Cloud: validate hosted app inventory evidence safely

[BigSimmo]

Summary

• Reject every unsupported Cloud-check argument, so malformed or misspelled hosted-inventory flags fail closed.
• Reject duplicate inventory inputs and suppress capability output whenever inventory evidence is invalid.
• Normalize connector identifiers case-insensitively and recognize the documented Slack/Linear Personal Pro connectors.
• Reuse the repository sensitive-text detector on the original input plus a reviewed connector allowlist, so case-sensitive token shapes and opaque unknown values cannot be accepted as connector evidence.
• Never echo operator-supplied inventory strings.

Why

PRs #1617 and #1625 were merged while later automated review findings were still being addressed. This focused follow-up closes those post-merge acceptance gaps without changing provider access, OAuth, deployments, or production data.

Files

• scripts/check-codex-cloud-setup.mjs
• tests/codex-cloud-setup.test.ts
• docs/codex-cloud.md

Verification

• npm run typecheck — PASS
• npm test -- tests/codex-cloud-setup.test.ts — PASS, 22/22
• npm run check:codex-cloud — PASS
• malformed inventory CLI/output self-test — PASS (exit 1, no capability line)
• npm run docs:check-links — PASS, 1624 references
• npm run format — PASS, full tree unchanged outside the intended files
• git diff --check — PASS
• hosted CI 31019924847 for exact head a0f7c875d7c886590e1ff18deb6d3e76ca105406 — PASS
• hosted Secret Scan 31019924527 — PASS
• hosted SAST 31019924601 — PASS
• all inline review threads — resolved

Risk and follow-up

No provider calls, deployments, database access, or secret values are introduced. Hosted inventory remains external evidence supplied by a fresh task; repository configuration is not treated as hosted-tool activation proof.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 46 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0c025ced-84a0-43f6-ae4a-e221ed7bfdb3

📥 Commits

Reviewing files that changed from the base of the PR and between 196dd43 and 2c2ff3f.

📒 Files selected for processing (3)

• docs/codex-cloud.md
• scripts/check-codex-cloud-setup.mjs
• tests/codex-cloud-setup.test.ts

📝 Walkthrough

Walkthrough

This change updates hosted app inventory handling in the Codex Cloud setup checker. It adds slack and linear, normalizes connector names to lowercase, counts unknown connectors instead of rejecting them, adds CLI flag validation, and updates tests and documentation to match the new rules.

Changes

Hosted app inventory flow

Layer / File(s)	Summary
Inventory rules and capability output scripts/check-codex-cloud-setup.mjs, tests/codex-cloud-setup.test.ts, docs/codex-cloud.md	The hosted app inventory allowlist now includes slack and linear. Inventory validation and capability formatting now lowercase names, keep known connectors as boolean flags, count unknown connectors, and reject credential-shaped values. Tests and docs now reflect the revised inventory behavior and output.
CLI argument validation and wiring scripts/check-codex-cloud-setup.mjs, tests/codex-cloud-setup.test.ts	A new validateHostedAppInventoryArguments(args) function rejects malformed hosted inventory flags and duplicate --hosted-app-inventory= usage. The CLI entry point now validates arguments before parsing and validating the inventory. Tests cover the new argument failures.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and directly summarizes the main change: adding validation for hosted app inventory evidence in the Cloud check script.
Description check	✅ Passed	The description includes a clear summary of changes, references to affected files, and comprehensive verification results. Required verification checkboxes have been completed with specific outcomes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #8193 (cancelled).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.