v1.7.0 — the audit closes, and an open relay refuses to start

oxaudit.md is closed in full, and this is the first npm release since 1.6.0.

v1.6.1 was tagged and released on GitHub but never published to npm — the audit work landed on main before the publish ran, which would have meant shipping different bytes under an already-tagged number. Everything in the v1.6.1 notes ships here. Upgrading from 1.6.0? Read both sections.

What changes under an existing user

Two things, and both are the decision rather than a side effect.

An exposed Gateway bind with no token now refuses to start. Running the Gateway on 0.0.0.0 (or any LAN address) without gatewayToken throws from start() instead of listening. That configuration was an unauthenticated relay: the gate enforced a token only if one was configured, so anything that could reach the port had its bodies forwarded to upstream providers, with no warning. Three ways forward:

• set gatewayToken / TOKENDAMPER_GATEWAY_TOKEN;
• bind a loopback host and reach it through a tunnel or an authenticating proxy;
• set allowUnauthenticatedNonLoopback: true if an open relay is genuinely what you want.

tokendamper exec is unaffected — it binds loopback and generates a token — and loopback trust (audit C3) is untouched and asserted.

Plain tokendamper bench no longer executes fixture code through python. It reports a different quantity under the same field names: syntaxPassRate and passAt1Rate now come from validation, measured 0.6 against the execution-derived 1.0 on the bundled fixtures. Pass --evaluate-quality for the previous behaviour.

New in 1.7.0 — the last four audit findings (DECISIONS §70)

M15	bench quality evaluation is opt-in. Verified on the built artifact: plain bench writes 0 python-subprocess evaluations, --evaluate-quality writes 5.
M8	An exposed bind must be authenticated, or say explicitly that it should not be.
M9 + L13	A foreign Origin is refused on every bind; a foreign Host on a loopback bind, where DNS rebinding is the threat. GET /health returns {"status":"ok"} and no longer reports sessionCount.
M13	--minimum-confidence and --max-debt documented as inert on the CLI, pinned by a characterization test so a change making either live fails on purpose.

Two corrections came out of verifying before fixing. The audit asked for an OPTIONS/CORS handler — measured, the server already answered OPTIONS 405 with no Access-Control-* headers, and preflight was never the gap since a simple request skips it. And the recorded decision claimed non-browser clients send neither header: true of Origin, false of Host, which every HTTP/1.1 client sends.

Folded in from the unpublished v1.6.1

§61 Go elides — four languages reduce instead of three (27.46% on application Go) · §62 --trace-output and --mode explain withdrawn · §64 debtScore becomes a measurement, correlation 1.0000, having been pinned at its 35.00 clamp on 317 of 317 rows · §65–§68 four Gateway defects that reached provider traffic · §58 --keep-docstrings · §63/§69 the float pool and the OX LOW table.

Verification

npm run typecheck, npm run lint, npm run build clean; 95 files / 859 tests passing. The built artifact reports 1.7.0 three ways: dist/src/version.js, package.json, and MCP serverInfo.version.

Full changelog: https://github.com/Epichlo/TokenDamper/blob/v1.7.0/CHANGELOG.md