L4XB f838085274 fix(gateguard): reach SQL clients behind shell flag clusters, su and taskset ...

main resolves SQL clients behind env -S and its launcher grammars, but a
destructive statement still passed under four forms:

- a shell -c inside a short-option cluster (bash -lc, sh -ec), since only
  an exact -c was looked up;
- su, whose -c / --command / -lc value runs through the target user's
  shell, before or after --;
- taskset, whose mask or CPU list precedes the command, like timeout's
  duration;
- a command nested past the shell -c recursion limit, which was allowed
  instead of denied.

The first three are checked like sh -c; past the limit the check now
fails closed.

2026-10-05 15:56:53 +02:00

..

ci

feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264)

2026-09-29 20:24:05 -05:00

codemaps

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

codex

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

codex-git-hooks

Merge pull request #3126 from VarunGore36/fix/reviewer-followups

2026-09-19 19:58:43 -04:00

dev

fix(profiles): bind routing receipts and harden review paths

2026-09-27 18:01:40 -04:00

discord

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

hooks

fix(gateguard): reach SQL clients behind shell flag clusters, su and taskset

2026-10-05 15:56:53 +02:00

lib

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

auto-update.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

build-opencode.js

fix: restore ci baseline for opencode packaging

2026-04-05 14:47:26 -07:00

build-pi-core.js

chore(release): 2.2.3, ECC-only naming in pi/core and a longer npm publish wait (#3329)

2026-10-01 17:49:51 -05:00

catalog.js

feat: add install catalog and project config autodetection

2026-03-27 05:56:39 -04:00

claw.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

consult.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

control-pane.js

feat(profiles): add opt-in Lean/Full and hybrid Auto selection

2026-09-27 16:46:07 -04:00

coordination-inventory.js

Distinguish declared goals, open sessions and overlap risk in coordination inventory (#3028)

2026-09-10 14:11:51 +03:00

dashboard-web.js

fix(hooks): keep hooks.json within Claude Code's schema

2026-09-12 02:59:02 -04:00

discussion-audit.js

chore: gate canonical ECC release identity (#1991)

2026-05-19 06:42:17 -04:00

doctor.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

ecc.js

feat(profiles): add opt-in Lean/Full and hybrid Auto selection

2026-09-27 16:46:07 -04:00

eval-harness.js

feat: group verified capsules into offline retrospective reports

2026-09-12 04:35:38 -04:00

feedback.js

feat: add retention feedback loop and honest support matrix (#2681)

2026-08-04 21:42:25 -04:00

gan-harness.sh

fix: deny Playwright tools in non-browser evaluator modes

2026-09-28 00:38:00 -04:00

gemini-adapt-agents.js

fix: use scalar Claude agent tools (#2583)

2026-07-26 03:20:15 -07:00

github-coordination.js

refactor: apply code-review findings to github-native coordination

2026-06-11 14:05:42 -04:00

harness-adapter-compliance.js

docs: add data-backed harness adapter scorecard (#1785)

2026-05-12 02:59:52 -04:00

harness-audit.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

install-apply.js

fix: reconcile pre-exclusion .agents installs on claude and codex home upgrades

2026-09-18 20:13:11 -04:00

install-guided.js

feat(install): require an explicit hook decision at the apply layer

2026-08-30 15:09:34 -04:00

install-plan.js

fix(install): ship ajv/sql.js with the plugin install bundle (#2822)

2026-09-07 16:26:10 -04:00

ito.js

fix(ito-compute): complete device auth lifecycle (#2706)

2026-08-07 14:53:13 -04:00

list-installed.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

loop-status.js

fix: handle dotted reserved snapshot names

2026-04-30 12:25:14 -04:00

mcp-inventory.js

feat: MCP inventory (ecc.mcp.v1) — unified cross-harness MCP config view (#2146)

2026-06-06 03:55:17 +08:00

memory-mcp.mjs

Merge pull request #3111 from Fibilisim-Tekno/fix/memory-initialized-metadata

2026-09-19 16:51:53 -04:00

memory.js

feat: add cross-harness memory vault (#2581)

2026-07-26 02:46:59 -07:00

nasiko.js

fix(release): stage ECC 2.2 launch safely

2026-08-25 17:19:45 -04:00

observability-readiness.js

security: add supply-chain IOC scanner (#1904)

2026-05-14 21:15:35 -04:00

operator-readiness-dashboard.js

docs: sync live native payments gate evidence

2026-05-19 23:25:38 -04:00

orchestrate-codex-worker.sh

fix(worker,installer,claw): correct approval flag, installer order, percent path hardening

2026-09-14 23:52:01 +05:30

orchestrate-worktrees.js

fix: preserve orchestration launcher compatibility

2026-03-12 15:40:25 -07:00

orchestration-status.js

feat: orchestration harness, selective install, observer improvements

2026-03-14 12:55:25 -07:00

plan-canvas.js

fix(plan-canvas): describe browser dispatch accurately

2026-09-28 01:38:53 -04:00

platform-audit.js

docs: sync selected-target announcement gate (#2020)

2026-05-19 22:09:45 -04:00

preview-pack-smoke.js

docs: sync selected-target announcement gate (#2020)

2026-05-19 22:09:45 -04:00

profile.js

feat(profiles): add opt-in Lean/Full and hybrid Auto selection

2026-09-27 16:46:07 -04:00

proximity-tick.js

feat(layer4): live messages-table wiring for proximity triggers

2026-06-20 20:49:17 -04:00

release-approval-gate.js

fix(release): derive approval gate paths from version (#2383)

2026-06-29 15:50:55 -07:00

release-video-suite.js

fix(release): derive video suite paths from version (#2384)

2026-06-29 15:50:57 -07:00

release.sh

fix(release): bind trusted checks and signed tag identity on current main

2026-09-27 22:48:51 -04:00

repair.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

session-inspect.js

feat: self-improving skills loop — observe, inspect, amend, evaluate

2026-03-14 23:21:18 -07:00

sessions-cli.js

fix(scripts): add os.homedir() fallback for Windows compatibility

2026-03-28 11:28:12 +08:00

setup-package-manager.js

fix: reject flags passed as package manager names in setup-package-manager CLI

2026-02-13 03:37:46 -08:00

setup.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

skill-create-output.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

skills-health.js

feat(design): skill health dashboard mockup (#518)

2026-03-16 14:01:41 -07:00

status.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

sync-ecc-to-codex.sh

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

uninstall.js

fix(install): preserve user files and honor uninstall previews

2026-09-07 16:40:47 -04:00

welcome.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

work-items.js

feat(control-pane): interactive JIT board — claim/move cards from the webapp

2026-06-18 18:16:46 -04:00

worktree-lifecycle.js

feat: worktree-lifecycle service (deterministic conflict prediction + safe GC) (#2164)

2026-06-07 13:00:08 +08:00