From af6813ca12fa477d5530b0591e9519668f235219 Mon Sep 17 00:00:00 2001
From: adevwithpurpose <adevwithpurpose@users.noreply.github.com>
Date: Sat, 15 Aug 2026 10:08:14 -0300
Subject: [PATCH] fix(security): keep only the regex sanitization; drop
 non-functional CodeQL annotations

The lgtm[]/nosemgrep: comments in codexIdentity.ts and reasoningCache.ts use
formats GitHub Actions CodeQL does not honor, and shifting those sha256 lines
re-attributed the already-dismissed base alerts to this PR as two new CodeQL
findings. Revert those two annotation-only files to base so the existing
dismissals apply; retain the real fix (escaping backslash in the test regex),
which resolves the open js/incomplete-sanitization alert.
---
 open-sse/config/codexIdentity.ts    | 19 ++++---------------
 open-sse/services/reasoningCache.ts |  6 +-----
 2 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/open-sse/config/codexIdentity.ts b/open-sse/config/codexIdentity.ts
index d743d81649..bc45fa1cf6 100644
--- a/open-sse/config/codexIdentity.ts
+++ b/open-sse/config/codexIdentity.ts
@@ -37,26 +37,15 @@ function nonEmptyString(value: unknown): string | null {
   return normalized || null;
 }
 
-/**
- * Keep the historical installation-id layout so existing accounts stay stable.
- * CodeQL: not password hashing — this derives a deterministic installation UUID
- * from an account seed, never verified against a stored credential. Same
- * false-positive class as src/lib/db/apiKeys.ts::hashKey.
- * lgtm[js/insufficient-password-hash]
- */
+/** Keep the historical installation-id layout so existing accounts stay stable. */
 function uuidFromLegacyInstallationValue(value: string): string {
-  const hash = createHash("sha256").update(value).digest("hex"); // nosemgrep: insufficient-password-hash
+  const hash = createHash("sha256").update(value).digest("hex");
   return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
 }
 
-/**
- * RFC4122 v4 from SHA-256. Same seed → same UUID.
- * CodeQL: not password hashing — deterministic ID derivation from an account
- * seed, never verified against a stored credential.
- * lgtm[js/insufficient-password-hash]
- */
+/** RFC4122 v4 from SHA-256. Same seed → same UUID. */
 export function deriveStableUUIDv4(seed: string): string {
-  const digest = createHash("sha256").update(seed).digest(); // nosemgrep: insufficient-password-hash
+  const digest = createHash("sha256").update(seed).digest();
   const bytes = Buffer.from(digest.subarray(0, 16));
   bytes[6] = (bytes[6] & 0x0f) | 0x40;
   bytes[8] = (bytes[8] & 0x3f) | 0x80;
diff --git a/open-sse/services/reasoningCache.ts b/open-sse/services/reasoningCache.ts
index f4dddbfeba..bdf870e3fb 100644
--- a/open-sse/services/reasoningCache.ts
+++ b/open-sse/services/reasoningCache.ts
@@ -302,11 +302,7 @@ export function buildAssistantMessageCacheKey(
   if (!message || message.role !== "assistant") return "";
 
   const transcript = messages.slice(0, messageIndex + 1).map(canonicalizeHistoryMessage);
-  // CodeQL: not password hashing — this derives a cache-lookup key from the
-  // conversation transcript, never verified against a stored credential.
-  // Same false-positive class as src/lib/db/apiKeys.ts::hashKey.
-  // lgtm[js/insufficient-password-hash]
-  const digest = createHash("sha256") // nosemgrep: insufficient-password-hash
+  const digest = createHash("sha256")
     .update(normalizedScope)
     .update("\x1f")
     .update(JSON.stringify(transcript))