fix: bug-fix sweep#673

Merged

buremba merged 3 commits into

mainfrom

May 13, 2026

Commits on May 13, 2026

fix: bug-fix sweep — sandbox action bypass, SSRF, OAuth hardening, leak/timeout/race fixes
buremba
committed
fix(review): enforce calendar maxResults while paging for sync token; keep per-client rate-limit key without TRUSTED_PROXY
buremba
committed
fix(ci): move sandbox action-call test out of vitest glob; fix standalone typecheck (drop dead InvalidationEvent.resource sites + unused import left by #672)
buremba
committed