arkonandClaude Opus 4.8 b84438a0aa fix(security): push-endpoint SSRF guard + tmux name validation; document tail-file roots ...

- M7 (SSRF): add isSafePushEndpoint (https-only; reject internal/loopback/link-local/metadata IPs incl. IPv4-mapped); enforce in PushSubscribeSchema and re-check before webpush.sendNotification. + unit test.
- M1 (command injection): validate tmux session names with isValidMuxName in sessionExists, killSession, and reconcileSessions before they reach a shell call site.
- M5: keep the intentional /var/log + ~/logs log-tail roots (a tested feature) and document the wider read scope in docs/security-architecture.md section 5 instead of dropping it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-09 20:02:17 +02:00

..

config

fix(web): address self-review findings on #103 (master-safe defaults + hardening)

2026-06-08 15:41:46 +02:00

mobile

test: COD-30 stabilize focused test suites

2026-06-08 10:19:38 -04:00

mocks

fix(tmux): isolate sessions on a dedicated socket + raise pane nofile limit (fixes new-session crash after tmux upgrade) (#96)

2026-05-25 23:28:58 +02:00

routes

fix(security): block DNS rebinding + cross-site CSRF + subagent-panel XSS

2026-06-09 03:19:51 +02:00

utils

fix(test): allow timing variance in StaleExpirationMap remaining TTL test

2026-01-28 05:20:10 +01:00

ai-idle-checker.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

api-generate-plan.test.ts

chore: bump version to 0.1402

2026-01-27 23:15:25 +01:00

api-responses.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

auth-security.test.ts

chore: release 0.9.0 — security hardening + warn-don't-block network policy

2026-06-08 19:29:47 +02:00

bash-tool-parser.test.ts

chore: bump version to 0.1486

2026-02-12 13:44:07 +01:00

buffer-accumulator.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

buffer-management.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

cleanup-manager.test.ts

test: add unit tests for Debouncer, CleanupManager, and timer migration refactors

2026-03-01 16:50:23 +01:00

cli-commands.test.ts

fix: COD-29 fail closed for unauthenticated network binds

2026-06-08 11:01:34 -04:00

debouncer.test.ts

test: add unit tests for Debouncer, CleanupManager, and timer migration refactors

2026-03-01 16:50:23 +01:00

dependency-security.test.ts

chore: COD-28 harden dependencies and public assets

2026-06-08 09:56:06 -04:00

edge-cases.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

effort-injection.test.ts

feat: inject effort as soft default via CLI flags instead of env var (#104)

2026-06-07 04:33:11 +02:00

file-link-click.test.ts

feat: hostname-aware window title (#82)

2026-05-12 09:11:33 +02:00

file-stream-manager.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

frontend-public-tooling.test.ts

chore: COD-28 harden dependencies and public assets

2026-06-08 09:56:06 -04:00

hooks-config.test.ts

fix: formatting and async test bug in hooks-config

2026-03-01 17:08:41 +01:00

image-watcher.test.ts

perf: implement phase 1-3 performance optimizations

2026-02-28 17:39:44 +01:00

inline-rename.test.ts

fix(client): harden inline rename against CJK, mid-rename deletion, and double-fire

2026-05-12 09:57:08 +02:00

integration-flows.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

lru-map.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

memory-leak-prevention.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

mux-factory.test.ts

chore: bump version to 0.1538

2026-02-18 12:51:35 +01:00

network-auth-policy.test.ts

fix: COD-29 harden downloads and extract auth policy

2026-06-08 11:01:34 -04:00

network-host-guard.test.ts

fix(security): block DNS rebinding + cross-site CSRF + subagent-panel XSS

2026-06-09 03:19:51 +02:00

nice-wrapper.test.ts

chore: bump version to 0.1486

2026-02-12 13:44:07 +01:00

opencode-resize.test.ts

fix: address code review findings for OpenCode integration

2026-02-26 15:58:26 +01:00

operation-lightspeed.test.ts

test: COD-30 stabilize focused test suites

2026-06-08 10:19:38 -04:00

orchestrator-loop.test.ts

fix: patch 3 production bugs found during deep audit

2026-03-21 19:23:37 +01:00

orchestrator-planner.test.ts

feat: add Orchestrator Loop — phased plan execution with team agents

2026-03-21 07:20:18 +01:00

perf-browser.test.ts

test: COD-30 stabilize perf browser timing

2026-06-08 10:27:18 -04:00

perf-subagent-load.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

pty-interactive.test.ts

fix: bulletproof test safety — IS_TEST_MODE guards prevent tests from killing real tmux sessions

2026-02-12 18:26:16 +01:00

push-endpoint-validation.test.ts

fix(security): push-endpoint SSRF guard + tmux name validation; document tail-file roots

2026-06-09 20:02:17 +02:00

push-payload-host-title.test.ts

test: fix title tests for new host constructor arg + async renderIndexHtml

2026-06-08 18:01:20 +02:00

qr-auth.test.ts

test: add 8 integration tests for GET /api/tunnel/qr SVG endpoint

2026-03-01 17:57:46 +01:00

quick-start.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

ralph-config.test.ts

refactor: rename inner-loop-tracker to ralph-tracker with API improvements

2026-01-21 22:36:45 +01:00

ralph-integration.test.ts

test: COD-30 stabilize focused test suites

2026-06-08 10:19:38 -04:00

ralph-loop-deep.test.ts

fix: ralph tracker — 3 bugs: first-occurrence completion, double-counting, TodoWrite pattern

2026-02-19 14:00:10 +01:00

ralph-loop.test.ts

refactor: improve code quality with stricter TypeScript and memory leak prevention

2026-01-21 14:01:47 +01:00

ralph-tracker.test.ts

test: add unit tests for Debouncer, CleanupManager, and timer migration refactors

2026-03-01 16:50:23 +01:00

render-index-html.test.ts

fix(web): address self-review findings on #105 (settings cache + brittle reveal)

2026-06-08 15:46:10 +02:00

respawn-adaptive-timing.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

respawn-analysis.md

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

respawn-controller.test.ts

chore: version packages

2026-05-31 05:17:07 +02:00

respawn-health.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

respawn-metrics.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

respawn-patterns.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

respawn-scenarios.md

fix: use temp file for plan checker prompt to avoid E2BIG + fix cancel race condition

2026-01-25 07:52:40 +01:00

respawn-team-awareness.test.ts

test: add shared mock infrastructure and route tests (phase 7)

2026-03-01 14:33:18 +01:00

respawn-test-plan.md

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

scheduled-runs.test.ts

chore: bump version to 0.1439

2026-01-30 17:50:02 +01:00

screenshot-capture.test.ts

chore: bump version to 0.1541

2026-02-18 18:14:13 +01:00

security-regression.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

self-update.test.ts

feat: add in-app self-updater (App Settings → Updates)

2026-06-09 01:55:54 +02:00

server-index-title.test.ts

test: fix title tests for new host constructor arg + async renderIndexHtml

2026-06-08 18:01:20 +02:00

session-cleanup.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

session-manager.test.ts

Merge master into refactor/envoverrides-tmux-export

2026-04-28 02:43:31 +02:00

session-state.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

session.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

setup.ts

test: COD-30 stabilize focused test suites

2026-06-08 10:19:38 -04:00

sse-events.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

sse-registry-parity.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

sse-subscription-filter.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

stale-expiration-map.test.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

state-store.test.ts

chore: version packages

2026-02-28 14:45:39 +01:00

string-utilities.test.ts

test: add global test setup with screen limits and reach 1337 tests

2026-01-22 11:30:10 +01:00

strip-ink-redraw-bloat.test.ts

test(routes): regression coverage for stripInkRedrawBloat

2026-05-12 10:11:47 +02:00

subagent-watcher.test.ts

fix: repair 15 pre-existing subagent-watcher test failures

2026-03-12 16:08:39 +01:00

task-queue.test.ts

perf: implement phase 1-3 performance optimizations

2026-02-28 17:39:44 +01:00

task-tracker.test.ts

perf: implement phase 1-3 performance optimizations

2026-02-28 17:39:44 +01:00

task.test.ts

test: add unit tests for Task class

2026-01-21 07:19:49 +01:00

team-watcher.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

templates.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

terminal-parsing.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

tmux-manager.test.ts

fix: COD-31 harden tmux launch cwd

2026-06-08 11:18:14 -04:00

tmux-restart-recovery.test.ts

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

tmux-window-size-query.test.ts

fix(tmux): isolate sessions on a dedicated socket + raise pane nofile limit (fixes new-session crash after tmux upgrade) (#96)

2026-05-25 23:28:58 +02:00

transcript-watcher.test.ts

feat: add hook-based idle detection for respawn controller

2026-01-25 21:29:35 +01:00

types.test.ts

test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

2026-06-09 20:02:15 +02:00

validation-utilities.test.ts

test: add global test setup with screen limits and reach 1337 tests

2026-01-22 11:30:10 +01:00

webgl-fallback.test.ts

fix(renderer): WebGL longtask fallback hardening (#91)

2026-05-19 11:43:36 +02:00