Commit Graph

4 Commits

Author SHA1 Message Date
Peter Steinberger
425c5b9f26 fix(macos): reject revoked forwarded exec approvals (#103968)
* fix(macos): reject revoked forwarded exec approvals

* fix(macos): split approval plan validation

* chore(i18n): refresh native source lines
2026-07-10 19:01:17 -07:00
Peter Steinberger
9b1c36d23c fix: prevent exec approval revocation races (#103515)
* fix(security): serialize exec approval mutations

* fix(security): preserve additive approval writes

* test(cli): expect normalized approval shape

* fix(security): preserve exec approval compatibility

* test(security): exercise locked approval initialization

* test(security): mock serialized approval helpers

* test(exec): derive enforced command path from plan

* fix(gateway): always return approval CAS conflicts

* fix(macos): serialize exec approvals writes

* fix(security): repair approval build errors

* fix(security): serialize exec approval mutations

* fix(security): fail closed on approval persistence errors

* test(security): cover detached approval persistence failures

* fix(security): harden exec approval state

* style(macos): format exec approval sources

* fix(security): complete exec approval hardening

Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>

* fix(macos): preserve approved login-shell semantics

* fix(macos): keep login shell approvals one-shot

* fix(security): linearize exec authorization

Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>

* fix(security): preserve durable approval basis

Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>

* fix(security): bind exec grants to current policy

Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>

* test(security): fix exec revocation fixtures

* test(security): align gateway approval fixtures

* fix(macos): return approval decisions

* chore(i18n): sync native approval strings

* test(security): align approval hardening fixtures

* test(node): authorize completed event fixture

* test(security): fix approval decision fixtures

* test(security): await durable approval visibility

* fix(exec): preserve concurrent approval grants

* fix(exec): address exact-head CI failures

* fix(exec): preserve concurrent approval promotions

* fix(exec): make Swift shutdown state explicit

* test(macos): handle approval read failures

* fix(macos): harden approval socket paths

* fix(macos): preserve exact shell payload bytes

* test(macos): make approval fixtures explicit

* test(macos): fix approval suite compilation

* fix(macos): bound approval socket JSONL reads

* chore: move exec approval note to release process

* chore: move exec approval note to release process

---------

Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>
2026-07-10 21:35:05 +01:00
pick-cat
b2620d7153 fix(infra): bound jsonl-socket response buffer to prevent OOM (#98130)
* fix(infra): bound jsonl-socket response buffer to prevent OOM

* fix(macos): cap exec host socket output

* fix(macos): satisfy swiftformat for exec limiter

* test(macos): prove exec host output cap on command output

* chore: keep jsonl socket cap scoped to infra

* fix(infra): raise jsonl socket buffer cap

* test(infra): prove jsonl socket cap beats timeout

* ci: rerun jsonl socket buffer bound checks

* fix(macos): cap exec host response output

* test(macos): avoid private exec response fixtures

* fix(macos): satisfy exec output limiter formatting

* fix(macos): avoid static self formatting conflict

* chore: keep jsonl socket guard infra-only

* fix(jsonl-socket): parse complete lines before enforcing the buffer cap

* chore: remove unnecessary return after finish(null)

* fix(infra): frame bounded JSONL socket lines

* fix(infra): frame bounded JSONL socket lines

* style(macos): keep exec limiter patch focused

* style(macos): keep exec limiter patch focused

* style(macos): satisfy exec limiter formatting

* style(infra): satisfy socket loop lint

---------

Co-authored-by: Peter Steinberger <peter@steipete.me>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-03 08:15:47 -07:00
Peter Steinberger
be2e6ca0f6 fix(macos): harden exec approval socket auth 2026-03-16 23:00:22 -07:00