[codex] Fix authz, scope propagation, and shell-injection bugs - #320

Merged

tlongwell-block merged 8 commits into

jmecom:jm/morevulns

Apr 16, 2026

Commits on Apr 13, 2026

Fix token self-mint scope escalation
jmecom
committed
9e20a75
Require workflow ownership for workflow mutations
jmecom
committed
121d7d4
Constrain workflow message destinations
jmecom
committed
ad3ed7c
Honor token channel scope on aggregate REST endpoints
jmecom
committed
8ab2b84
Preserve token proofs and scopes on WebSocket auth
jmecom
committed
28ea344
Avoid shell injection in managed agent discovery
jmecom
committed
6cb381d
Add regression tests for vulnerability fixes
jmecom
committed
211ffda

Commits on Apr 14, 2026

Format discovery regression test
jmecom
committed
87d3f85