23211159c9
test(hooks): remove unsafe test assertions
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-05-12 15:41:17 +09:00
ca9b5fde40
test(hooks): update claude-code, comment-checker, and rules-injector tests
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-10 15:53:33 +09:00
da86b57f23
test: fix CI test isolation - upgrade Bun, fix mock contamination and fresh-import patterns
2026-04-05 01:01:19 +09:00
5213525a95
fix(test): narrow execute-http-hook-security mock to shared/logger to prevent barrel contamination
2026-04-04 19:10:33 +09:00
382f9b61fa
Fix mock isolation in remaining hook tests
...
- message-builder.test.ts: improve mock isolation
- background-update-check.ts: update for test compatibility
- execute-http-hook-security.test.ts: narrow mock targets
- recover-tool-result-missing.test.ts: prevent barrel contamination
🤖 GENERATED WITH ASSISTANCE OF OhMyOpenCode
2026-04-04 18:56:34 +09:00
a6e783adc4
fix(test): improve execute-http-hook-security test isolation
...
Reset mocks and process.env copy in afterEach to prevent cross-test
contamination from mock.module() isolation.
2026-04-04 16:48:12 +09:00
b8f4037622
Refine HTTP hook redirect enforcement
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:30:57 +09:00
d081e8ef4f
Fix HTTP hook HTTPS enforcement gaps
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:11:09 +09:00
f84d311c64
Revert "Merge pull request #3048 from code-yeongyu/fix/p0-2-https-enforcement-gaps"
...
This reverts commit ede561cb742d13e125bb
2026-04-03 17:10:23 +09:00
3eb1430a43
Fix HTTP hook HTTPS enforcement gaps
...
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-03 17:07:17 +09:00
5a2814980e
fix(security): enforce HTTPS for HTTP hook URLs
...
Add TLS requirement for HTTP hook destinations:
- Warn when plain http:// URLs are used
- Reject remote http:// in production mode
- Allow http://localhost and http://127.0.0.1 for dev
Prevents secret exfiltration over unencrypted channels.
2026-04-02 15:01:15 +09:00
YeonGyu-Kim