Close the four security-audit findings: paste injection, dev-bridge RCE, proxy origin laundering, OSC forgery - #453

Merged

nedtwigg merged 12 commits into

mainfrom

audit-findings-b1-b2-w1-w8

Aug 27, 2026

Commits on Aug 27, 2026

security(clipboard): filter ESC out of the bracketed-paste payload

nedtwigg
and
claude
committed
81eaaf9
security(standalone): authenticate the browser-dev bridge

nedtwigg
and
claude
committed
1c097f5
security(host): stop the iframe proxy vouching for strangers, and name the rule

nedtwigg
and
claude
committed
fcca569
security(shell-integration): filter OSC 633 fields before they are emitted

nedtwigg
and
claude
committed
a85c2eb
refactor(security): clean up the four audit fixes

nedtwigg
and
claude
committed
ff5eccf
security(ci): fail the build on an unguarded loopback listener

nedtwigg
and
claude
committed
9f63240
test(shell-integration): resolve the shells off PATH, and say what was skipped

nedtwigg
and
claude
committed
727386f
ci: install zsh so the shell-integration tests actually cover it

nedtwigg
and
claude
committed
54b9293
fix(security): address the four review notes on #453

nedtwigg
and
claude
committed
6c9aec7
ci: give the zsh install a budget that outlasts its own retries

nedtwigg
and
claude
committed
a1bd66a
ci: guard the last retry sleep so the stated worst case is the real one

nedtwigg
and
claude
committed
0039b15
ci: stop the apt warning promising a retry that does not happen

nedtwigg
and
claude
committed
ae3f015