v1.1 security audit remediation

[bit-cook]

Why release was paused

The unpublished v1.1.0 tag workflow exposed an infrastructure disk issue, while final independent audits found additional security and reliability defects. The tag was deleted before any Release was created; no v1.1 assets were promoted.

Security fixes

• execute safe commands as fixed argv from trusted system directories; reject shell grammar, path spoofing, and unknown confirmation policies
• reject incomplete/malformed SSE and partial tool calls
• restrict model endpoints to HTTPS or keyless loopback HTTP; block private-network SSRF and unsafe redirects
• reject symlinked CoCo roots, preserve bundled Node, verify UV downloads
• pin Actions, scope write permissions to publish, check out publish source, stage release files from an exact allowlist
• atomically write/rollback launchers, app and Agent payloads

Reliability and compatibility

• private atomic config/session/proxy/state files and interprocess install-state locking
• process-tree timeout termination and bounded output
• private Aider venv lifecycle; OpenCode offline claim disabled until native postinstall support
• real npm entry-type dispatch, Hermes selected Node, recorded-package uninstall precedence
• Python 3 validation, archive limits, PS3-compatible hashes, Unicode-safe Windows launchers
• exact Node engine ranges, unknown architecture rejection, builder CWD fixes
• macOS Intel native Codex smoke added

Evidence

• 140 tests pass locally
• actionlint, Python compile, POSIX shell syntax, and Worker syntax pass
• original safe-mode bypass probes no longer mutate temporary state
• current online artifacts are reproducible and checksum-valid
• explicit-stage Linux Codex package passed internal SHA-256 → wrapper install → codex --version → uninstall