Peter Steinberger 481d826ff4 fix(vault): prevent insecure secrets plan writes (#113707) ...

* fix(vault): harden secrets plan writes

* fix(secrets): avoid env marker collision

* style(secrets): type plan write rejection

* refactor(onepassword): remove obsolete path resolver

* fix(secrets): preserve Windows plan path trust

* refactor(secrets): compact ACL token policy

* fix(secrets): route permission checks through facade

2026-07-25 08:27:33 -07:00

..

apply.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

apply.ts

fix(config,secrets): emit JSON errors and cover dotenv roots (#104340)

2026-07-17 23:14:05 -07:00

audit.test.ts

fix(config,secrets): emit JSON errors and cover dotenv roots (#104340)

2026-07-17 23:14:05 -07:00

audit.ts

fix(config,secrets): emit JSON errors and cover dotenv roots (#104340)

2026-07-17 23:14:05 -07:00

auth-profiles-scan.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

auth-store-paths.ts

…

channel-contract-api.external.test.ts

…

channel-contract-api.fast-path.test.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

channel-contract-api.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

channel-contract-surface-guardrails.test.ts

…

channel-env-var-names.ts

…

channel-env-vars.dynamic.test.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

channel-env-vars.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

channel-secret-basic-runtime.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

channel-secret-collector-runtime.ts

…

channel-secret-tts-runtime.ts

…

command-config.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

command-config.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

config-io.ts

chore(tooling): enforce no-floating-promises and drop DOM globals from Node-side typechecking (#104422)

2026-07-11 07:28:20 -07:00

configure-plan.test.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

configure-plan.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

configure.test.ts

…

configure.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

credential-matrix.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

exec-resolution-policy.ts

…

exec-secret-ref-id-parity.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

json-pointer.test.ts

…

json-pointer.ts

…

legacy-secretref-env-marker.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

model-provider-header-policy.ts

…

path-utils.test.ts

fix(secrets): reject prototype-polluting mutation paths (#102840)

2026-07-10 00:17:31 +01:00

path-utils.ts

fix(secrets): reject prototype-polluting mutation paths (#102840)

2026-07-10 00:17:31 +01:00

plan.test.ts

test: speed up and stabilize full suite

2026-07-05 08:00:23 -04:00

plan.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

plugin-setup-plan.ts

fix(onepassword): make SecretRef setup production-safe

2026-07-25 06:03:30 -05:00

private-plan-file.test.ts

fix(vault): prevent insecure secrets plan writes (#113707)

2026-07-25 08:27:33 -07:00

private-plan-file.ts

fix(vault): prevent insecure secrets plan writes (#113707)

2026-07-25 08:27:33 -07:00

provider-env-vars.dynamic.test.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

provider-env-vars.test.ts

feat: add Anthropic and OpenAI cost history (#100672)

2026-07-06 12:06:55 +01:00

provider-env-vars.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

provider-integrations.test.ts

fix(ios): native Talk respects session thinking level (#112901)

2026-07-23 01:02:12 -04:00

provider-integrations.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

ref-contract.test.ts

…

ref-contract.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

resolve-errors.ts

fix(secrets): surface degradation in logs and doctor (#109792)

2026-07-18 11:46:53 +01:00

resolve-secret-input-string.ts

…

resolve-types.ts

…

resolve.manifest-registry.test.ts

fix(browser): tab creation steals window focus during agent automation (#105356)

2026-07-21 21:35:40 -07:00

resolve.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

resolve.ts

fix(onepassword): make SecretRef setup production-safe

2026-07-25 06:03:30 -05:00

runtime-assignment-provenance.ts

fix(secrets): surface degradation in logs and doctor (#109792)

2026-07-18 11:46:53 +01:00

runtime-auth-collectors.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-auth-profile-owner.ts

fix(secrets): degrade stale auth profile refs on startup (#77213)

2026-07-17 00:38:35 -07:00

runtime-auth-profiles-oauth-policy.test.ts

…

runtime-auth-refresh-failure.test.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-auth-store-inline-refs.test.ts

fix(secrets): degrade stale auth profile refs on startup (#77213)

2026-07-17 00:38:35 -07:00

runtime-auth.integration.test-helpers.ts

…

runtime-channel-inactive-variants.test-support.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

runtime-channel-inactive-variants.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-command-secrets.test.ts

fix(gateway): make hot reload transactional (#105289)

2026-07-12 18:16:15 -07:00

runtime-command-secrets.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime-config-collectors-channels.test.ts

…

runtime-config-collectors-channels.ts

…

runtime-config-collectors-core.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-config-collectors-memory.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-config-collectors-plugins.bundled.test.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-config-collectors-plugins.test.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-config-collectors-plugins.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-config-collectors-sandbox.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-config-collectors-tts.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-config-collectors-tts.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-config-collectors.ts

…

runtime-core-snapshots.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-degradation-attribution.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-degraded-state.test.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-degraded-state.ts

fix(vault): aggregate provider outage diagnostics (#110908)

2026-07-18 22:44:06 +01:00

runtime-discord-surface.test.ts

fix: keep healthy channel accounts running when one credential fails (#109766)

2026-07-17 01:12:18 -07:00

runtime-discord.test-support.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

runtime-external-channel-audit.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-external-channel-origin-discovery.test.ts

…

runtime-fast-path.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-gateway-auth-surfaces.test.ts

…

runtime-gateway-auth-surfaces.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

runtime-gateway-local-surfaces.test.ts

fix(config): reject schema-only keys (#106031)

2026-07-12 23:10:12 -07:00

runtime-inactive-core-surfaces.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-inactive-telegram-surfaces.test.ts

…

runtime-manifest.runtime.ts

…

runtime-matrix-shadowing.test.ts

fix: keep healthy channel accounts running when one credential fails (#109766)

2026-07-17 01:12:18 -07:00

runtime-matrix-top-level.test.ts

fix: keep healthy channel accounts running when one credential fails (#109766)

2026-07-17 01:12:18 -07:00

runtime-matrix.test-support.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

runtime-media-secret-owner.ts

fix: isolate media model SecretRef owners (#110042)

2026-07-17 15:39:18 +01:00

runtime-memory-secret-owner.ts

fix: keep memory SecretRef failures agent-scoped (#109977)

2026-07-17 14:44:03 +01:00

runtime-nextcloud-talk-file-precedence.test.ts

…

runtime-nextcloud-talk.test-support.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

runtime-openai-file-fixture.test-helper.ts

…

runtime-owner-assignments.ts

fix(vault): aggregate provider outage diagnostics (#110908)

2026-07-18 22:44:06 +01:00

runtime-owner-contract.test.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime-owner-contract.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-prepare.runtime.ts

…

runtime-provider-and-media-surfaces.test.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime-provider-auth-activation.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-provider-auth-scope.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-provider-auth-warnings.test.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-provider-auth-warnings.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-provider-failure-fanout.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-request-secret-refs.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime-sandbox-secret-owner.ts

fix: keep broken SSH sandbox refs agent-scoped (#110081)

2026-07-17 23:56:43 +01:00

runtime-secret-scan.ts

…

runtime-shared.test.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-shared.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-state.test.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime-state.ts

fix(vault): aggregate provider outage diagnostics (#110908)

2026-07-18 22:44:06 +01:00

runtime-telegram-token-inheritance.test.ts

…

runtime-telegram.test-support.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

runtime-warning-log.test.ts

fix(vault): aggregate provider outage diagnostics (#110908)

2026-07-18 22:44:06 +01:00

runtime-warning-log.ts

fix(vault): aggregate provider outage diagnostics (#110908)

2026-07-18 22:44:06 +01:00

runtime-web-secret-owner.ts

fix(secrets): keep gateway alive when web provider refs fail (#109687)

2026-07-16 23:48:37 -07:00

runtime-web-tools-fallback.runtime.ts

…

runtime-web-tools-manifest.runtime.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime-web-tools-public-artifacts.runtime.ts

…

runtime-web-tools-selection.types.ts

fix(vault): aggregate provider outage diagnostics (#110908)

2026-07-18 22:44:06 +01:00

runtime-web-tools-state.test.ts

…

runtime-web-tools-state.ts

…

runtime-web-tools.shared.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime-web-tools.test.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime-web-tools.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime-web-tools.types.ts

…

runtime-zalo-token-activity.test.ts

…

runtime-zalo.test-support.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

runtime.auth.integration.test.ts

fix(secrets): keep unaffected owners live during reload failures (#110779)

2026-07-18 18:29:24 +01:00

runtime.coverage.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

runtime.fast-path.test.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime.gateway-auth.integration.test.ts

…

runtime.integration.test-helpers.ts

refactor(deadcode): enforce repository hard zero (#108641)

2026-07-15 22:40:00 -07:00

runtime.loadable-plugin-origins.test.ts

fix(browser): tab creation steals window focus during agent automation (#105356)

2026-07-21 21:35:40 -07:00

runtime.test-support.ts

refactor: remove expired plugin compatibility surfaces (#111451)

2026-07-19 11:04:48 -07:00

runtime.test.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

runtime.ts

refactor(agents): move implicit-main fallback into load-time roster injection (#112678)

2026-07-24 22:38:09 -07:00

secret-value.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

sentinel.test.ts

refactor(deadcode): privatize core test seams (#108325)

2026-07-15 06:37:40 -07:00

sentinel.ts

fix(secrets): prevent capture and sentinel credential retention (#102420)

2026-07-09 05:50:28 +01:00

shared.ts

refactor(plugin-sdk): narrow wildcard barrels to explicit used exports (#108440)

2026-07-16 00:45:23 -07:00

storage-scan.ts

fix(config,secrets): emit JSON errors and cover dotenv roots (#104340)

2026-07-17 23:14:05 -07:00

target-registry-data.current-snapshot.test.ts

fix(secrets): register secret targets for installed-origin plugins (#104347)

2026-07-21 00:12:55 -07:00

target-registry-data.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

target-registry-pattern.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

target-registry-pattern.ts

refactor(secrets): trim internal exports (#107342)

2026-07-14 02:38:46 -07:00

target-registry-query.ts

refactor(deadcode): trim mid-size src exports (#105888)

2026-07-13 00:42:56 -07:00

target-registry-types.ts

refactor(plugin-sdk): narrow wildcard barrels to explicit used exports (#108440)

2026-07-16 00:45:23 -07:00

target-registry.docs.test.ts

chore(tooling): enforce indexed access in core tests (#105375)

2026-07-12 14:29:52 +01:00

target-registry.fast-path.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

target-registry.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

target-registry.ts

…

test-node-command.test-support.ts

fix(browser): tab creation steals window focus during agent automation (#105356)

2026-07-21 21:35:40 -07:00

trusted-plan-path-policy.ts

fix(vault): prevent insecure secrets plan writes (#113707)

2026-07-25 08:27:33 -07:00

trusted-plan-path.test.ts

fix(vault): prevent insecure secrets plan writes (#113707)

2026-07-25 08:27:33 -07:00

trusted-plan-path.ts

fix(vault): prevent insecure secrets plan writes (#113707)

2026-07-25 08:27:33 -07:00

unsupported-surface-policy.test.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00

unsupported-surface-policy.ts

refactor(config): config-surface reduction tranche 3 — product consolidations (review request) (#111527)

2026-07-21 20:28:43 -07:00