chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs
Full-codebase audit + automatic cleanup (no behavioural change for users).
Security
- ServerSwitcher: post-switch redirect is now reduced to a SAME-ORIGIN
relative path. Rejects off-host referers, non-http(s) schemes
(javascript:/data:), different ports (https://host:444/x -> /x), and
protocol-relative tricks (//host, /\host). Closes a Referer open-redirect
(Codex P2).
- EditCredential: a key passphrase is stored only for key auth, never for
password auth.
Removed dead code
- FirewallService::status/allow/deny (+ orphaned clampPort)
- Server::auditEvents(), SshCredential::scopeActive(), unused 'bell' icon
Cleanups / improvements
- Files list + editor use a dedicated 'file' icon (was the audit icon)
- Import RuntimeException/Throwable instead of FQN; fix stale docblocks
(FirewallService, HardeningService) and the Files delete comment
- Quote base64 in the sudo command path (defensive, consistent)
- Null-safe Auth::user()?->email in Settings; single domain() read in hasTls()
Release
- Bump 0.1.0 -> 0.1.1 + CHANGELOG entry
Verified: Pint clean, Codex review clean (no actionable regressions),
R12 browser check — 9 routes HTTP 200, 0 console errors, lazy pages loaded.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
0f57074e6f