WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-21 00:58:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(worker,installer,claw): correct approval flag, installer order, percent path hardening

Browse Source 
- orchestrate-codex-worker: pass approval policy via --ask-for-approval,
  not -p profile
- codex global hooks: validate conflicting global hooksPath before backup/copy,
  so refused install is side-effect free
- claw: reject percent-delimited Windows paths in cmd.exe fallback to avoid
  %NAME% expansion
- codex-hooks: opt into ECC_PREPUSH_RUN_CHECKS=1 in existing verification
  fixtures and add default-skip coverage
This commit is contained in:
Geronimo
2026-09-14 23:52:01 +05:30
parent 15f1ee8a41
commit c5bbee3cb8
4 changed files with 45 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/orchestrate-codex-worker.sh
+8 -5
View File
@@ -54,12 +54,15 @@ write_status "running" "- Task file: \`$task_file\`"
# rm -rf / exfiltration commands without confirmation.
# Default to the most restrictive approval mode; allow an explicit operator
# override only via env (e.g. ECC_CODEX_APPROVAL_MODE=on-request for trusted runs).
APPROVAL_MODE="${ECC_CODEX_APPROVAL_MODE:-never}"
case "$APPROVAL_MODE" in
# Codex profiles (-p) and approval policies (--ask-for-approval) are
# independent concepts. SECURITY: default to never approving untrusted
# tool execution; operators can override via env.
APPROVAL_POLICY="${ECC_CODEX_APPROVAL_POLICY:-never}"
case "$APPROVAL_POLICY" in
never|on-request|on-failure) ;;
*)
echo "[ECC worker] Refusing to run: unsupported ECC_CODEX_APPROVAL_MODE='$APPROVAL_MODE' (expected never|on-request|on-failure)" >&2
write_status "failed" "- Error: unsupported approval mode"
echo "[ECC worker] Refusing to run: unsupported ECC_CODEX_APPROVAL_POLICY='$APPROVAL_POLICY' (expected never|on-request|on-failure)" >&2
write_status "failed" "- Error: unsupported approval policy"
exit 1
;;
esac
@@ -106,7 +109,7 @@ Task file: $task_file
$(cat "$task_file")
EOF
if codex exec -p "$APPROVAL_MODE" -m gpt-5.4 --color never -C "$(pwd)" -o "$output_file" - < "$prompt_file"; then
if codex exec --ask-for-approval "$APPROVAL_POLICY" -m gpt-5.4 --color never -C "$(pwd)" -o "$output_file" - < "$prompt_file"; then
{
echo "# Handoff"
echo