DottaandPaperclip a871f5c42e test(security): inventory board-key routes from the runtime router ...

Replace the source-regex board-key route inventory with an enumeration of
the real Express router stack that createApp mounts. Express 5 does not keep
the mount path string on a mounted layer, so a probe records it as each router
is mounted; the inventory then walks the built app and reconstructs every
final normalized path, including nested routers.

Runtime-only surfaces (handlers injected through createApp options, plugin
sub-apps) are declared through an explicit registration hook; anything mounted
at runtime that is not registered resolves to undeclared and stays denied.

The runtime set is compared bidirectionally with the explicit registry
inventory so a reachable route without metadata (missing) and a declared row
with no live route (stale) both fail CI. A regression registers a direct
app.post and proves the gate fails on it. Declare the top-level /_plugins and
/llms surfaces the runtime walk newly surfaces as explicit denials; deny and
concealment behavior are unchanged.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-08-19 19:43:55 +00:00

..

scripts

fix(server): use stable tsx/cli entry point in dev-watch

2026-03-28 06:42:03 +07:00

src

test(security): inventory board-key routes from the runtime router

2026-08-19 19:43:55 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572)

2026-08-17 22:11:30 -05:00

package.json

build(deps-dev): bump tsx from 4.23.1 to 4.23.12 (#11722)

2026-08-19 10:32:04 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

feat(workspaces): sign the workspace login handoff and gate readiness (#11671)

2026-08-19 02:37:02 -05:00