[jkyberneees]

This PR collects one manual review and four adversarial review passes (the last by eight reviewers, each on a separate area). Each finding was reproduced before it was fixed, and each fix has a regression test. DESIGN.md §24 has the findings → fixes tables; SECURITY.md is updated.

Critical

• Opening a folder ran its code. The compiled server autoloaded bunfig.toml and .env from its working directory, which is often the viewed folder, so a repository's preload script ran inside the server. Fixed with --no-compile-autoload-*; the Mac app now starts the server in /.

• Git ran programs named by the repository:

  • a partial clone's promisor remote ran on lazy fetch;
  • submodule filters ran through git diff;
  • a driver listing cut short left drivers active;
  • drivers added later through included config files were not blanked;
  • git diff rewrote the index and ran the post-index-change hook.

  Now: no transports, no hooks, no index refresh, submodules ignored, and the driver overrides fail closed and are rebuilt for every operation.

High and medium

• Session token: a process in a terminal could read the token from the app window's on-disk profile and type into other terminals. The window now runs --incognito, and the boot page is removed as soon as the page connects.
• Containment: a folder swapped for a symlink could make file reads and search open files outside the root. Special files in .git (a /dev/zero symlink, a FIFO) could exhaust memory; git is now turned off for such a folder.
• Terminal: the server's replay mode tracking now mirrors the page's parser, so a reload can no longer turn bracketed paste off. Also: hostile-output limits (REP, clusters, OSC 8, OSC 4, bell and title floods), DECRQM echo, legacy mouse reports.
• Updater:
  • the checksum is now taken from the file as written to disk (a full disk installed a truncated binary);
  • strict install detection, so it can't replace an unrelated folder or app;
  • pre-releases are never offered;
  • capped reads, no rollback races, actions pinned to SHAs.
• Client: Trojan Source (bidi characters) in code and names; SVG previews from data: URLs; SVG <use> bombs and image decompression bombs refused before decoding.
• Denial of service:
  • quadratic highlighter, Go to Symbol and Markdown paths;
  • unbounded bidi markers and an unbounded HEAD peek;
  • huge diffs;
  • superseded blame processes left running;
  • a 20 s freeze when deleting many files;
  • a shell that fails to start no longer crashes the server;
  • the settings write blow-up and Bun's debug error page.

Tests

The suite went from 1368 to 1459 tests. New files:

• invariants.static — the AGENTS.md rules, checked against the source.
• http.routes — every route found in http.ts: auth, Host, CSRF, headers.
• redos.matrix — every highlighter and Go to Symbol language, plus the Markdown parser, against pathological input.
• terminal.fuzz — seeded hostile terminal output.
• files.resolve.fuzz — random paths through symlinks in and out of the root.
• git.hostile-config — every hook and program-naming key armed; .git is snapshotted before and after.
• pty.tracker.diff — differential check of the server's mode tracking against the page's parser.

Needs a Mac

packaging/macos/main.swift changed but could not be compiled here:

• the server starts in /
• the restart message is honoured only after an update, from the main frame
• the command-line install uses ln -sfh

Run xcrun swiftc -typecheck -target arm64-apple-macos13.3 -framework Cocoa -framework WebKit packaging/macos/main.swift before merging.

Recommendations (not done here)

• Move the release signing key to a protected GitHub Environment with required reviewers, and verify that tags point at main.
• Pin hashes of the Bun runtimes used for cross-compiling.
• The "Workers Builds" check is a Cloudflare project setting that also fails on main.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Px3ERqxxjWWCw6ty21M5S

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		5c8dc4e	2026-11-03T14:39:17.329Z	View logs ↗
Build: Failed ❌ View logs ↗		9c7a060	2026-11-03T13:40:07.198Z	View logs ↗
Build: Failed ❌ View logs ↗		7b1d010	2026-11-03T12:51:00.214Z	View logs ↗
Build: Failed ❌ View logs ↗		474b7cc	2026-11-03T11:01:54.430Z	View logs ↗

[jkyberneees]

Workers Builds: codeviewer (Cloudflare) is red here, but the failure doesn't come from this PR.

• It fails the same way on fix(theme): buttons follow the theme, and system follows macOS #20, which merged to main before any of these changes.
• It completes within the second it starts, which points to a setup problem in the Cloudflare project rather than a build that ran.
• This PR doesn't touch anything that check builds: docs/ and scripts/site.ts are unchanged.

There's no fix to make from the repository. The Cloudflare project's build settings need a look in the dashboard.

CodeQL reported one new high-severity alert on the earlier head. I couldn't read the alert from this session. The settings PATCH merge wrote request-supplied keys onto a plain object (cur[k] = v), which is the likeliest match, so e306c86 merges through a Map instead and adds a test with __proto__/constructor keys. CodeQL runs again on that push.

---

Generated by Claude Code

[jkyberneees]

CodeQL still reports one new high alert on e306c86. The alert turned out to be in a test, not product code: an assertion in test/client.hidden.test.ts that stripped tags with /<[^>]+>/g (CodeQL's incomplete multi-character sanitization rule). 9c7a060 replaces it with an exact unwrap of the markup markBidi adds. The settings Map change in e306c86 stays, as hardening.

---

Generated by Claude Code