Geronimo 27667bc746 fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks ...

- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing

2026-09-14 13:24:58 +05:30

..

pre-commit

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

pre-push

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30