fix(security): pin CI inputs and minimize documentation telemetry

.github/workflows/ci.yml

@@ -16,8 +16,8 @@ jobs:
     name: Coverage generators and drift checks
     runs-on: ${{ (startsWith(vars.CI_RUNNER, 'blacksmith-') && vars.CI_RUNNER) || 'blacksmith-4vcpu-ubuntu-2404' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
       - name: Test coverage generators and verify generated artifacts
@@ -27,8 +27,8 @@ jobs:
     name: Vite+ monorepo check
     runs-on: ${{ (startsWith(vars.CI_RUNNER, 'blacksmith-') && vars.CI_RUNNER) || 'blacksmith-4vcpu-ubuntu-2404' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
           cache: 'npm'
@@ -56,8 +56,8 @@ jobs:
       run:
         working-directory: sdks/typescript-sdk
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -81,8 +81,8 @@ jobs:
   sdk-tooling:
     runs-on: ${{ (startsWith(vars.CI_RUNNER, 'blacksmith-') && vars.CI_RUNNER) || 'blacksmith-4vcpu-ubuntu-2404' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
           cache: 'npm'
@@ -107,8 +107,8 @@ jobs:
       matrix:
         node-version: [20, 22, 24]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -136,8 +136,8 @@ jobs:
   mcp:
     runs-on: ${{ (startsWith(vars.CI_RUNNER, 'blacksmith-') && vars.CI_RUNNER) || 'blacksmith-4vcpu-ubuntu-2404' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
           cache: 'npm'
@@ -185,8 +185,8 @@ jobs:
           - '2024-11-05'
           - '2024-10-07'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
           cache: 'npm'
@@ -228,8 +228,8 @@ jobs:
             echo "available=false" >> "$GITHUB_OUTPUT"
             echo "::notice::Skipping authenticated preview smoke because MCP_EVAL_TOKEN is unavailable"
           fi
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         if: steps.credential.outputs.available == 'true'
         with:
           node-version-file: .tool-versions

.github/workflows/claude-code-review.yml

@@ -31,17 +31,26 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 50
+          persist-credentials: false
+
+      - name: Checkout pinned review marketplace
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          repository: anthropics/claude-code
+          ref: 65823ec0034ed0aa0266bc43903fefd3ff94a327
+          path: .review-marketplace
+          persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
         continue-on-error: true
         uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugin_marketplaces: './.review-marketplace'
           plugins: 'code-review@claude-code-plugins'
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md

.github/workflows/deploy_postman.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ (startsWith(vars.CI_RUNNER_SMALL, 'blacksmith-') && vars.CI_RUNNER_SMALL) || 'blacksmith-2vcpu-ubuntu-2404' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install jq (for Postman API call)
         run: sudo apt-get update && sudo apt-get install -y jq

.github/workflows/generate_postman.yml

@@ -16,52 +16,45 @@ on:
       - 'tools/generate-postman.mjs'
       - 'tools/postman-generation.test.mjs'
 
+permissions:
+  contents: read
+
 jobs:
-  generate-postman-collection:
+  validate-postman-collection:
     runs-on: ${{ (startsWith(vars.CI_RUNNER_SMALL, 'blacksmith-') && vars.CI_RUNNER_SMALL) || 'blacksmith-2vcpu-ubuntu-2404' }}
-    permissions:
-      contents: write # Needed for committing back to the repo
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          fetch-depth: 0 # Full history for proper diffing
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
+      - run: npm ci
+      - run: node tools/generate-postman.mjs
+      - run: node --test tools/postman-generation.test.mjs
 
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Generate Postman Collection
-        run: node tools/generate-postman.mjs
-
-      - name: Test Postman generation
-        run: node --test tools/postman-generation.test.mjs
-
-      # Only main commits the collection. The generator is deterministic, so a
-      # diff here is a real spec change, and a push made with GITHUB_TOKEN does
-      # not start another workflow run.
-      - name: Commit changes
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        id: commit
+  publish-postman-collection:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: validate-postman-collection
+    runs-on: ${{ (startsWith(vars.CI_RUNNER_SMALL, 'blacksmith-') && vars.CI_RUNNER_SMALL) || 'blacksmith-2vcpu-ubuntu-2404' }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.sha }}
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .tool-versions
+      - run: npm ci
+      - run: node tools/generate-postman.mjs
+      - run: node --test tools/postman-generation.test.mjs
+      - name: Commit collection
         run: |
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
           git add Terminal49-API.postman_collection.json
-          if git diff --quiet --cached; then
-            echo "No changes detected in generated collection."
-            echo "committed=false" >> $GITHUB_OUTPUT
-          else
-            echo "Generated collection changed. Committing..."
-            git commit -m "chore: Auto-generate Postman collection from openapi.json"
-            echo "committed=true" >> $GITHUB_OUTPUT
+          if ! git diff --quiet --cached; then
+            git commit -m "chore: regenerate Postman collection"
+            git push origin HEAD:main
           fi
-
-      - name: Push changes
-        if: steps.commit.outputs.committed == 'true'
-        run: |
-          echo "Pushing updated collection to ${{ github.ref_name }}..."
-          git push origin HEAD:${{ github.ref_name }}

.github/workflows/publish_typescript_cli.yml

@@ -20,15 +20,23 @@ jobs:
     steps:
       - name: Resolve release tag
         id: release-tag
-        run: echo "tag=${{ github.event.release.tag_name || inputs.tag }}" >> "$GITHUB_OUTPUT"
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          if [[ ! "$RELEASE_TAG" =~ ^(cli-v-v|cli-v|v)?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid release tag."
+            exit 1
+          fi
+          printf 'tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          ref: ${{ steps.release-tag.outputs.tag }}
+          ref: refs/tags/${{ steps.release-tag.outputs.tag }}
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
           registry-url: https://registry.npmjs.org/
@@ -43,9 +51,12 @@ jobs:
 
       - name: Check release tag matches CLI version
         id: tag-check
+        env:
+          RELEASE_TAG: ${{ steps.release-tag.outputs.tag }}
+          PACKAGE_VERSION: ${{ steps.cli-version.outputs.version }}
         run: |
-          tag="${{ steps.release-tag.outputs.tag }}"
-          version="${{ steps.cli-version.outputs.version }}"
+          tag="$RELEASE_TAG"
+          version="$PACKAGE_VERSION"
           if [[ "$tag" == "v$version" || "$tag" == "cli-v$version" || "$tag" == "$version" || "$tag" == "cli-v-v$version" ]]; then
             echo "publish=true" >> "$GITHUB_OUTPUT"
           else

.github/workflows/publish_typescript_sdk.yml

@@ -20,15 +20,23 @@ jobs:
     steps:
       - name: Resolve release tag
         id: release-tag
-        run: echo "tag=${{ github.event.release.tag_name || inputs.tag }}" >> "$GITHUB_OUTPUT"
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          if [[ ! "$RELEASE_TAG" =~ ^(sdk-v-v|sdk-v|v)?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
+            echo "Invalid release tag."
+            exit 1
+          fi
+          printf 'tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
-          ref: ${{ steps.release-tag.outputs.tag }}
+          ref: refs/tags/${{ steps.release-tag.outputs.tag }}
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version-file: .tool-versions
           registry-url: https://registry.npmjs.org/
@@ -41,9 +49,12 @@ jobs:
 
       - name: Check release tag matches SDK version
         id: tag-check
+        env:
+          RELEASE_TAG: ${{ steps.release-tag.outputs.tag }}
+          PACKAGE_VERSION: ${{ steps.sdk-version.outputs.version }}
         run: |
-          tag="${{ steps.release-tag.outputs.tag }}"
-          version="${{ steps.sdk-version.outputs.version }}"
+          tag="$RELEASE_TAG"
+          version="$PACKAGE_VERSION"
           if [[ "$tag" == "v$version" || "$tag" == "sdk-v$version" || "$tag" == "$version" || "$tag" == "sdk-v-v$version" ]]; then
             echo "publish=true" >> "$GITHUB_OUTPUT"
           else

.github/workflows/release_please_sdk.yml

@@ -16,7 +16,7 @@ jobs:
   release-please:
     runs-on: ${{ (startsWith(vars.CI_RUNNER_SMALL, 'blacksmith-') && vars.CI_RUNNER_SMALL) || 'blacksmith-2vcpu-ubuntu-2404' }}
     steps:
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         id: release
         with:
           config-file: .release-please-config.json

docs/segment.js

@@ -31,6 +31,31 @@
 
   analytics.invoked = true;
 
+  function pageUrl(value) {
+    if (!value || typeof value !== 'string') return undefined;
+    try {
+      var url = new URL(value, location.origin);
+      if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined;
+      return url.origin + url.pathname;
+    } catch {
+      return undefined;
+    }
+  }
+
+  function referrerOrigin(value) {
+    var url = pageUrl(value);
+    return url ? new URL(url).origin : undefined;
+  }
+
+  function minimizePage(page) {
+    if (!page || typeof page !== 'object') return;
+    if ('url' in page) page.url = pageUrl(page.url);
+    if ('referrer' in page) page.referrer = referrerOrigin(page.referrer);
+    delete page.search;
+    delete page.query;
+    delete page.hash;
+  }
+
   analytics.methods = [
     'trackSubmit',
     'trackClick',
@@ -69,12 +94,11 @@
         var c = document.querySelector("link[rel='canonical']");
         n.push({
           __t: 'bpc',
-          c: (c && c.getAttribute('href')) || void 0,
+          c: pageUrl(c && c.getAttribute('href')),
           p: location.pathname,
-          u: location.href,
-          s: location.search,
+          u: pageUrl(location.href),
           t: document.title,
-          r: document.referrer,
+          r: referrerOrigin(document.referrer),
         });
       }
       n.unshift(e);
@@ -102,6 +126,21 @@
   analytics._writeKey = WRITE_KEY;
   analytics.SNIPPET_VERSION = '5.2.1';
 
+  analytics.addSourceMiddleware(function (event) {
+    var data = event.payload.obj;
+    if (data.context) {
+      minimizePage(data.context.page);
+      if (typeof data.context.referrer === 'string') {
+        data.context.referrer = referrerOrigin(data.context.referrer);
+      } else if (data.context.referrer) {
+        data.context.referrer.url = referrerOrigin(data.context.referrer.url);
+      }
+      delete data.context.campaign;
+    }
+    if (data.type === 'page') minimizePage(data.properties);
+    event.next(event.payload);
+  });
+
   analytics.load(WRITE_KEY, {
     integrations: { 'Segment.io': { apiHost: API_HOST } },
   });

package.json

@@ -16,12 +16,13 @@
     "check": "vp check && npm run build --workspace @terminal49/sdk && npm run type-check:api && vp run -r type-check",
     "format": "vp fmt --write api packages sdks",
     "lint:api": "vp lint api && vp fmt --check api",
-    "test": "npm run test:agent-trust && npm run test:risk-policy && vp run -r test",
+    "test": "npm run test:security && npm run test:agent-trust && npm run test:risk-policy && vp run -r test",
     "test:coverage": "node --test tools/generate-coverage.test.mjs tools/generate-rail-terminals.test.mjs tools/verify-deployed-coverage.test.mjs && node tools/generate-coverage.mjs --check && node tools/generate-rail-terminals.mjs --check",
     "test:agent-trust": "node --test bin/check-agent-trust.test.mjs bin/check-openapi-types.test.mjs",
     "test:risk-policy": "node --test scripts/ci/*.test.mjs",
     "type-check:api": "tsc --noEmit -p tsconfig.json",
-    "sdk:docs": "npm run docs --workspace @terminal49/sdk"
+    "sdk:docs": "npm run docs --workspace @terminal49/sdk",
+    "test:security": "node --test tools/security/*.test.mjs && npm run test:fixtures --workspace @terminal49/sdk"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.88.0",