Security/harden shell cicd#211

Open

vlad-activeloop wants to merge 20 commits into

mainfrom

security/harden-shell-cicd

Commits on Jun 1, 2026

edits
vlad-activeloop
committed
guide unroutable/unconfigured memory commands instead of host passthrough, tighten isSafe allowlist, drop codex just-bash fallback
vlad-activeloop
committed

Commits on Jun 2, 2026

drop sed/awk from VFS retry guidance — they're no longer in the isSafe allowlist
vlad-activeloop
committed
deny unserviceable Read instead of command-shaped guidance (Read needs file_path, not command)
vlad-activeloop
committed
codex: block unsafe memory commands instead of guide — guide exits 0 and lets them run on the host
vlad-activeloop
committed
pin npx/unknown manual-install messages to the verified version instead of @latest
vlad-activeloop
committed
rewrite only the memory-path argument in the interpreter fast-path, not the first absolute token (was leaking host files like /etc/hosts)
vlad-activeloop
committed
anchor the find -name matcher to the exact supported shape so suffixes like -delete/-o fall through to guidance
vlad-activeloop
committed
assert the npm-install-failure manual hint is pinned, not @latest
vlad-activeloop
committed
set persist-credentials:false on read-only checkout jobs so GITHUB_TOKEN isn't left in .git/config
vlad-activeloop
committed
match the memory mount on path boundaries so siblings like memory-backup aren't intercepted
vlad-activeloop
committed
pin clawhub CLI to 0.18.0 before it consumes CLAWHUB_TOKEN
vlad-activeloop
committed
stop rewriting interpreter reads to a host cat (leaked host files via path traversal) and emit file_path for Read directory listings
vlad-activeloop
committed