6 Commits

Author	SHA1	Message	Date
Peter Steinberger	b02b94673f	refactor: dedupe runtime and helper flows	2026-03-02 12:55:47 +00:00
Peter Steinberger	155118751f	refactor!: remove versioned system-run approval contract	2026-03-02 01:12:53 +00:00
Peter Steinberger	07f653ffc8	fix: polish bare wildcard allowlist handling (#25250) (thanks @widingmarcus-cyber)	2026-02-24 14:20:11 +00:00
Marcus Widing	0f0b2c0255	fix(exec): match bare * wildcard in allowlist entries (#25082) ... The matchAllowlist() function skipped patterns without path separators (/, \, ~), causing a bare "*" wildcard entry to never reach the glob matcher. Since glob's single * maps to [^/]*, it would also fail against absolute paths. Handle bare "*" as a special case that matches any resolved executable path. Closes #25082	2026-02-24 14:20:11 +00:00
Peter Steinberger	a1c4bf07c6	fix(security): harden exec wrapper allowlist execution parity	2026-02-24 01:52:17 +00:00
Peter Steinberger	862975507a	refactor(exec): split command resolution and trusted-dir normalization	2026-02-22 23:00:33 +01:00