Third-party security audit: remediation branch ready (SEC-01…07, RC-01, REL-01/02, A11Y-01, VC-01)

Security audit of config/webfetch/computer surfaces — full remediation branch available

Hi — I ran a third-party security audit against current master and prepared complete remediations for every accepted finding. I'd like to hand the work upstream, but pull requests here appear to be limited to repository collaborators, so I'm starting with an issue as the contributing guide suggests.

What the audit covered

• SEC-01 — Claude OAuth login used the PKCE verifier where CSRF state belongs; fixed by separating independent CSRF state handling.
• SEC-02 — model-run AppleScript/JXA invocations bypassed the destructive-command gate; now routed through the shared gate (#604).
• SEC-03 — webfetch SSRF surface: internal/metadata destination blocking, redirect re-validation, and connect-time IP pinning against DNS rebinding. Fail-closed on client-construction failure after a second-pass review.
• RC-01 / SEC-04 — atomic, owner-only config writes; cross-process locking via flock on Unix and LockFileEx on Windows; direct Config::save() callers take the lock too.
• REL-01 — bounded reconnect waits; permanent-offline states now surface instead of hanging.
• REL-02 — last-good config is preserved and securely persisted across restarts; corrupt input backed up securely rather than reset.
• A11Y-01 / VC-01 — accessibility documentation and NO_COLOR / JCODE_NO_COLOR honored in the TUI.
• SEC-07 — documented install/update trust model plus a signing roadmap (documentation-level remediation).
• Also registers the previously omitted JCODE_SHOW_BASH_OUTPUT cache-fingerprint key.

Where the code lives

Branch fix/apodex-audit-findings on my fork, rebased onto 10c26eb12:

https://github.com/ra-co88/jcode/tree/fix/apodex-audit-findings

15 focused commits, per-finding where practical, ~27 files changed (+2053/−374). Full write-up (including honest scope limits) is staged as a PR description and can be opened the moment PRs are possible — or feel free to open the PR from my fork yourself via the compare view.

On macOS the following passed: cargo fmt --check, git diff --check, changelog JSON validation, and cargo check -p jcode-base -p jcode-app-core; TUI style suite: 81 passed / 0 failed. Per-finding scope notes and residual risks live in docs/AUDIT_REMEDIATION.md on the branch.

Ask

Would you be open to receiving these as a series of small PRs? If PR creation stays collaborator-only, alternatives that work fine on my side:

1. You open the PR from my fork branch (compare view above) and review at leisure.
2. Temporary collaborator access for @ra-co88 so I can open the PRs individually.
3. Patch series attached here if neither is convenient.

Happy to split per-finding, drop anything you disagree with, or provide reproductions/test cases for specific findings first.

Start with docs/AUDIT_REMEDIATION.md and the fix/apodex-audit-findings branch, which contains the proposed per-finding changes across about 27 files. Review the 15 focused commits and the stated validation results, including cargo fmt --check, git diff --check, cargo check, and the TUI style suite. Done means the remediation is reviewed and accepted as a series of upstream changes, with any disputed findings or residual risks resolved.