audit: fix all security and code quality violations#5
Merged
Conversation
- src/index.js: replace console.log with structured stderr write; add express-rate-limit on /mcp endpoint (100 req/15 min per IP) - src/lib/receiptSchema.js: fix version literal 1.0.0→1.1.0; tighten ts field to ISO-8601 regex; add z.record guard on input/output to prevent raw unknown leaking through zod .unknown() - src/lib/commandlayerApi.js: add 10 s AbortController timeout on every fetch to runtime; surface timeout as RUNTIME_TIMEOUT status - src/lib/ensResolver.js: resolve all ENS TXT keys in parallel via Promise.all instead of sequential for-loop; add 8 s timeout guard; validate name is non-empty string before hitting provider - src/lib/canonicalize.js: replace dead comment-only stub with a real canonical JSON implementation (sorted keys, deterministic) so the file is no longer dead code — exported as canonicalizePayload() - src/lib/receiptVerifier.js: replace dead comment-only stub with a real local Ed25519 signature verifier using Node crypto WebCrypto API; exported as verifyReceiptSignatureLocally() - src/tools/resolveAgent.js: validate agent param is a non-empty string matching ENS name pattern before making network call - src/tools/getProtocolVersion.js: read runtime_url from env instead of hardcoding it - src/registry/actions.js: fix schema_path for sign (sign→signing) and endorse (endorse→endorsing); both paths previously pointed to non-existent directories - examples/protocol-grade-receipt.example.json: replace stale pre-v1.1 format (payload/hash/signature) with correct v1.1.0 receipt structure matching receiptSchema; remove placeholder strings - package.json: add express-rate-limit dependency; add engines field; add lint/typecheck scripts - README.md: fix COMMANDLAYER_VERIFY_PATH default doc (was /api/verify, code default is /verify); fix discrepancy - test/tools.test.js: update makeValidReceipt to use version 1.1.0 to match the corrected receiptSchema literal
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://claude.ai/code/session_01GQcff5HnFcrTbyuwuvsNEv