Daily Fro Bot Report — 2026-10-12 (UTC) #609

Daily Fro Bot Report — 2026-10-12 (UTC)

Run Summary

Errored PRs

None. #604 (test/question-only-fixture, by marcusrbrown) has every check passing. No repair needed.

Security

• Dependabot alerts: none. pnpm audit --prod: no known vulnerabilities.
• Code scanning: 48 open alerts. None needed a PR.
  • Trivy, high (container image, reported against release.yaml:release): util-linux CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410 (repeated across many image builds), plus other OS-package alerts on the digest-pinned node:24-trixie-slim base. Posture is documented in merged docs(security): record base-image Trivy alert posture #409. Renovate owns the base-image bump.
  • Scorecard: BranchProtection, CodeReview, Fuzzing, License, CIIBestPractices. These are repo-settings matters and I did not touch them.
• Auth middleware review (src/server.ts ~L518-640): a global app.use('*') session check runs before every route. Public paths come from an explicit allowlist (isPublicPath): SPA shell assets, /privacy (exact match), /static/operator-*.js, and /api/listener/ingest, which is HMAC-gated in its own route. /api/listener/messages* and ack-all stay behind the session. Fixture-harness routes are public only when the harness gate holds (dev/test env, loopback bind, flag on) and startup refuses otherwise. The gateway branch fails closed (redirect to login) on a missing cookie, an invalid gateway origin, a failed session lookup, or an expired session. Logs record only the path, not cookie values.
• Not found: any code path that logs or returns key, cookie or token material. Earlier logger-call spot checks still hold. This is a code read of the auth wiring, not a full audit of each route handler body.

Code Quality

All gates pass:

• pnpm bootstrap
• pnpm check-types
• pnpm lint
• pnpm test: 2728 server tests and 1124 web tests
• Strip-only load check over every non-test src/**/*.ts: no failures

Workflow Integrity

• SHA pinning: no unpinned third-party uses:. fro-bot/agent is at e2a77c5… # v0.119.3.
• Strip-only: no enum or namespace in non-test src. The load check passes.
• Permissions: top-level contents: read. Elevated scopes are per-job only.
• Setup action: release.yaml calls actions/setup-node directly in jobs that install no dependencies. This is unchanged and not a duplicate-setup problem.

Progressive Improvement

pnpm outdated: @opencode-ai/plugin 1.18.35 → 1.19.0 (minor). Major lag on typescript (6.0.3 → 7.0.2), vitest (4.1.11 → 5.0.3), vite-plugin-pwa (1.3.0 → 2.0.0), jsdom (29 → 30), @testing-library/jest-dom (6 → 7) and eslint-plugin-erasable-syntax-only (0.4.2 → 0.7.2). @types/node stays at 24 to match the Node 24 runtime. All Renovate-owned. There are no TODO or FIXME annotations in src, web/src or wiki-writer.

Cross-Project Intelligence

• fro-bot/agent latest is v0.120.0 (2026-10-11). This repo pins v0.119.3, so a Renovate bump should follow.
• marcusrbrown/infra latest is @marcusrbrown/infra@0.25.1.
• Release metadata only. I did not inspect sibling repos' source this run, and no conventions worth adopting were identified.

Needs Human Attention

• Scorecard alerts (BranchProtection, CodeReview): repo-settings matters; I did not change them.
• Trivy util-linux and related alerts: no action possible until the base image ships fixes. Verify with gh api 'repos/fro-bot/dashboard/code-scanning/alerts?state=open'. Let a Renovate digest bump of the node:24-trixie-slim base in Dockerfile pick them up. Do not switch base image or dismiss alerts just to clear the list.
• Per-route audit: the global auth wiring is reviewed, but individual handlers in src/routes/*.ts have not had a full response/error-body leak audit.