Peter Steinberger
|
425c5b9f26
|
fix(macos): reject revoked forwarded exec approvals (#103968)
* fix(macos): reject revoked forwarded exec approvals
* fix(macos): split approval plan validation
* chore(i18n): refresh native source lines
|
2026-07-10 19:01:17 -07:00 |
|
Peter Steinberger
|
9b1c36d23c
|
fix: prevent exec approval revocation races (#103515)
* fix(security): serialize exec approval mutations
* fix(security): preserve additive approval writes
* test(cli): expect normalized approval shape
* fix(security): preserve exec approval compatibility
* test(security): exercise locked approval initialization
* test(security): mock serialized approval helpers
* test(exec): derive enforced command path from plan
* fix(gateway): always return approval CAS conflicts
* fix(macos): serialize exec approvals writes
* fix(security): repair approval build errors
* fix(security): serialize exec approval mutations
* fix(security): fail closed on approval persistence errors
* test(security): cover detached approval persistence failures
* fix(security): harden exec approval state
* style(macos): format exec approval sources
* fix(security): complete exec approval hardening
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>
* fix(macos): preserve approved login-shell semantics
* fix(macos): keep login shell approvals one-shot
* fix(security): linearize exec authorization
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>
* fix(security): preserve durable approval basis
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>
* fix(security): bind exec grants to current policy
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>
* test(security): fix exec revocation fixtures
* test(security): align gateway approval fixtures
* fix(macos): return approval decisions
* chore(i18n): sync native approval strings
* test(security): align approval hardening fixtures
* test(node): authorize completed event fixture
* test(security): fix approval decision fixtures
* test(security): await durable approval visibility
* fix(exec): preserve concurrent approval grants
* fix(exec): address exact-head CI failures
* fix(exec): preserve concurrent approval promotions
* fix(exec): make Swift shutdown state explicit
* test(macos): handle approval read failures
* fix(macos): harden approval socket paths
* fix(macos): preserve exact shell payload bytes
* test(macos): make approval fixtures explicit
* test(macos): fix approval suite compilation
* fix(macos): bound approval socket JSONL reads
* chore: move exec approval note to release process
* chore: move exec approval note to release process
---------
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com>
|
2026-07-10 21:35:05 +01:00 |
|
pick-cat
|
b2620d7153
|
fix(infra): bound jsonl-socket response buffer to prevent OOM (#98130)
* fix(infra): bound jsonl-socket response buffer to prevent OOM
* fix(macos): cap exec host socket output
* fix(macos): satisfy swiftformat for exec limiter
* test(macos): prove exec host output cap on command output
* chore: keep jsonl socket cap scoped to infra
* fix(infra): raise jsonl socket buffer cap
* test(infra): prove jsonl socket cap beats timeout
* ci: rerun jsonl socket buffer bound checks
* fix(macos): cap exec host response output
* test(macos): avoid private exec response fixtures
* fix(macos): satisfy exec output limiter formatting
* fix(macos): avoid static self formatting conflict
* chore: keep jsonl socket guard infra-only
* fix(jsonl-socket): parse complete lines before enforcing the buffer cap
* chore: remove unnecessary return after finish(null)
* fix(infra): frame bounded JSONL socket lines
* fix(infra): frame bounded JSONL socket lines
* style(macos): keep exec limiter patch focused
* style(macos): keep exec limiter patch focused
* style(macos): satisfy exec limiter formatting
* style(infra): satisfy socket loop lint
---------
Co-authored-by: Peter Steinberger <peter@steipete.me>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
|
2026-07-03 08:15:47 -07:00 |
|
Peter Steinberger
|
be2e6ca0f6
|
fix(macos): harden exec approval socket auth
|
2026-03-16 23:00:22 -07:00 |
|