fix(security): close the agent star-consent bypass found auditing the #892 merge - #917

Merged

lidge-jun merged 8 commits into

devfrom

codex/postmerge-audit-fixes

Aug 3, 2026

Commits on Aug 3, 2026

fix(repo): untrack the retired Go file that reached dev, and guard it mechanically
lidge-jun
committed
3ffb7e6
fix(consent): key the star guard on the authenticating credential, not headers
lidge-jun
committed
503786a
fix(relay-eager): wake a parked read by cancelling the reader, not by racing
lidge-jun
committed
5d8acf9
test(bounded-body): lock the explicit maxBytes budget and fragmented reassembly
lidge-jun
committed
99747ca
test: close three coverage gaps the post-merge audit found mutation-surviving
lidge-jun
committed
f2eb047
fix(consent,relay-eager): require a dashboard session, and inspect before abort
lidge-jun
committed
ef851ae
test: make the two retention repairs observable instead of merely correct
lidge-jun
committed
cec481c
docs(consent), test(bounded-body): state the guard's real limit, pin the shape
lidge-jun
committed
6542970