[temp] write-permission probe - #1

Closed

ra-co88 wants to merge 15 commits into

fix/apodex-audit-findings

Commits on Aug 27, 2026

fix(auth): use independent CSRF state for Claude OAuth (SEC-01)
pt-act
committed
a5d4bdd
fix(computer): gate AppleScript/JXA through the #604 destructive gate (SEC-02)
pt-act
committed
8fe91b9
fix(webfetch): block SSRF to internal/metadata destinations (SEC-03)
pt-act
committed
b41749a
fix(config): atomic, owner-only, race-free config writes (RC-01, SEC-04)
pt-act
committed
0e9bb5c
fix(network): bound the reconnect wait so offline states can't hang (REL-01)
pt-act
committed
eb37462
chore: ignore local agent context and OS cruft
pt-act
committed
e7b6aee
fix(config): preserve last-good config on parse error instead of resetting (REL-02)
pt-act
committed
9137bbe
docs+fix(tui): document accessibility, honor NO_COLOR in the TUI (A11Y-01, VC-01)
pt-act
committed
35d8d90
docs: document the install/update supply-chain trust model (SEC-07)
pt-act
committed
94eea8c
fix(config): harden RC-01/REL-02 remediation per audit follow-up
pt-act
committed
99544e7
fix(webfetch): pin SSRF-validated IP at connect time to close DNS-rebinding (SEC-03 #4)
pt-act
committed
6e2cad6
docs: record honest per-finding scope of the audit remediation
pt-act
committed
9c10614
fix(config): add Windows cross-process config lock to fully close RC-01
pt-act
committed
4dce887
fix(security): fail closed on pinned fetch and lock direct config saves
pt-act
committed
d708f60
chore: preserve upstream v0.81.0 changelog
pt-act
committed
cde3f97