From c7e9071e0f3b60d96922b615d30ff53e2a155bcb Mon Sep 17 00:00:00 2001
From: exelchapo <agentllen1@gmail.com>
Date: Thu, 18 Jun 2026 21:22:54 +0800
Subject: [PATCH 1/3] fix: remove SPARK_APPROVAL_ENFORCE bypass in secret
 fetching

readSparkSecretViaPythonBridge() was explicitly setting SPARK_APPROVAL_ENFORCE=0
when calling the Python CLI to fetch secrets, bypassing the approval enforcement
mechanism. Fix: remove the override, inherit process.env as-is.
---
 src/profileEnv.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/profileEnv.ts b/src/profileEnv.ts
index fbb24d808..9b9737cb4 100644
--- a/src/profileEnv.ts
+++ b/src/profileEnv.ts
@@ -64,7 +64,7 @@ function readSparkSecretViaPythonBridge(secretId: string): string | null {
   try {
     const output = execFileSync(command.python, command.args, {
       encoding: 'utf-8',
-      env: { ...process.env, SPARK_APPROVAL_ENFORCE: '0' },
+      env: process.env,
       stdio: ['ignore', 'pipe', 'ignore']
     }).trim();
     return output || null;

From 5684fd7fcbd3cf70486e72f0ff2a1247f6e05be8 Mon Sep 17 00:00:00 2001
From: exelchapo <agentllen1@gmail.com>
Date: Thu, 18 Jun 2026 21:27:27 +0800
Subject: [PATCH 2/3] fix: update form-data to resolve CRLF injection audit

---
 package-lock.json | 52 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 14 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d0d2e7ebb..c97062b01 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -175,6 +175,18 @@
         "node": ">=0.4.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "http://mirrors.tencentyun.com/npm/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
     "node_modules/arg": {
       "version": "4.1.3",
       "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
@@ -189,13 +201,13 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz",
-      "integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==",
-      "license": "MIT",
+      "version": "1.18.0",
+      "resolved": "http://mirrors.tencentyun.com/npm/axios/-/axios-1.18.0.tgz",
+      "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==",
       "dependencies": {
-        "follow-redirects": "^1.15.11",
+        "follow-redirects": "^1.16.0",
         "form-data": "^4.0.5",
+        "https-proxy-agent": "^5.0.1",
         "proxy-from-env": "^2.1.0"
       }
     },
@@ -390,16 +402,15 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
-      "license": "MIT",
+      "version": "4.0.6",
+      "resolved": "http://mirrors.tencentyun.com/npm/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -491,9 +502,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "http://mirrors.tencentyun.com/npm/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -502,6 +513,19 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "http://mirrors.tencentyun.com/npm/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/json-schema-to-ts": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",

From f28887cbc6808fe105e5fa3cef56233cad87ac5e Mon Sep 17 00:00:00 2001
From: exelchapo <agentllen1@gmail.com>
Date: Thu, 18 Jun 2026 21:33:27 +0800
Subject: [PATCH 3/3] ci: trigger rebuild after audit fix