[codex] fix scorecard vuln and fuzzing gaps (#16)

* fix: reduce scorecard security and fuzzing debt

* test: guard bootstrap pip security floor

Author: xiaojiou176

apps/webui/package-lock.json

@@ -50,14 +50,15 @@
     "eslint": "^9.39.1",
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.5.2",
+    "fast-check": "^4.3.0",
     "globals": "^16.5.0",
     "jsdom": "^28.1.0",
     "postcss": "^8.5.8",
     "tailwindcss": "^3.4.19",
     "tailwindcss-animate": "^1.0.7",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.58.0",
-    "vite": "^7.3.1",
+    "vite": "^7.3.2",
     "vitest": "^4.1.2"
   }
 }

apps/webui/package.json

@@ -1,3 +1,4 @@
+import fc from 'fast-check'
 import { describe, expect, it } from 'vitest'
 
 import { normalizeJobStatus } from '@/lib/job-status'
@@ -11,4 +12,19 @@ describe('normalizeJobStatus', () => {
     expect(normalizeJobStatus('unknown-status')).toBe('queued')
     expect(normalizeJobStatus(undefined)).toBe('queued')
   })
+
+  it('only preserves the documented status set', () => {
+    const known = new Set(['queued', 'running', 'cancelling', 'succeeded', 'failed', 'cancelled'])
+
+    fc.assert(
+      fc.property(fc.string(), (candidate) => {
+        const normalized = normalizeJobStatus(candidate)
+        if (known.has(candidate)) {
+          expect(normalized).toBe(candidate)
+        } else {
+          expect(normalized).toBe('queued')
+        }
+      }),
+    )
+  })
 })

apps/webui/src/test/job-status.test.ts

@@ -202,6 +202,13 @@ def test_bootstrap_env_prebuilt_restore_clears_existing_runtime_venv_contents()
     assert 'python3 -m venv "$target"' in script
 
 
+def test_requirements_pip_lock_keeps_pip_at_or_above_the_current_security_floor() -> None:
+    lock = (_repo_root() / "tooling" / "requirements-pip.lock.txt").read_text(encoding="utf-8")
+
+    assert "pip==26.0.1" in lock
+    assert "pip==25.0.1" not in lock
+
+
 def test_restore_prebuilt_tree_replaces_existing_contents_without_file_exists_conflicts(tmp_path: Path) -> None:
     script = _repo_root() / "tooling" / "scripts" / "restore_prebuilt_tree.py"
     src = tmp_path / "src"

tests/unit/test_frontend_gate_bootstrap.py

@@ -1,2 +1,3 @@
-pip==25.0.1 \
-    --hash=sha256:c46efd13b6aa8279f33f2864459c8ce587ea6a1a59ee20de055868d8f7688f7f
+pip==26.0.1 \
+    --hash=sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b \
+    --hash=sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8