fix: the worker in worker.js

[anupamme]

Summary

Fix high severity security issue in worker.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	worker.js:94
Assessment	Likely exploitable

Description: The worker.js script passes the original incoming request object directly to the jq_fetch function when fetching external GitHub resources, causing all headers from the original request (including Authorization tokens, API keys, cookies) to be forwarded to GitHub. The jq_fetch function also copies response headers (including Set-Cookie) into subsequent redirect requests without sanitization.

Evidence

Exploitation scenario: An attacker sends a request to the worker with sensitive headers (Authorization tokens, API keys).

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Python library - vulnerabilities affect applications that import this code.

Changes

• worker.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security