taigrrSecurity: INT-A1 verify GitHub push permission before push mirroring; INT-A2/A33 MergeFix requires base write, trailers, no-CI needs human; INT-A3/A4 legacy webhooks via guarded outbound client with encrypted secrets; INT-A5/A25/A27 detach integrations on transfer/delete, prune orphans and logs; INT-A26 hide installer repo list; INT-A28/A29 streamed inbound cap, strip auth on cross-origin redirect; INT-A6/A7/A8/A20/A22/A32 editor container cap, preview hardening, symlink-safe sync, non-root image
f2e2275 ·
- ..
- api.ts
- blob-read.ts
- container-admin.ts
- container-api.ts
- container-config.ts
- container-do.ts
- container-meter.ts
- host.ts
- http.ts
- origin-check.test.ts
- origin-check.ts
- origin.ts
- raw.d.ts
- room-agents.ts
- room-api.ts
- room-awareness.ts
- room-client.ts
- room-files.ts
- room-presence.ts
- room.ts
- session.ts
- workbench-boot.js
- workbench.ts
- write-guard.ts