fix(security): harden context, dry-run, manifest, and glob handling#488

Open

toshtag wants to merge 61 commits into

mainfrom

fix/security-hardening-bd84281

Commits on Jun 19, 2026

fix(security): harden context, dry-run, manifest, and glob handling
toshtag
committed
fix(security): map manifest symlink escape to a clean error; surface divergent install files
toshtag
committed
fix(security): contain planning-prompt grounding reads to the project root
toshtag
committed
fix(security): tag path-safety escapes and keep decision gates fail-closed
toshtag
committed
fix(security): map malformed / schema-invalid adapter manifests to a clean error
toshtag
committed
fix(security): fail-closed adapter install/upgrade (ordering, placeholder mkdir, CLI mapping)
toshtag
committed
fix(security): contain the agent-profile path to the project root
toshtag
committed
fix(security): preflight all adapter write paths before the --model pin
toshtag
committed
fix(security): detect dangling symlinks in resolveWithinProject
toshtag
committed
fix(security): unify matchGlob/globToRegex semantics for adjacent doublestar
toshtag
committed
fix(security): refuse dangling symlinks in resolveWithinProject (write-safe preflight)
toshtag
committed
fix(security): clean up the atomic temp file on a mid-write failure
toshtag
committed
fix(glob): true matchGlob/globToRegex parity (escape '?', match newlines)
toshtag
committed
fix(security): map attacker-input read failures to structured errors, not exit 3
toshtag
committed
fix(security): typed adapter write preflight (reject wrong on-disk type before the pin)
toshtag
committed
fix(security): contain loadPhase / loadRoadmap reads to the project root
toshtag
committed
fix(security): stop forged manifest+profile from overwriting arbitrary project files
toshtag
committed
chore(security): add a fast static fs-containment tripwire (local hook engine)
toshtag
committed
fix(security): structure loadPhase/loadRoadmap errors and map them in pack
toshtag
committed
fix(security): authorize adapter overwrite/prune by canonical identity, not lexical path
toshtag
committed
fix(security): route every roadmap read through the contained loadRoadmap + map CONFIG_ERROR
toshtag
committed
fix(security): contain the model-profiles dir; give refusals a correct, machine-readable reason
toshtag
committed
chore(security): fs-containment tripwire catches multiline fsfn(\n join(...))
toshtag
committed
fix(security): contain the PlanState family's roadmap/phase reads
toshtag
committed
docs(cli): fix adapter --force / --accept-modified help (was backwards)
toshtag
committed
fix plan-state config error handling
toshtag
committed
test decision retire roadmap containment
toshtag
committed
fix design write containment
toshtag
committed
fix remaining fs containment reads
toshtag
committed
fix(security): reject unowned design writes
toshtag
committed
fix(security): preflight init owned namespaces
toshtag
committed
fix(security): own progress ledger paths
toshtag
committed
fix(security): own archive mutation paths
toshtag
committed
test(security): cover owned symlink refusals
toshtag
committed

Commits on Jun 20, 2026