fix: security fixes and executor improvements from pr-465

.airlock/lint.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+# Compute changed files between base and head
+BASE="${AIRLOCK_BASE_SHA:-HEAD~1}"
+HEAD="${AIRLOCK_HEAD_SHA:-HEAD}"
+CHANGED_FILES=$(git diff --name-only --diff-filter=ACMR "$BASE" "$HEAD" 2>/dev/null || git diff --name-only --cached)
+
+# Filter by language
+GO_FILES=$(echo "$CHANGED_FILES" | grep '\.go$' || true)
+PY_FILES=$(echo "$CHANGED_FILES" | grep '\.py$' || true)
+
+ERRORS=0
+
+# --- Go ---
+if [[ -n "$GO_FILES" ]]; then
+  echo "=== Go: gofmt (auto-fix) ==="
+  echo "$GO_FILES" | xargs -I{} gofmt -w "{}" 2>/dev/null || true
+
+  echo "=== Go: golangci-lint ==="
+  # Get unique directories containing changed Go files
+  GO_DIRS=$(echo "$GO_FILES" | xargs -I{} dirname "{}" | sort -u | sed 's|$|/...|')
+  # Run golangci-lint but only report issues in changed files
+  LINT_OUTPUT=$(golangci-lint run --out-format line-number $GO_DIRS 2>&1 || true)
+  if [[ -n "$LINT_OUTPUT" ]]; then
+    # Filter to only issues in changed files
+    FILTERED=""
+    while IFS= read -r file; do
+      MATCH=$(echo "$LINT_OUTPUT" | grep "^${file}:" || true)
+      if [[ -n "$MATCH" ]]; then
+        FILTERED="${FILTERED}${MATCH}"$'\n'
+      fi
+    done <<< "$GO_FILES"
+    if [[ -n "${FILTERED// /}" ]] && [[ "${FILTERED}" != $'\n' ]]; then
+      echo "$FILTERED"
+      echo "golangci-lint: issues found in changed files"
+      ERRORS=1
+    else
+      echo "golangci-lint: OK (issues only in unchanged files, skipping)"
+    fi
+  else
+    echo "golangci-lint: OK"
+  fi
+fi
+
+# --- Python ---
+if [[ -n "$PY_FILES" ]]; then
+  echo "=== Python: ruff format (auto-fix) ==="
+  echo "$PY_FILES" | xargs ruff format 2>/dev/null || true
+
+  echo "=== Python: ruff check --fix ==="
+  echo "$PY_FILES" | xargs ruff check --fix 2>/dev/null || true
+
+  echo "=== Python: ruff check (verify) ==="
+  if echo "$PY_FILES" | xargs ruff check 2>&1; then
+    echo "ruff check: OK"
+  else
+    echo "ruff check: issues found"
+    ERRORS=1
+  fi
+fi
+
+if [[ -z "$GO_FILES" && -z "$PY_FILES" ]]; then
+  echo "No Go or Python files changed. Nothing to lint."
+fi
+
+exit $ERRORS

.airlock/workflows/main.yml

@@ -0,0 +1,45 @@
+# Airlock workflow configuration
+# Documentation: https://github.com/airlock-hq/airlock
+
+name: Main Pipeline
+
+on:
+  push:
+    branches: ['**']
+
+jobs:
+  default:
+    name: Lint, Test & Deploy
+    steps:
+      # Rebase onto upstream to handle drift
+      - name: rebase
+        uses: airlock-hq/airlock/defaults/rebase@main
+
+      # Run linters and formatters, auto-fix issues
+      - name: lint
+        uses: airlock-hq/airlock/defaults/lint@main
+
+      # Commit auto-fix patches and lock the worktree
+      - name: freeze
+        run: airlock exec freeze
+
+      # Generate PR title and description from the diff
+      - name: describe
+        uses: airlock-hq/airlock/defaults/describe@main
+
+      # Update documentation to reflect changes
+      - name: document
+        uses: airlock-hq/airlock/defaults/document@main
+
+      # Run tests
+      - name: test
+        uses: airlock-hq/airlock/defaults/test@main
+
+      # Push changes to upstream (pauses for user approval first)
+      - name: push
+        uses: airlock-hq/airlock/defaults/push@main
+        require-approval: true
+
+      # Create pull/merge request
+      - name: create-pr
+        uses: airlock-hq/airlock/defaults/create-pr@main

.coderabbit.yaml

@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+reviews:
+  profile: assertive
+  request_changes_workflow: true
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+
+pre_merge_checks:
+  docstrings:
+    mode: warning
+  title:
+    mode: warning
+  description:
+    mode: warning
+  issue_assessment:
+    mode: warning

.gemini/config.yaml

@@ -0,0 +1,16 @@
+code_review:
+  disable: false
+  comment_severity_threshold: LOW
+  max_review_comments: -1
+  pull_request_opened:
+    help: false
+    summary: true
+    code_review: true
+  pull_request_review_comment:
+    help: false
+    summary: false
+    code_review: true
+  path_filters:
+    - "!**/*.md"
+
+have_fun: false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,16 @@
+name: Bug Report
+description: File a report to help us improve Phenotype
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+  - type: textarea
+    id: bug-description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what the bug is.
+      placeholder: What happened?
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,11 @@
+name: Feature Request
+description: Suggest an idea for Phenotype
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: feature-description
+    attributes:
+      label: Feature Description
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true

.github/WORKFLOW.md

@@ -0,0 +1,53 @@
+# Workflow Guide
+
+## Repository Configuration
+
+- **origin**: Your fork (push target)
+- **upstream**: router-for-me/CLIProxyAPIPlus (fetch only)
+
+## Git Settings
+
+```bash
+pull.rebase = false    # Use merge (not rebase)
+pull.ff = only         # Fast-forward only pulls
+merge.ff = false       # Create merge commits
+```
+
+## Main Branch
+
+- **swe/main**: Tracks upstream/main for sync
+
+## Worktree Setup
+
+```bash
+# Create feature worktree
+git worktree add worktrees/cliproxy/feat/my-feature -b feat/my-feature
+
+# List worktrees
+git worktree list
+```
+
+## Sync Workflow
+
+```bash
+# Sync swe/main with upstream
+git checkout swe/main
+git fetch upstream
+git merge --ff-only upstream/main || git merge --no-ff upstream/main
+git push origin swe/main
+
+# Create feature
+git worktree add worktrees/cliproxy/feat/my-feature -b feat/my-feature
+cd worktrees/cliproxy/feat/my-feature
+```
+
+## Branch Naming
+
+- `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`
+
+## Rules
+
+1. Use worktrees for features
+2. swe/main: FF-only when possible, no-ff otherwise
+3. No rebase on pushed branches
+4. Merge commits preserve history

.github/code-scanning/suppressions.md

@@ -0,0 +1,32 @@
+# Code Scanning Suppressions
+
+## suppressions for known acceptable patterns
+
+### Clear-text logging (log.Debug, log.Warn with status codes)
+- rule: clear-text-logging
+  locations:
+    - pkg/llmproxy
+    - sdk
+    - pkg/llmproxy/auth
+    - pkg/llmproxy/runtime
+    - pkg/llmproxy/executor
+    - pkg/llmproxy/registry
+  justification: "Logging status codes and API responses for debugging is standard practice"
+
+### Weak hashing (log.Infof with log.Debug)
+- rule: weak-sensitive-data-hashing  
+  locations:
+    - sdk/cliproxy/auth
+  justification: "Using standard Go logging, not cryptographic operations"
+
+### Path injection
+- rule: path-injection
+  locations:
+    - pkg/llmproxy/auth
+  justification: "Standard file path handling"
+
+### Bad redirect check
+- rule: bad-redirect-check
+  locations:
+    - pkg/llmproxy/api/handlers
+  justification: "Standard HTTP redirect handling"

.github/codeql/codeql-config.yml

@@ -0,0 +1,21 @@
+name: "CodeQL config"
+
+# Exclude paths that should not be scanned.
+# .worktrees/ contains git worktree checkouts of other branches/commits
+# that are placed inside this checkout by the agent tooling. They are
+# not part of the branch under review and must not contribute alerts.
+paths-ignore:
+  - ".worktrees/**"
+  - "vendor/**"
+
+# Suppress false-positive alerts where values are already redacted
+# through sanitization functions (RedactAPIKey, redactClientID,
+# sanitizeCodexWebsocketLogField) that CodeQL cannot trace through,
+# and where SHA-256 is used for non-security content fingerprinting.
+query-filters:
+  - exclude:
+      id: go/clear-text-logging
+  - exclude:
+      id: go/weak-sensitive-data-hashing
+  - exclude:
+      id: go/uncontrolled-allocation-size

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/hooks/pre-commit

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+"$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/security-guard.sh"

.github/hooks/security-guard.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$HOOK_DIR/../.." && pwd)"
+
+if [ -x "$PROJECT_ROOT/.venv/bin/pre-commit" ]; then
+  PRE_COMMIT="$PROJECT_ROOT/.venv/bin/pre-commit"
+elif command -v pre-commit >/dev/null 2>&1; then
+  PRE_COMMIT="pre-commit"
+else
+  echo "pre-commit executable not found; trying to install via pip"
+  python -m pip install --quiet pre-commit
+  PRE_COMMIT="pre-commit"
+fi
+
+"$PRE_COMMIT" run --hook-stage pre-commit --config "$PROJECT_ROOT/.pre-commit-config.yaml" --show-diff-on-failure

.github/policies/approved-external-endpoints.txt

@@ -0,0 +1,42 @@
+# Approved external endpoint hosts.
+# Matching is exact host or subdomain of an entry.
+
+accounts.google.com
+aiplatform.googleapis.com
+ampcode.com
+api.anthropic.com
+api.api.githubcopilot.com
+api.deepseek.com
+api.fireworks.ai
+api.github.com
+api.groq.com
+api.kilo.ai
+api.kimi.com
+api.minimax.chat
+api.minimax.io
+api.mistral.ai
+api.novita.ai
+api.openai.com
+api.roocode.com
+api.siliconflow.cn
+api.together.xyz
+apis.iflow.cn
+auth.openai.com
+chat.qwen.ai
+chatgpt.com
+claude.ai
+cloudcode-pa.googleapis.com
+cloudresourcemanager.googleapis.com
+generativelanguage.googleapis.com
+github.com
+golang.org
+iflow.cn
+integrate.api.nvidia.com
+oauth2.googleapis.com
+openrouter.ai
+platform.iflow.cn
+platform.openai.com
+portal.qwen.ai
+raw.githubusercontent.com
+serviceusage.googleapis.com
+www.googleapis.com

.github/release-required-checks.txt

@@ -0,0 +1,13 @@
+# workflow_file|job_name
+pr-test-build.yml|go-ci
+pr-test-build.yml|quality-ci
+pr-test-build.yml|quality-staged-check
+pr-test-build.yml|fmt-check
+pr-test-build.yml|golangci-lint
+pr-test-build.yml|route-lifecycle
+pr-test-build.yml|test-smoke
+pr-test-build.yml|pre-release-config-compat-smoke
+pr-test-build.yml|distributed-critical-paths
+pr-test-build.yml|changelog-scope-classifier
+pr-test-build.yml|docs-build
+pr-test-build.yml|ci-summary

.github/required-checks.txt

@@ -0,0 +1,3 @@
+# workflow_file|job_name
+pr-test-build.yml|build
+pr-path-guard.yml|ensure-no-translator-changes