Geronimo 27667bc746 fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks ...

- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing

2026-09-14 13:24:58 +05:30

..

auto-tmux-dev.test.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

bash-hook-dispatcher.test.js

fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)

2026-06-15 13:48:46 -04:00

block-no-verify.test.js

fix(hooks): block-no-verify handles stuck optional values and long-option prefixes (#3073)

2026-09-12 03:07:29 +01:00

check-hook-enabled.test.js

feat: add C++ language support and hook tests (#539)

2026-03-16 14:31:49 -07:00

config-protection.test.js

fix(config-protection): match protected filenames case-insensitively (#2543)

2026-07-22 12:17:04 -04:00

continuous-learning-observe-runner.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

continuous-learning-shebang-consistency.test.js

chore(continuous-learning-v2): standardize shell shebangs to env bash (#2401)

2026-07-03 20:40:44 -07:00

cost-tracker.test.js

fix(costs): retain dated Opus 4 legacy pricing

2026-08-28 16:26:13 -04:00

cursor-block-no-verify.test.js

fix(.cursor/hooks): route block-no-verify through local hook to fix message-body false positives (#2107) (#2177)

2026-06-07 13:01:36 +08:00

design-quality-check.test.js

feat: add web frontend rules and design quality hook

2026-04-02 17:33:17 -07:00

detect-project-nongit.test.js

fix(continuous-learning-v2): honor non-git CLAUDE_PROJECT_DIR (#2488)

2026-07-26 00:04:35 -07:00

detect-project-worktree.test.js

fix(learning): add project registry maintenance

2026-05-19 12:51:18 -04:00

doc-file-warning.test.js

fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358)

2026-06-29 15:54:55 -07:00

ecc-context-monitor.test.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-metrics-bridge.test.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-statusline.test.js

chore: update statusline ANSI color palette

2026-05-15 23:18:01 -04:00

evaluate-session.test.js

fix: remove unused execFileSync import (no-unused-vars ESLint)

2026-02-18 07:15:53 +05:30

gateguard-fact-force.test.js

fix: close release review gaps and expose failing CI suites

2026-09-07 17:57:26 -04:00

governance-capture.test.js

fix: close release review gaps and expose failing CI suites

2026-09-07 17:57:26 -04:00

hook-flags.test.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

hooks-metadata.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

hooks.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

insaits-security-monitor.test.js

test: skip insaits monitor subprocesses without python

2026-05-18 00:47:05 -04:00

insaits-security-wrapper.test.js

test: harden InsAIts wrapper fake Python shim

2026-05-12 01:13:01 -04:00

mcp-health-check.test.js

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

migrate-homunculus-home-escape.test.js

fix(clv2): escape $HOME before pgrep -f in migrate-homunculus.sh (#2339)

2026-06-25 16:47:32 -07:00

observe-entrypoint-allowlist.test.js

fix(continuous-learning-v2): accept claude-vscode as valid entrypoint (#2134)

2026-06-07 13:01:24 +08:00

observe-nosurvive-warning.test.js

fix(continuous-learning-v2): warn when the observer never survives a hook invocation (#2489) (#2606)

2026-08-12 18:36:30 -04:00

observe-signal-counter-race.test.js

fix: resolve open-issue cluster (#2295, #2298, #2303–#2306, #2340) + createdTime fallback bug (#2408)

2026-07-03 21:10:45 -07:00

observe-signal-timeout.test.js

fix: resolve open-issue cluster (#2295, #2298, #2303–#2306, #2340) + createdTime fallback bug (#2408)

2026-07-03 21:10:45 -07:00

observe-subdirectory-detection.test.js

fix(learning): add project registry maintenance

2026-05-19 12:51:18 -04:00

observer-loop-archive.test.js

fix: harden observer completion handling

2026-09-06 00:01:49 +08:00

observer-loop-mktemp.test.js

fix: resolve open-issue cluster (#2295, #2298, #2303–#2306, #2340) + createdTime fallback bug (#2408)

2026-07-03 21:10:45 -07:00

observer-memory.test.js

fix: pass observer analysis path explicitly

2026-08-24 22:26:24 -03:00

passthrough-large-stdin.test.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

plan-canvas-pending-hook.test.js

fix(plan-canvas): deliver browser chat to the agent every time (#2739)

2026-08-09 18:15:25 -04:00

plan-canvas-sessions-hook.test.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

plugin-hook-bootstrap-no-echo.test.js

test(hooks): drain bootstrap children asynchronously (#2941)

2026-09-02 19:55:26 -04:00

plugin-hook-bootstrap.test.js

test(hooks): report unavailable Windows runtimes

2026-08-14 23:40:56 +08:00

post-bash-hooks.test.js

feat: add C++ language support and hook tests (#539)

2026-03-16 14:31:49 -07:00

posttooluse-dispatcher.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

pre-bash-commit-quality.test.js

fix(hooks): support Windows linter paths and ESLint 9 (#3076)

2026-09-12 01:46:38 +01:00

pre-bash-dev-server-block.test.js

fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)

2026-06-07 13:25:39 +08:00

pre-bash-reminders.test.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

pre-bash-tmux-reminder.test.js

fix(hooks): remove stray '?' that made every 'yarn <anything>' fire tmux reminder (#2517)

2026-07-20 16:21:03 -04:00

pre-compact.test.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

quality-gate.test.js

feat: add C++ language support and hook tests (#539)

2026-03-16 14:31:49 -07:00

run-with-flags-truncation.test.js

fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)

2026-06-11 00:31:33 -04:00

session-activity-tracker.test.js

test: cover session activity tracker edge paths

2026-04-29 18:15:51 -04:00

session-end.test.js

fix(hooks): preserve short sessions and quote evolved metadata

2026-08-28 16:08:19 -04:00

skill-run-tracker.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

stop-format-typecheck.test.js

fix(hooks): never format installed plugin and marketplace clones (#2667)

2026-08-04 17:14:37 -04:00

stop-hooks-stdout.test.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

suggest-compact.test.js

fix: close truth and portability review gaps

2026-08-29 14:55:14 -04:00

test_insaits_security_monitor.py

ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package (#2364)

2026-08-11 14:15:57 -04:00