Commit Graph

15 Commits

Author SHA1 Message Date
Pavan Kumar Gondhi
fc065b2693 Harden macOS shell wrapper allowlist parsing [AI] (#78518)
* fix: harden shell wrapper allowlist parsing

* fix: harden shell wrapper approval binding

* docs: add changelog entry for PR merge

---------

Co-authored-by: Ishaan <ishaan@Ishaans-Mac-mini.local>
2026-05-08 10:18:41 +05:30
Peter Steinberger
117364e2b9 fix: unwrap env path carrier commands 2026-05-04 05:53:03 +01:00
Peter Steinberger
5eac4686aa fix: preserve env split-string payloads 2026-05-04 05:53:03 +01:00
Pavan Kumar Gondhi
8f8492d172 fix(security): broaden shell-wrapper detection and block env-argv assignment injection [AI-assisted] (#65717)
* fix: address issue

* fix: address PR review feedback

* fix: address PR review feedback

* docs: add changelog entry for PR merge
2026-04-13 11:48:42 +05:30
Nimrod Gutman
de6bac331c fix(exec): detect cmd wrapper carriers (#62439)
* fix(exec): detect cmd wrapper carriers

* fix(exec): block env cmd wrapper carriers

* fix: keep cmd wrapper carriers approval-gated (#62439) (thanks @ngutman)
2026-04-07 14:27:06 +03:00
Vincent Koc
730ba40763 fix(exec): unwrap arch and xcrun dispatch wrappers (#58203)
* fix(exec): unwrap arch and xcrun dispatch wrappers

* fix(infra): scope arch wrapper unwrapping to macos

* fix(exec): scope arch wrapper unwrapping to macos

* fix(infra): validate macos arch wrapper selectors

* test(infra): cover invalid arch name wrappers
2026-03-31 21:00:14 +09:00
Vincent Koc
9023a0436c fix(exec): unwrap transparent approval wrappers (#58215)
* fix(exec): unwrap transparent approval wrappers

* fix(exec): normalize sandbox-exec -D wrapper parsing
2026-03-31 19:38:34 +09:00
Peter Steinberger
0b013bdd94 test: dedupe exec approval and system run suites 2026-03-28 00:02:09 +00:00
Jacob Tomlinson
83da3cfe31 infra: unwrap script wrapper approval targets (#55685)
* infra: unwrap script wrapper approvals

* infra: handle script short option values

* infra: gate script wrapper unwrapping by platform

* infra: narrow script wrapper option parsing
2026-03-27 10:05:35 +00:00
Peter Steinberger
cef7d14861 refactor(exec): rename wrapper plans for trust semantics 2026-03-22 23:18:54 -07:00
Peter Steinberger
6ba5595004 refactor(exec): make dispatch wrapper semantics spec-driven 2026-03-22 23:18:54 -07:00
Peter Steinberger
f52eb934d6 fix(security): unify dispatch wrapper approval hardening 2026-03-22 23:01:49 -07:00
Peter Steinberger
b4a3e5324b test: expand exec wrapper helper coverage 2026-03-13 19:06:22 +00:00
Peter Steinberger
54998a1042 test: expand exec wrapper helper coverage 2026-03-13 18:34:42 +00:00
Peter Steinberger
66c581c64c fix: normalize windows runtime shim executables 2026-03-09 07:01:42 +00:00