claw-code-parity

odium/claw-code-parity

Fork 0

...

Author	SHA1	Message	Date
YeonGyu-Kim	0a03f12432	feat: add bashPermissions, bashSecurity, shouldUseSandbox — complete 9/9 bash validation submodules - bashPermissions: CommandPermissionRule + BashPermissionPolicy with allow/deny list matching (exact and prefix patterns) - bashSecurity: check_security() detects embedded credentials, dangerous env vars (LD_PRELOAD, DYLD_INSERT_LIBRARIES), and shell injection in data-passing commands - shouldUseSandbox: command-aware sandbox decision based on CommandIntent classification and SandboxConfig - Pipeline extended: validate_command() now runs security checks as step 5 - 19 new tests (51 total), all passing - fmt/clippy clean	2026-04-03 14:57:22 +09:00
Jobdori	36dac6cbbe	feat: add bash validation submodules — readOnlyValidation, destructiveCommandWarning, modeValidation, sedValidation, pathValidation, commandSemantics Ports 6 of 9 upstream BashTool validation submodules: - readOnlyValidation: blocks write/state-modifying commands in read-only mode - destructiveCommandWarning: flags dangerous commands (rm -rf /, fork bombs, etc.) - modeValidation: enforces permission mode constraints on commands - sedValidation: blocks sed -i in read-only mode - pathValidation: detects directory traversal and home dir escapes - commandSemantics: classifies command intent (read-only, write, destructive, network, etc.) Full validation pipeline: validate_command() runs all checks in priority order. 32 new tests covering all validation paths. Remaining bash submodules for separate lane: bashPermissions, bashSecurity, shouldUseSandbox	2026-04-03 13:54:05 +09:00

Author

SHA1

Message

Date

YeonGyu-Kim

0a03f12432

feat: add bashPermissions, bashSecurity, shouldUseSandbox — complete 9/9 bash validation submodules

- bashPermissions: CommandPermissionRule + BashPermissionPolicy with
  allow/deny list matching (exact and prefix patterns)
- bashSecurity: check_security() detects embedded credentials, dangerous
  env vars (LD_PRELOAD, DYLD_INSERT_LIBRARIES), and shell injection in
  data-passing commands
- shouldUseSandbox: command-aware sandbox decision based on CommandIntent
  classification and SandboxConfig
- Pipeline extended: validate_command() now runs security checks as step 5
- 19 new tests (51 total), all passing
- fmt/clippy clean

2026-04-03 14:57:22 +09:00

Jobdori

36dac6cbbe

feat: add bash validation submodules — readOnlyValidation, destructiveCommandWarning, modeValidation, sedValidation, pathValidation, commandSemantics

Ports 6 of 9 upstream BashTool validation submodules:
- readOnlyValidation: blocks write/state-modifying commands in read-only mode
- destructiveCommandWarning: flags dangerous commands (rm -rf /, fork bombs, etc.)
- modeValidation: enforces permission mode constraints on commands
- sedValidation: blocks sed -i in read-only mode
- pathValidation: detects directory traversal and home dir escapes
- commandSemantics: classifies command intent (read-only, write, destructive, network, etc.)

Full validation pipeline: validate_command() runs all checks in priority order.
32 new tests covering all validation paths.

Remaining bash submodules for separate lane: bashPermissions, bashSecurity, shouldUseSandbox

2026-04-03 13:54:05 +09:00

2 changed files with 1403 additions and 0 deletions

1402

rust/crates/runtime/src/bash_validation.rs Normal file

View file

File diff suppressed because it is too large Load diff

									
										1

rust/crates/runtime/src/lib.rs
									
										View file
										
				@ -1,4 +1,5 @@

				mod bash;

				pub mod bash_validation;

				mod bootstrap;

				mod compact;

				mod config;

Compare commits

2 commits

main ... jobdori/ba

1402

rust/crates/runtime/src/bash_validation.rs Normal file

View file

1

rust/crates/runtime/src/lib.rs

View file

Rows
Columns

Compare commits

2 commits main ... jobdori/ba

1402 rust/crates/runtime/src/bash_validation.rs Normal file View file

1 rust/crates/runtime/src/lib.rs Unescape Escape View file

2 commits

main ... jobdori/ba

1402

rust/crates/runtime/src/bash_validation.rs Normal file

View file

1

rust/crates/runtime/src/lib.rs

View file