8 Commits

Author	SHA1	Message	Date
NCBM	2b3b2073a0	core/tools: only value-taking options may swallow the program ... The wrapper option table listed flags as if they consumed the next token, so the program behind them was skipped: `exec -c git -c init.defaultBranch=main init` resolved to `init` and the policy denied it as a denylisted basename, while `exec -c rm -rf /`, `command -p rm -rf /` and `command -v rm` hid `rm` from the denylist completely and `exec -c python -c …` lost the interpreter review. Drop the entries that take no value — `exec -c`/`-l`, the whole `command` entry, `pkexec --disable-internal-agent`, `su -p`, and `xargs -e` (its argument is optional, and the jammed form needs no entry) — so the resolved program is the one that really runs.	2026-10-06 21:50:21 +08:00
NCBM	c7680491c9	core/tools: denylist power-management subcommands and privileged programs	2026-10-06 19:55:14 +08:00
NCBM	9501efb3d7	core/tools: block a denylisted program behind env wrappers and run launchers	2026-10-06 19:42:06 +08:00
NCBM	ba021cb138	tools/workspace: mode-aware path grants and escape hint	2026-09-09 22:11:50 +08:00
NCBM	1d718582ac	core/tools: drop process workspace/todo globals; require bound state	2026-07-24 16:32:33 +08:00
NCBM	d6616d0da3	core/tools: timed human allow for denylisted commands ... Denylist hits ask the user (default deny, timeout) instead of only hard rejecting when a policy hook is installed. Independent of YOLO soft-confirm; session grants skip re-prompt for the same basename. CLI installs the hook via install_cli_limit_hooks.	2026-07-20 03:02:34 +08:00
NCBM	510dd67a54	core/tools: classify destructive tools and clarify policy denies ... Add classify_danger for delete/move/overwrite paths, get_path_denylist, and clearer path/command denial messages.	2026-07-14 23:30:02 +08:00
NCBM	f45af76c9b	test/tools: cover workspace, file, run_command and PTY	2026-07-14 18:20:32 +08:00