[WRONG BRANCH] fix(cli): bind status probe token to hub snapshot

[luvs01]

Motivation

• The remote-hub status probe previously reread the service-api-token independently of the snapshotted client connection, which could cause a mismatched or newly rotated token to be sent to a different hub origin and disclose a bearer credential.

Description

• Revalidate connection ownership before probing: collectRemoteHubStatus now reads the live connection (readClientConnectionState()) and verifies the token fingerprint matches the snapshotted connection before passing a token to resolveHubState().
• Fail closed to the existing owner-stamped cache path when the token does not belong to the snapshot, so no token is transmitted for mismatched generations.
• Add regression tests that assert a mismatched token and a token from a newly established connection are never sent to the earlier snapshot and that fetch is not invoked in those cases.
• Files changed: src/cli/status.ts and tests/cli/cli-status-hub-state.test.ts.

Testing

• Ran the focused security regression: ./node_modules/.bin/bun test tests/cli/cli-status-hub-state.test.ts and it passed (new tests included).
• Ran typecheck and privacy scan: ./node_modules/.bin/bun run typecheck and ./node_modules/.bin/bun run privacy:scan and both succeeded.
• The full test suite (./node_modules/.bin/bun run test) encountered environment-sensitive worker panics and unrelated Codex shim cleanup failures during parallel runs; the focused tests, typecheck, and privacy scan (the relevant, focused validations for this change) passed.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1f898cca-c983-4908-9d01-03125ca842a6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T05:40:04.672293Z	f599784	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.

[luvs01]

Closing this original proposal because its useful scope has been reimplemented as a focused, independently validated submission. Further review and CI follow-up now belong to that active submission; this does not claim the change is merged.