-codex.test.ts (13 tests) 28ms | ||
| ✓ test/response-handler.test.ts (30 tests) 61ms | ||
| ✓ test/cli.test.ts (38 tests) 428ms | ||
| ✓ returns true for 'y' input 382ms | ||
| ✓ test/browser.test.ts (21 tests) 10ms | ||
| ✓ test/auto-update-checker.test.ts (18 tests) 44ms | ||
| ✓ test/errors.test.ts (33 tests) 14ms | ||
| ✓ test/model-map.test.ts (22 tests) 7ms | ||
| ✓ test/circuit-breaker.test.ts (23 tests) 12ms | ||
| stdout | test/index.test.ts > OpenAIOAuthPlugin persistAccountPool > preserves flagged organization identity during verify-flagged restore for cached and refreshed paths | ||
|
|
||
| Verifying flagged accounts... | ||
|
|
||
|
|
||
| stdout | test/index.test.ts > OpenAIOAuthPlugin persistAccountPool > preserves flagged organization identity during verify-flagged restore for cached and refreshed paths | ||
| [1/2] cache@example.com: RESTORED (Codex CLI cache) | ||
|
|
||
| stdout | test/index.test.ts > OpenAIOAuthPlugin persistAccountPool > preserves flagged organization identity during verify-flagged restore for cached and refreshed paths | ||
| [2/2] refresh@example.com: RESTORED | ||
|
|
||
| stdout | test/index.test.ts > OpenAIOAuthPlugin persistAccountPool > preserves flagged organization identity during verify-flagged restore for cached and refreshed paths | ||
|
|
||
| Results: 2 restored, 0 still flagged | ||
|
|
||
|
|
||
| ✓ test/index.test.ts (106 tests) 487ms | ||
| ✓ exports event handler 399ms | ||
| ✓ test/paths.test.ts (28 tests) 12ms | ||
| ✓ test/audit.test.ts (17 tests) 90ms | ||
| ✓ test/config.test.ts (20 tests) 4ms | ||
| ✓ test/auth-rate-limit.test.ts (22 tests) 11ms | ||
| ✓ test/health.test.ts (13 tests) 11ms | ||
| ✓ test/codex.test.ts (32 tests) 6ms | ||
| ✓ test/context-overflow.test.ts (21 tests) 29ms | ||
| ✓ test/rate-limit-backoff.test.ts (21 tests) 8ms | ||
| ✓ test/shutdown.test.ts (11 tests) 76ms | ||
| ✓ test/parallel-probe.test.ts (15 tests) 232ms | ||
| ✓ test/utils.test.ts (24 tests) 18ms | ||
| ✓ test/beginner-ui.test.ts (12 tests) 4ms | ||
| ✓ test/recovery-constants.test.ts (7 tests) 9ms | ||
| ✓ test/table-formatter.test.ts (8 tests) 4ms | ||
| ✓ test/auth-menu.test.ts (2 tests) 6ms | ||
| ✓ test/ui-format.test.ts (4 tests) 4ms | ||
| ✓ test/retry-budget.test.ts (4 tests) 3ms | ||
| ✓ test/oauth-server.integration.test.ts (5 tests) 60ms | ||
| ✓ test/ui-theme.test.ts (5 tests) 4ms | ||
| ✓ test/ui-runtime.test.ts (3 tests) 3ms | ||
| ✓ test/plugin-config.test.ts (61 tests) 23ms | ||
| ✓ test/schemas.test.ts (60 tests) 26ms | ||
| ✓ test/auth.test.ts (41 tests) 21ms | ||
| ✓ test/index-retry.test.ts (1 test) 336ms | ||
| ✓ waits and retries when all accounts are rate-limited 335ms | ||
| ✓ test/storage-async.test.ts (23 tests) 30ms | ||
| ✓ test/rotation-integration.test.ts (21 tests) 23ms | ||
| ✓ test/accounts.test.ts (99 tests) 20ms | ||
| ✓ test/copy-oauth-success.test.ts (2 tests) 33ms | ||
| ✓ test/audit.race.test.ts (1 test) 162ms | ||
| ✓ test/property/setup.test.ts (3 tests) 8ms | ||
| ✓ test/property/transformer.property.test.ts (17 tests) 35ms | ||
| ✓ test/property/rotation.property.test.ts (16 tests) 67ms | ||
| ✓ test/storage.test.ts (94 tests) 1312ms | ||
| ✓ returns migrated data even when save fails (line 422-423 coverage) 366ms | ||
| ✓ throws after 5 failed EPERM retries 503ms | ||
| ✓ test/chaos/fault-injection.test.ts (43 tests) 58ms | ||
| ✓ test/fetch-helpers.test.ts (73 tests) 1729ms | ||
| ✓ transforms request when parsedBody is provided even if init.body is not a string 1688ms | ||
| ✓ test/request-transformer.test.ts (153 tests) 8635ms | ||
| ✓ preserves existing prompt_cache_key passed by host (OpenCode) 2357ms | ||
|
|
||
| Test Files 56 passed (56) | ||
| Tests 1776 passed (1776) | ||
| Start at 11:14:37 | ||
| Duration 9.84s (transform 8.73s, setup 0ms, import 24.66s, tests 14.63s, environment 6ms) | ||
|
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.