Peter Steinberger
d1684f48a3
refactor: delete dead infra and config exports ( #106019 )
...
* refactor: delete dead infra and config exports
* refactor: preserve live infra and config contracts
* refactor(config): remove obsolete file-store lifecycle APIs
* refactor(infra): finish current-main dead export cleanup
2026-07-13 12:00:47 -07:00
Pavan Kumar Gondhi
534ace4d8a
fix: bind package-manager exec approvals to inner commands [AI] ( #102035 )
...
* fix: bind package-manager exec approvals to inner commands
* fix: fail closed package manager exec approval gaps
* chore: refresh pr branch metadata
* fix: cover npm exec alias approvals
* fix: fail closed hidden package manager exec aliases
* fix: unwrap chained package manager approvals
* fix: cover yarn package manager approvals
* fix: preserve yarn run approval compatibility
* fix: bind package manager script argv checks
* test: fix package manager script argv type check
* fix: fail closed pnpm shorthand approvals
* fix: preserve pnpm built-in approvals
* fix: preserve pnpm script shortcuts
* fix: preserve npm cwd exec unwrapping
* fix: fail closed cwd and yarn package shorthands
2026-07-08 21:29:02 +05:30
Agustin Rivera
55d1324c7d
fix(flock): bind allow-always to wrapped command ( #93362 )
...
* fix(flock): bind allow-always to wrapped command
* fix(flock): handle wrapper option aliases
* fix(flock): handle wrapper option aliases
2026-06-15 11:56:15 -07:00
Peter Steinberger
2f814c6c92
docs: document infra execution helpers
2026-06-04 03:06:18 -04:00
Pavan Kumar Gondhi
8e41c118fa
fix: block side-effecting command wrappers [AI] ( #87292 )
...
* fix: block side-effecting command wrappers
* docs: add changelog entry for PR merge
2026-05-27 20:56:53 +05:30
Pavan Kumar Gondhi
50f4440c96
Enforce inline shell wrapper payload matching [AI] ( #80978 )
...
* fix: enforce inline shell wrapper payload matching
* addressing review-skill
* addressing codex review
* addressing codex review
* addressing claude review
* addressing claude review
* fix: complete shell wrapper allowlist handling
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing ci
* docs: add changelog entry for PR merge
2026-05-12 19:30:18 +05:30
Pavan Kumar Gondhi
de47989731
Recognize PowerShell -ec inline commands [AI] ( #80893 )
...
* fix: recognize PowerShell -ec inline command flag
* fix: recognize PowerShell -ec inline command flag
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* addressing codex review
* fix: recognize PowerShell encoded command prefixes
* addressing review-skill
* addressing review-skill
* addressing codex review
* addressing codex review
* docs: add changelog entry for PR merge
2026-05-12 15:53:10 +05:30
Pavan Kumar Gondhi
fc065b2693
Harden macOS shell wrapper allowlist parsing [AI] ( #78518 )
...
* fix: harden shell wrapper allowlist parsing
* fix: harden shell wrapper approval binding
* docs: add changelog entry for PR merge
---------
Co-authored-by: Ishaan <ishaan@Ishaans-Mac-mini.local >
2026-05-08 10:18:41 +05:30
Peter Steinberger
117364e2b9
fix: unwrap env path carrier commands
2026-05-04 05:53:03 +01:00
Peter Steinberger
5eac4686aa
fix: preserve env split-string payloads
2026-05-04 05:53:03 +01:00
Pavan Kumar Gondhi
8f8492d172
fix(security): broaden shell-wrapper detection and block env-argv assignment injection [AI-assisted] ( #65717 )
...
* fix: address issue
* fix: address PR review feedback
* fix: address PR review feedback
* docs: add changelog entry for PR merge
2026-04-13 11:48:42 +05:30
Nimrod Gutman
de6bac331c
fix(exec): detect cmd wrapper carriers ( #62439 )
...
* fix(exec): detect cmd wrapper carriers
* fix(exec): block env cmd wrapper carriers
* fix: keep cmd wrapper carriers approval-gated (#62439 ) (thanks @ngutman)
2026-04-07 14:27:06 +03:00
Vincent Koc
730ba40763
fix(exec): unwrap arch and xcrun dispatch wrappers ( #58203 )
...
* fix(exec): unwrap arch and xcrun dispatch wrappers
* fix(infra): scope arch wrapper unwrapping to macos
* fix(exec): scope arch wrapper unwrapping to macos
* fix(infra): validate macos arch wrapper selectors
* test(infra): cover invalid arch name wrappers
2026-03-31 21:00:14 +09:00
Vincent Koc
9023a0436c
fix(exec): unwrap transparent approval wrappers ( #58215 )
...
* fix(exec): unwrap transparent approval wrappers
* fix(exec): normalize sandbox-exec -D wrapper parsing
2026-03-31 19:38:34 +09:00
Peter Steinberger
0b013bdd94
test: dedupe exec approval and system run suites
2026-03-28 00:02:09 +00:00
Jacob Tomlinson
83da3cfe31
infra: unwrap script wrapper approval targets ( #55685 )
...
* infra: unwrap script wrapper approvals
* infra: handle script short option values
* infra: gate script wrapper unwrapping by platform
* infra: narrow script wrapper option parsing
2026-03-27 10:05:35 +00:00
Peter Steinberger
cef7d14861
refactor(exec): rename wrapper plans for trust semantics
2026-03-22 23:18:54 -07:00
Peter Steinberger
6ba5595004
refactor(exec): make dispatch wrapper semantics spec-driven
2026-03-22 23:18:54 -07:00
Peter Steinberger
f52eb934d6
fix(security): unify dispatch wrapper approval hardening
2026-03-22 23:01:49 -07:00
Peter Steinberger
b4a3e5324b
test: expand exec wrapper helper coverage
2026-03-13 19:06:22 +00:00
Peter Steinberger
54998a1042
test: expand exec wrapper helper coverage
2026-03-13 18:34:42 +00:00
Peter Steinberger
66c581c64c
fix: normalize windows runtime shim executables
2026-03-09 07:01:42 +00:00
