clawdex-mobile 5.0.1 → 5.0.2

package/services/mac-bridge/src/utils/__tests__/threadMapping.test.ts

@@ -1,397 +0,0 @@
-import {
-  toPreview,
-  toRecord,
-  readString,
-  readNumber,
-  unixSecondsToIso,
-  mapRawStatus,
-  extractLastError,
-  toRawThread,
-  toRawTurn,
-} from '../threadMapping';
-
-// ---------------------------------------------------------------------------
-// toPreview
-// ---------------------------------------------------------------------------
-
-describe('toPreview', () => {
-  it('collapses multiple whitespace and newlines into single spaces', () => {
-    expect(toPreview('hello   world\nfoo')).toBe('hello world foo');
-  });
-
-  it('truncates strings longer than 180 chars to 177 + "..."', () => {
-    const long = 'a'.repeat(200);
-    const result = toPreview(long);
-    expect(result.length).toBe(180);
-    expect(result).toBe('a'.repeat(177) + '...');
-  });
-
-  it('returns short strings unchanged', () => {
-    expect(toPreview('hello')).toBe('hello');
-  });
-
-  it('returns a 180-char string unchanged (boundary)', () => {
-    const exact = 'b'.repeat(180);
-    expect(toPreview(exact)).toBe(exact);
-  });
-
-  it('trims leading and trailing whitespace', () => {
-    expect(toPreview('  hello  ')).toBe('hello');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// toRecord
-// ---------------------------------------------------------------------------
-
-describe('toRecord', () => {
-  it('returns plain objects as-is', () => {
-    const obj = { a: 1, b: 'two' };
-    expect(toRecord(obj)).toBe(obj);
-  });
-
-  it('returns null for a string', () => {
-    expect(toRecord('hello')).toBeNull();
-  });
-
-  it('returns null for a number', () => {
-    expect(toRecord(42)).toBeNull();
-  });
-
-  it('returns null for a boolean', () => {
-    expect(toRecord(true)).toBeNull();
-  });
-
-  it('returns null for null', () => {
-    expect(toRecord(null)).toBeNull();
-  });
-
-  it('returns null for undefined', () => {
-    expect(toRecord(undefined)).toBeNull();
-  });
-
-  it('returns arrays as objects (typeof [] === "object")', () => {
-    const arr = [1, 2, 3];
-    // Arrays pass the typeof === 'object' && !== null check
-    expect(toRecord(arr)).toBe(arr);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// readString
-// ---------------------------------------------------------------------------
-
-describe('readString', () => {
-  it('returns string input unchanged', () => {
-    expect(readString('hello')).toBe('hello');
-  });
-
-  it('returns empty string unchanged', () => {
-    expect(readString('')).toBe('');
-  });
-
-  it('returns null for a number', () => {
-    expect(readString(42)).toBeNull();
-  });
-
-  it('returns null for an object', () => {
-    expect(readString({ a: 1 })).toBeNull();
-  });
-
-  it('returns null for null', () => {
-    expect(readString(null)).toBeNull();
-  });
-
-  it('returns null for undefined', () => {
-    expect(readString(undefined)).toBeNull();
-  });
-
-  it('returns null for a boolean', () => {
-    expect(readString(true)).toBeNull();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// readNumber
-// ---------------------------------------------------------------------------
-
-describe('readNumber', () => {
-  it('returns finite numbers', () => {
-    expect(readNumber(42)).toBe(42);
-    expect(readNumber(-3.14)).toBe(-3.14);
-    expect(readNumber(0)).toBe(0);
-  });
-
-  it('returns null for NaN', () => {
-    expect(readNumber(NaN)).toBeNull();
-  });
-
-  it('returns null for Infinity', () => {
-    expect(readNumber(Infinity)).toBeNull();
-  });
-
-  it('returns null for -Infinity', () => {
-    expect(readNumber(-Infinity)).toBeNull();
-  });
-
-  it('returns null for a string', () => {
-    expect(readNumber('42')).toBeNull();
-  });
-
-  it('returns null for null', () => {
-    expect(readNumber(null)).toBeNull();
-  });
-
-  it('returns null for undefined', () => {
-    expect(readNumber(undefined)).toBeNull();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// unixSecondsToIso
-// ---------------------------------------------------------------------------
-
-describe('unixSecondsToIso', () => {
-  it('converts 1700000000 to the expected ISO string', () => {
-    expect(unixSecondsToIso(1700000000)).toBe('2023-11-14T22:13:20.000Z');
-  });
-
-  it('converts 0 to the Unix epoch ISO string', () => {
-    expect(unixSecondsToIso(0)).toBe('1970-01-01T00:00:00.000Z');
-  });
-
-  it('returns a valid ISO string for undefined (falls back to current time)', () => {
-    const result = unixSecondsToIso(undefined);
-    // Should be a valid ISO date string, not throw
-    expect(() => new Date(result)).not.toThrow();
-    expect(new Date(result).toISOString()).toBe(result);
-  });
-
-  it('returns a valid ISO string for NaN (falls back to current time)', () => {
-    const result = unixSecondsToIso(NaN);
-    expect(() => new Date(result)).not.toThrow();
-    expect(new Date(result).toISOString()).toBe(result);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// mapRawStatus
-// ---------------------------------------------------------------------------
-
-describe('mapRawStatus', () => {
-  it('returns "running" for { type: "active" }', () => {
-    expect(mapRawStatus({ type: 'active' }, undefined)).toBe('running');
-  });
-
-  it('returns "error" for { type: "systemError" }', () => {
-    expect(mapRawStatus({ type: 'systemError' }, undefined)).toBe('error');
-  });
-
-  it('returns "complete" for { type: "idle" } with turns', () => {
-    const turns = [{ id: 't1', status: 'completed' }];
-    expect(mapRawStatus({ type: 'idle' }, turns)).toBe('complete');
-  });
-
-  it('returns "idle" for { type: "idle" } with empty turns', () => {
-    expect(mapRawStatus({ type: 'idle' }, [])).toBe('idle');
-  });
-
-  it('returns "idle" for { type: "idle" } with no turns', () => {
-    expect(mapRawStatus({ type: 'idle' }, undefined)).toBe('idle');
-  });
-
-  it('returns "complete" for { type: "notLoaded" } with turns', () => {
-    const turns = [{ id: 't1', status: 'completed' }];
-    expect(mapRawStatus({ type: 'notLoaded' }, turns)).toBe('complete');
-  });
-
-  it('returns "running" when last turn status is "inProgress"', () => {
-    const turns = [
-      { id: 't1', status: 'completed' },
-      { id: 't2', status: 'inProgress' },
-    ];
-    expect(mapRawStatus({ type: 'idle' }, turns)).toBe('running');
-  });
-
-  it('returns "error" when last turn status is "failed"', () => {
-    const turns = [{ id: 't1', status: 'failed' }];
-    expect(mapRawStatus({ type: 'idle' }, turns)).toBe('error');
-  });
-
-  it('returns "error" when last turn status is "interrupted"', () => {
-    const turns = [{ id: 't1', status: 'interrupted' }];
-    expect(mapRawStatus({ type: 'idle' }, turns)).toBe('error');
-  });
-
-  it('returns "complete" when last turn status is "completed"', () => {
-    const turns = [{ id: 't1', status: 'completed' }];
-    // Note: "idle" status + completed last turn -> lastTurnStatus check fires first
-    expect(mapRawStatus({ type: 'idle' }, turns)).toBe('complete');
-  });
-
-  it('returns "idle" for null status with no turns', () => {
-    expect(mapRawStatus(null, undefined)).toBe('idle');
-  });
-
-  it('returns "idle" for undefined status with no turns', () => {
-    expect(mapRawStatus(undefined, undefined)).toBe('idle');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// extractLastError
-// ---------------------------------------------------------------------------
-
-describe('extractLastError', () => {
-  it('returns error message from the last failed turn', () => {
-    const turns = [
-      { id: 't1', status: 'failed', error: { message: 'something broke' } },
-    ];
-    expect(extractLastError(turns)).toBe('something broke');
-  });
-
-  it('returns "turn failed" when failed turn has no error message', () => {
-    const turns = [{ id: 't1', status: 'failed', error: null }];
-    expect(extractLastError(turns)).toBe('turn failed');
-  });
-
-  it('returns "turn interrupted" for an interrupted turn', () => {
-    const turns = [{ id: 't1', status: 'interrupted' }];
-    expect(extractLastError(turns)).toBe('turn interrupted');
-  });
-
-  it('returns null for an empty array', () => {
-    expect(extractLastError([])).toBeNull();
-  });
-
-  it('returns null when all turns are completed', () => {
-    const turns = [
-      { id: 't1', status: 'completed' },
-      { id: 't2', status: 'completed' },
-    ];
-    expect(extractLastError(turns)).toBeNull();
-  });
-
-  it('finds the LAST failed turn when scanning from end', () => {
-    const turns = [
-      { id: 't1', status: 'failed', error: { message: 'first error' } },
-      { id: 't2', status: 'completed' },
-      { id: 't3', status: 'failed', error: { message: 'last error' } },
-    ];
-    expect(extractLastError(turns)).toBe('last error');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// toRawThread
-// ---------------------------------------------------------------------------
-
-describe('toRawThread', () => {
-  it('maps a well-formed object with all fields', () => {
-    const input = {
-      id: 'thread-1',
-      preview: 'Hello world',
-      modelProvider: 'openai',
-      createdAt: 1700000000,
-      updatedAt: 1700001000,
-      status: { type: 'idle' },
-      cwd: '/home/user',
-      source: { kind: 'manual' },
-      turns: [
-        {
-          id: 'turn-1',
-          status: 'completed',
-          error: null,
-          items: [{ type: 'userMessage', id: 'item-1', content: [] }],
-        },
-      ],
-    };
-
-    const result = toRawThread(input);
-    expect(result.id).toBe('thread-1');
-    expect(result.preview).toBe('Hello world');
-    expect(result.modelProvider).toBe('openai');
-    expect(result.createdAt).toBe(1700000000);
-    expect(result.updatedAt).toBe(1700001000);
-    expect(result.status).toEqual({ type: 'idle' });
-    expect(result.cwd).toBe('/home/user');
-    expect(result.source).toEqual({ kind: 'manual' });
-    expect(result.turns).toHaveLength(1);
-    expect(result.turns![0].id).toBe('turn-1');
-  });
-
-  it('returns safe defaults for null input', () => {
-    const result = toRawThread(null);
-    expect(result.id).toBeUndefined();
-    expect(result.preview).toBeUndefined();
-    expect(result.modelProvider).toBeUndefined();
-    expect(result.createdAt).toBeUndefined();
-    expect(result.updatedAt).toBeUndefined();
-    expect(result.status).toBeUndefined();
-    expect(result.cwd).toBeUndefined();
-    expect(result.source).toBeNull();
-    expect(result.turns).toBeUndefined();
-  });
-
-  it('returns safe defaults for non-object input', () => {
-    const result = toRawThread('not an object');
-    expect(result.id).toBeUndefined();
-    expect(result.preview).toBeUndefined();
-    expect(result.turns).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// toRawTurn
-// ---------------------------------------------------------------------------
-
-describe('toRawTurn', () => {
-  it('maps a well-formed turn object', () => {
-    const input = {
-      id: 'turn-1',
-      status: 'completed',
-      error: { message: 'oops' },
-      items: [{ type: 'userMessage', id: 'item-1' }],
-    };
-
-    const result = toRawTurn(input);
-    expect(result).not.toBeNull();
-    expect(result!.id).toBe('turn-1');
-    expect(result!.status).toBe('completed');
-    expect(result!.error).toEqual({ message: 'oops' });
-    expect(result!.items).toHaveLength(1);
-    expect(result!.items![0]).toEqual({ type: 'userMessage', id: 'item-1' });
-  });
-
-  it('returns null for null input', () => {
-    expect(toRawTurn(null)).toBeNull();
-  });
-
-  it('returns null for undefined input', () => {
-    expect(toRawTurn(undefined)).toBeNull();
-  });
-
-  it('returns null for non-object input (string)', () => {
-    expect(toRawTurn('not an object')).toBeNull();
-  });
-
-  it('returns null for non-object input (number)', () => {
-    expect(toRawTurn(42)).toBeNull();
-  });
-
-  it('handles turn with no items', () => {
-    const result = toRawTurn({ id: 'turn-2', status: 'failed' });
-    expect(result).not.toBeNull();
-    expect(result!.items).toBeUndefined();
-  });
-
-  it('filters out non-object items', () => {
-    const input = {
-      id: 'turn-3',
-      items: [{ type: 'userMessage', id: 'i1' }, 'bad-item', null, 42],
-    };
-    const result = toRawTurn(input);
-    expect(result!.items).toHaveLength(1);
-    expect(result!.items![0]).toEqual({ type: 'userMessage', id: 'i1' });
-  });
-});

package/services/mac-bridge/src/utils/threadMapping.ts

@@ -1,176 +0,0 @@
-import type { ThreadStatus } from '../types';
-
-// ---------------------------------------------------------------------------
-// Raw types from codex app-server JSON responses
-// ---------------------------------------------------------------------------
-
-export type RawThreadStatus =
-  | { type?: string }
-  | string
-  | null
-  | undefined;
-
-export interface RawTurn {
-  id?: string;
-  status?: string;
-  error?: {
-    message?: string;
-  } | null;
-  items?: RawThreadItem[];
-}
-
-export type RawThreadItem =
-  | {
-      type?: 'userMessage';
-      id?: string;
-      content?: Array<{ type?: string; text?: string; path?: string; url?: string }>;
-    }
-  | {
-      type?: 'agentMessage';
-      id?: string;
-      text?: string;
-    }
-  | {
-      type?: string;
-      id?: string;
-      text?: string;
-    };
-
-export interface RawThread {
-  id?: string;
-  preview?: string;
-  modelProvider?: string;
-  createdAt?: number;
-  updatedAt?: number;
-  status?: RawThreadStatus;
-  cwd?: string;
-  source?: {
-    kind?: string;
-  };
-  turns?: RawTurn[];
-}
-
-// ---------------------------------------------------------------------------
-// Pure helper functions
-// ---------------------------------------------------------------------------
-
-export function toPreview(value: string): string {
-  const collapsed = value.replace(/\s+/g, ' ').trim();
-  if (collapsed.length <= 180) {
-    return collapsed;
-  }
-
-  return `${collapsed.slice(0, 177)}...`;
-}
-
-export function toRecord(value: unknown): Record<string, unknown> | null {
-  return typeof value === 'object' && value !== null
-    ? (value as Record<string, unknown>)
-    : null;
-}
-
-export function readString(value: unknown): string | null {
-  return typeof value === 'string' ? value : null;
-}
-
-export function readNumber(value: unknown): number | null {
-  return typeof value === 'number' && Number.isFinite(value) ? value : null;
-}
-
-export function unixSecondsToIso(value: number | undefined): string {
-  if (typeof value !== 'number' || !Number.isFinite(value)) {
-    return new Date().toISOString();
-  }
-
-  return new Date(value * 1000).toISOString();
-}
-
-export function mapRawStatus(status: unknown, turns: RawTurn[] | undefined): ThreadStatus {
-  const statusRecord = toRecord(status);
-  const statusType = readString(statusRecord?.type);
-
-  if (statusType === 'active') {
-    return 'running';
-  }
-
-  if (statusType === 'systemError') {
-    return 'error';
-  }
-
-  const lastTurn = Array.isArray(turns) && turns.length > 0 ? turns[turns.length - 1] : null;
-  const lastTurnStatus = readString(lastTurn?.status);
-
-  if (lastTurnStatus === 'inProgress') {
-    return 'running';
-  }
-
-  if (lastTurnStatus === 'failed' || lastTurnStatus === 'interrupted') {
-    return 'error';
-  }
-
-  if (lastTurnStatus === 'completed') {
-    return 'complete';
-  }
-
-  if (statusType === 'idle' || statusType === 'notLoaded') {
-    return Array.isArray(turns) && turns.length > 0 ? 'complete' : 'idle';
-  }
-
-  return 'idle';
-}
-
-export function extractLastError(turns: RawTurn[]): string | null {
-  for (let i = turns.length - 1; i >= 0; i -= 1) {
-    const turn = turns[i];
-    const turnStatus = readString(turn.status);
-    if (turnStatus !== 'failed' && turnStatus !== 'interrupted') {
-      continue;
-    }
-
-    const message = readString(turn.error?.message);
-    if (message) {
-      return message;
-    }
-
-    return `turn ${turnStatus}`;
-  }
-
-  return null;
-}
-
-export function toRawThread(value: unknown): RawThread {
-  const record = toRecord(value) ?? {};
-  return {
-    id: readString(record.id) ?? undefined,
-    preview: readString(record.preview) ?? undefined,
-    modelProvider: readString(record.modelProvider) ?? undefined,
-    createdAt: readNumber(record.createdAt) ?? undefined,
-    updatedAt: readNumber(record.updatedAt) ?? undefined,
-    status: (record.status as RawThreadStatus) ?? undefined,
-    cwd: readString(record.cwd) ?? undefined,
-    source: toRecord(record.source) as { kind?: string } | undefined,
-    turns: Array.isArray(record.turns)
-      ? (record.turns.map((turn) => toRawTurn(turn)).filter(Boolean) as RawTurn[])
-      : undefined
-  };
-}
-
-export function toRawTurn(value: unknown): RawTurn | null {
-  const record = toRecord(value);
-  if (!record) {
-    return null;
-  }
-
-  const items = Array.isArray(record.items)
-    ? (record.items
-        .map((item) => toRecord(item))
-        .filter((item): item is RawThreadItem => item !== null) as RawThreadItem[])
-    : undefined;
-
-  return {
-    id: readString(record.id) ?? undefined,
-    status: readString(record.status) ?? undefined,
-    error: toRecord(record.error) as { message?: string } | null,
-    items
-  };
-}

package/services/mac-bridge/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "CommonJS",
-    "moduleResolution": "Node",
-    "outDir": "dist",
-    "rootDir": "src",
-    "strict": true,
-    "esModuleInterop": true,
-    "forceConsistentCasingInFileNames": true,
-    "skipLibCheck": true,
-    "resolveJsonModule": true,
-    "types": ["node", "vitest/globals"]
-  },
-  "include": ["src/**/*.ts"]
-}

package/services/mac-bridge/vitest.config.ts

@@ -1,9 +0,0 @@
-import { defineConfig } from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    globals: true,
-    root: '.',
-    passWithNoTests: true,
-  },
-});

package/services/rust-bridge/.env.example

@@ -1,14 +0,0 @@
-BRIDGE_HOST=127.0.0.1
-BRIDGE_PORT=8787
-BRIDGE_WORKDIR=/path/to/target/repo
-BRIDGE_AUTH_TOKEN=change-me
-BRIDGE_ALLOW_INSECURE_NO_AUTH=false
-BRIDGE_ALLOW_QUERY_TOKEN_AUTH=true
-BRIDGE_ALLOW_OUTSIDE_ROOT_CWD=true
-BRIDGE_DISABLE_TERMINAL_EXEC=false
-BRIDGE_TERMINAL_ALLOWED_COMMANDS=pwd,ls,cat,git
-BRIDGE_CHATGPT_ACCESS_TOKEN=
-BRIDGE_CHATGPT_ACCOUNT_ID=
-BRIDGE_CHATGPT_PLAN_TYPE=
-CODEX_CLI_BIN=codex
-CODEX_CLI_TIMEOUT_MS=180000

package/services/rust-bridge/package.json

@@ -1,13 +0,0 @@
-{
-  "name": "@codex/rust-bridge",
-  "version": "5.0.1",
-  "private": true,
-  "scripts": {
-    "dev": "cargo run",
-    "start": "cargo run --release",
-    "build": "cargo build --release",
-    "typecheck": "cargo check",
-    "lint": "cargo fmt --check",
-    "test": "cargo test"
-  }
-}

package/services/rust-bridge/security_best_practices_report.md

@@ -1,24 +0,0 @@
-# Executive Summary
-The bridge exposes powerful RPC surface (terminal execution, git operations, approvals) with minimal automation around authentication, token handling, and child-process resilience. Without tightening the gates, an attacker on the same LAN can run commands or mutate the repository, and outages may go unnoticed. The following findings prioritize these risks and note the lack of tests that would otherwise guard against regressions.
-
-## Severity: High
-### HF-1 — Unauthenticated bridge surface with common dev flags
-- **Impact:** When `BRIDGE_ALLOW_INSECURE_NO_AUTH=true` and the host is bound to `0.0.0.0`, any LAN client can connect to `/rpc` and call `bridge/terminal/exec`, `bridge/git/*`, or even forward arbitrary App Server RPCs, effectively running shell commands and mutating the repository as the bridge user. This is a remote code execution and repo integrity risk.
-- **Observation:** `BridgeConfig::from_env` only skips the `BRIDGE_AUTH_TOKEN` requirement when `BRIDGE_ALLOW_INSECURE_NO_AUTH` is true (src/main.rs:51-129). `ws_handler` accepts any socket once `is_authorized` returns true, and that function returns true whenever authentication is disabled (src/main.rs:1125-1144). The powerful operations behind `handle_bridge_method` remain exposed without additional checks (src/main.rs:1307-1405).
-- **Remediation:** Require a token for any non-local binding or refuse to listen on `0.0.0.0` when auth is disabled. Alternatively, keep `BRIDGE_ALLOW_INSECURE_NO_AUTH` but automatically bind to `127.0.0.1` and refuse the flag otherwise, or fail fast if the flag is set without a token plus documented justification. Harden `bridge/terminal/exec` and `bridge/git/*` with explicit policy guards when auth is missing.
-
-## Severity: Medium
-### MF-2 — Query-token auth leaks credentials in plaintext URLs
-- **Impact:** `BRIDGE_ALLOW_QUERY_TOKEN_AUTH` accepts the token as a `token` query parameter (src/main.rs:101-129, 1125-1144). Passing secrets in URLs risks leakage through proxy logs, browser history, and any MITM on the local network (the bridge already speaks plain HTTP/TCP). A leaked token allows the exact same RPC surface as a Bearer header, so attackers can replay it.
-- **Observation:** `is_authorized` unconditionally trusts the `token` query value when the flag is true (src/main.rs:101-129). `ws_handler` populates that query into the check every WebSocket upgrade (src/main.rs:1125-1144).
-- **Remediation:** Deprecate `BRIDGE_ALLOW_QUERY_TOKEN_AUTH`; accept only Authorization headers and keep them out of URLs. If the flag is still needed, require TLS + short-lived tokens and actively rotate/log reuse.
-
-### MF-3 — App server child death leaves future requests dead and health endpoint blind
-- **Impact:** When the `codex app-server` child exits, the bridge logs the exit, fails outstanding RPCs, and shuts down approval state, but it never restarts the child or marks `/health` as degraded. Forwarded requests still attempt to write to the closed pipe and immediately fail with `-32000`, leaving clients blind and requiring a manual restart, which is a resiliency issue with moderate to high operational impact.
-- **Observation:** `spawn_wait_loop` just logs success/error and clears `pending` state without recovery (src/main.rs:362-403). `forward_request` continues to accept work and only reports failure once `write_json` fails, so the bridge does not short-circuit new requests once the child is gone (src/main.rs:406-439). The existing `/health` handler never observes the child state (src/main.rs:1117-1123).
-- **Remediation:** Monitor the app server child, surface its state through `/health`, and attempt automatic restart/backoff or block forwarded requests (return `ServiceUnavailable`) until recovery. Consider wiring `AppState` with a flag that short-circuits `handle_client_message` whenever the child is not running.
-
-### MF-4 — No automated tests for critical security gates or bridge resiliency
-- **Impact:** The bridge’s only source file is `src/main.rs` and `Cargo.toml` defines no `[dev-dependencies]` or test harnesses (Cargo.toml:1-13), so there are no unit or integration tests for `BridgeConfig`, `TerminalService`, or `AppServerBridge`. Any refactor can silently break auth, token parsing, or terminal-command restrictions, and there is no automated guard detecting the regression.
-- **Observation:** `src/main.rs` does not contain any `#[cfg(test)]` modules or `mod tests`, and there is no `tests/` directory in the repo. The mission-critical entry points (`BridgeConfig::from_env`, `TerminalService::execute_shell`, `AppServerBridge::forward_request`) are therefore unverified.
-- **Remediation:** Add tabletop unit tests that cover config parsing (including `BRIDGE_ALLOW_INSECURE_NO_AUTH` vs. `BRIDGE_AUTH_TOKEN`), query token acceptance, terminal command whitelists, and app-server shutdown behavior. Start simple with `#[cfg(test)]` modules shipping assertion scenarios, then expand to integration or smoke tests to exercise `/rpc` and `/health` flows.