Repository navigation
Security & quality hardening for 1.5.4 (P0-01…P0-13) - #39
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKN2tz335nxPSo4Sv2b
…n logs and errors
… (file, dir, secrets)
…~/.gnupg, ~/.azure
…d docs drift checks
…-RPC test Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
…st PRs Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
…-db error Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
…nstall test) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b924f5cab8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // Causly's own data: ~/.causly or CAUSLY_HOME (API keys, secrets store, database), a custom | ||
| // CAUSLY_ENV_FILE and the .env next to the code (a git checkout). | ||
| function causlyOwnPaths(env) { | ||
| return [env.CAUSLY_HOME, env.CAUSLY_ENV_FILE, path.join(PACKAGE_ROOT, ".env")].filter(Boolean); |
There was a problem hiding this comment.
When the server runs from a source checkout, dataDir() places the default secrets store at <PACKAGE_ROOT>/.causly-secrets.enc, but this list only protects CAUSLY_HOME, CAUSLY_ENV_FILE, and <PACKAGE_ROOT>/.env. The file tools can therefore still overwrite or delete the encrypted store, potentially destroying saved secrets. Include the actual default store path in the protected paths.
Useful? React with 👍 / 👎.
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: KNIHAL/causly-agent-environment | ||
| ref: master |
There was a problem hiding this comment.
While the P0-06..13 documentation updates remain only on the docs branch, this job checks out master and then runs tests/docsDrift.test.js with CAUSLY_REQUIRE_DOCS=1. That makes the check compare the updated manifest and permission levels against the stale docs revision, so the new docs-drift job fails until the docs changes are merged. Point it at the revision containing those updates, or land the docs changes first.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KXDWKJrAj1tYcVEYYyGvEv
What
P0 hardening before 1.5.4 and the 10 Nov launch:
npm audit --omit=devclean)cmd.exefix fornpm install(issue npm install fails on packages with postinstall scripts: 'node' not recognized in nested cmd.exe #2)http_checkSSRF guard; consistent path protection (real-path, macOS/Linux/Windows)npm ci, audit, Dependabot, package-contents and docs-drift checksgit_stash/git_tag, missing level is a test failureedit_filematches CRLF files;github_list_issuesstate=allpages past PRshomepage/bugs, provenance publish workflow, release metadata test; version bump to 1.5.4Why
Fixes issues from the external audit and QA findings before the launch.
Tests
77 files / 1264 tests pass locally on Windows (Node 24).
Notes
docs-driftjob checks out the docs repomaster. The docs for P0-06..13 are onKNIHAL/causly-agent-environmentbranchdocs/hardening-1.5.4, so that job fails until the docs are merged.npm publish.