Geronimo 27667bc746 fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks ...

- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing

2026-09-14 13:24:58 +05:30

..

ci

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

commands

fix(commands): generate discoverable skills from learning workflows (#2653)

2026-08-02 14:39:29 -04:00

docker

feat(docker): add hardened CLI test harness (#2625)

2026-08-06 16:52:39 -04:00

docs

test(github-ops): report locale policy failures

2026-09-10 15:40:13 -04:00

fixtures

fix(install): harden universal setup release path (#2888)

2026-08-30 18:54:00 -04:00

hooks

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

integration

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

lib

fix(memory): classify directory traversal failures

2026-09-12 07:45:40 -04:00

pi

fix(pi): prevent recursive compiled OMP hook execution

2026-09-07 16:26:10 -04:00

scripts

feat(control-pane): live control-plane view with 2D projection and static-threshold advisories

2026-09-12 04:17:37 -04:00

skills

Consolidate recovered eval framework and operator workflows (#3040)

2026-09-10 13:20:52 +01:00

__init__.py

Small changes

2026-04-12 12:34:45 +05:30

codex-config.test.js

fix(codex): broaden context7 config checks

2026-03-29 00:26:16 -04:00

codex-native-hooks.test.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

conftest.py

docs: salvage focused stale PR contributions

2026-05-11 05:31:12 -04:00

gan-harness.test.js

fix(gan): distinguish scores from verdict thresholds

2026-08-29 14:24:16 -04:00

opencode-config.test.js

test(opencode): require non-empty agent catalog

2026-08-24 20:09:12 -04:00

opencode-plugin-hooks.test.js

fix(opencode): don't crash the whole session when plugins/lib is missing (#2538)

2026-07-28 21:37:41 -04:00

opencode-tools.test.js

fix(opencode): don't crash the whole session when plugins/lib is missing (#2538)

2026-07-28 21:37:41 -04:00

plugin-manifest.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

run-all.js

test: fix Windows ownership paths and failure annotations

2026-09-07 18:09:46 -04:00

test_astraflow_provider.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00

test_atlas_provider.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00

test_builder.py

test: pin Ollama whitespace normalization

2026-08-28 15:59:31 -04:00

test_claude_provider.py

fix(llm/providers/claude): attach cache_control to system block, not top-level (#2515)

2026-07-17 16:04:32 -04:00

test_executor.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00

test_invariant_runner.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00

test_provider_tools.py

fix: harden openai-compatible provider responses

2026-05-18 01:04:28 -04:00

test_resolver.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00

test_selector.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00

test_taste_blender.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_mint3d.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_overlays.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_pipeline.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_resolve.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_transport.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_verify.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_taste_workflow_graphs.py

feat(tasteforge): package reusable workflows and preserve native edits (#3033)

2026-09-10 15:31:36 +01:00

test_templates.py

docs: salvage focused stale PR contributions

2026-05-11 05:31:12 -04:00

test_types.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00