Supersede open PR stack: deep-audited consolidation of #40 and #43-#52 - #53

Closed

ndycode wants to merge 60 commits into

devfrom

audit/supersede-open-prs

Commits on Feb 26, 2026

feat(sync): add manual Codex CLI <-> plugin account sync
ndycode
committed
9d2c3ac
fix(sync): address PR review follow-ups
ndycode
committed
b65dc6f
test(sync): cover windows retry and secure file mode
ndycode
committed
3eff80b
fix(sync): add push rollback and share identity helpers
ndycode
committed
de14ffa
fix(sync): validate token payloads and harden backups
ndycode
committed
dda51e3
fix: resolve remaining codex sync review findings
ndycode
committed
6cd36c9
refactor: address remaining codex sync review nits
ndycode
committed
5c18d1d

Commits on Feb 27, 2026

fix(security): remediate audited dependency vulnerabilities
ndycode
committed
af78211
fix(auth): harden loopback redirect and token-aware account selection
ndycode
committed
c04782d
feat(api): add explicit setup/doctor modes with compatibility guards
ndycode
committed
a0c1608
docs(audit): publish deep architecture security audit notes
ndycode
committed
618f06b
docs(api): publish v5.4.0 contract audit and mode guidance
ndycode
committed
23967e1
fix(deps): patch hono and rollup audit findings
ndycode
committed
ad5b89b
fix(auth): harden callback parsing and loopback redirect URI
ndycode
committed
91af817
fix(rate-limit): honor retry_after_ms units in response parsing
ndycode
committed
cbe88d3
test(api): expand mode contract compatibility coverage
ndycode
committed
ce24cd8
docs(api): deepen v5.4 contract matrix and compatibility evidence
ndycode
committed
1ba4da2
fix(oauth): harden callback server startup fallback path
ndycode
committed
5d0135c
fix(oauth): enforce callback state in waitForCode polling
ndycode
committed
276056f
chore(deps): remediate npm audit vulnerabilities
ndycode
committed
9637f45

Commits on Feb 28, 2026

fix(api): reject empty mode inputs for setup and doctor
ndycode
committed
c651eec
test(types): remove legacy ts-ignore suppressions in storage suite
ndycode
committed
c24bfae
fix(auth): align waitForCode expectedState parameter naming
ndycode
committed
7c911b6
fix(rate-limit): clamp delays and codify retry_after precedence
ndycode
committed
a0cc4f2
fix(rate-limit): normalize header retry delays and add clamp boundary tests
ndycode
committed
4309694
fix(deps): upgrade hono to patched 4.12.3
ndycode
committed
e10a7ba
fix(deps): patch minimatch ReDoS transitive paths
ndycode
committed
0927d97
fix(deps): force patched rollup for vite/vitest chain
ndycode
committed
8a8e870
fix(deps): override ajv to patched 6.14.0
ndycode
committed
01ceec8
refactor(style): normalize top-level helper declarations
ndycode
committed
29574d6
refactor(request): simplify tool-output normalization flow
ndycode
committed
10f990e
fix(recovery): harden recovered tool-use id normalization
ndycode
committed
64f367c
docs(architecture): clarify orphan output serialization behavior
ndycode
committed
f102943
fix(audit phase 1): remediate high dependency vulnerabilities
ndycode
committed
6b3f907
fix(audit phase 2): harden manual OAuth callback validation
ndycode
committed
715c1a2
fix(audit phase 3): tighten local OAuth callback server behavior
ndycode
committed
3636cca
docs(audit): publish overlap ledger and deep audit report
ndycode
committed
1b28a87
fix(deps): remediate hono advisory and pin rollup override
ndycode
committed
2ea33d5
fix(auth): enforce loopback redirect URI and strict callback parsing
ndycode
committed
5770cb2
fix(rate-limit): normalize retry-after units and clamp boundaries
ndycode
committed
ccb7a99
test(ui): harden interactive menu coverage and gate stability
ndycode
committed
22fc8b1
docs(audit): add deep audit evidence and verification logs
ndycode
committed
9442d5d
chore(audit): refresh eslint toolchain and clear residual audit advisory
ndycode
committed
6daad9f
fix(codex-sync): enforce restrictive sync directory permissions

ndycode
and
codex
committed
8fbd262
merge(pr40): integrate codex sync feature branch
ndycode
committed
356e047
merge(pr43): integrate explicit setup/doctor mode contract
ndycode
committed
0ac0dba
merge(pr51): integrate deep comprehensive audit hardening
ndycode
committed
c4d14e3
merge(pr52): integrate deep repo hardening follow-up
ndycode
committed
a00d1ff
fix(sync): retry rollback file ops on Windows lock errors

ndycode
and
codex
committed
aeadb00
merge(pr44): integrate deep audit hardening branch
ndycode
committed
dce04f1
merge(pr45): integrate phase 1 dependency security branch
ndycode
committed
b924281
merge(pr46): integrate phase 2 oauth hardening branch
ndycode
committed
81c650c
merge(pr47): integrate phase 3 retry-after unit branch
ndycode
committed
2a365db
merge(pr48): integrate full code quality audit branch
ndycode
committed
8a887c3
merge(pr49): integrate simplify and harden audit branch
ndycode
committed
4f47d72
merge(pr50): integrate deep RCA remediation branch
ndycode
committed
2125d49
Fix all remaining PR #53 review findings
ndycode
committed
508ac44
Address latest PR #53 critical review findings
ndycode
committed
6005963
Resolve latest deep-audit review findings
ndycode
committed
2050535
Fix remaining review threads on path redaction and cache loading

ndycode
and
codex
committed
1fe16b6