ZacharyZhang-NY 23a007d157 Require the OAuth state on the Codex callback (sec #4) ...

The Codex flow guarded with `result.state && result.state !== state`,
so a callback that simply omitted state skipped CSRF validation while a
sign-in window was open. Match the Anthropic and Google flows: compare
strictly, so a missing or mismatched state is rejected. PKCE already
blocks code injection; this closes the login-CSRF gap.

2026-06-26 18:06:58 -04:00

..

resources

Rebuild AgentCompany Electron app

2026-05-20 23:27:00 -04:00

src

Require the OAuth state on the Codex callback (sec #4)

2026-06-26 18:06:58 -04:00

tests

Contain workspace file ingestion to the bound folder (sec #3)

2026-06-26 18:04:13 -04:00

.gitignore

Rebuild AgentCompany Electron app

2026-05-20 23:27:00 -04:00

electron-builder.yml

Rebuild AgentCompany Electron app

2026-05-20 23:27:00 -04:00

electron.vite.config.ts

Rebuild AgentCompany Electron app

2026-05-20 23:27:00 -04:00

eslint.config.mjs

Rebuild AgentCompany Electron app

2026-05-20 23:27:00 -04:00

package.json

Harden provider security and build dependencies

2026-06-07 14:04:32 -04:00

pnpm-lock.yaml

Harden provider security and build dependencies

2026-06-07 14:04:32 -04:00

pnpm-workspace.yaml

Harden provider security and build dependencies

2026-06-07 14:04:32 -04:00

tsconfig.json

Rebuild AgentCompany Electron app

2026-05-20 23:27:00 -04:00

vitest.config.ts

Add layered CI quality gates

2026-05-23 19:05:32 -04:00