0dbdf994b3
feat(macos): isolate named app profiles ( #121136 )
...
* feat(macos): isolate named app profiles
* refactor(macos): isolate profile launch ownership
* fix(macos): avoid overlapping approvals socket access
* fix(macos): declare profile defaults concurrency ownership
* fix(macos): return profiled node launch arguments
* chore(i18n): refresh macOS profile source inventory
* fix(macos): gate profile startup before services
* test(macos): evaluate profile state before assertions
* fix(daemon): skip absent launchd deactivation
* fix(macos): fail closed on profile port conflicts
* chore(i18n): refresh profile conflict inventory
* fix(macos): ignore non-gateway launch agent claims
* test(macos): stabilize profile lifecycle timing
* fix(macos): remove stale dashboard URL
* chore(macos): refresh native source baseline
2026-08-09 14:50:15 -07:00
a8f8fd3256
fix(macos): prevent shared state in parallel test suites ( #120912 )
...
* fix(macos): isolate parallel test state
* chore(i18n): refresh native source inventory
2026-08-08 23:03:20 -07:00
1d57a4989b
fix(mac): stop repeated exec approvals migration retries ( #115502 )
...
* fix(mac): classify exec-approvals migration errors and stop retry storm
* fix(mac): refresh native i18n inventory
2026-07-29 01:09:22 -04:00
9eae43bd37
refactor(infra): move exec approvals into the shared SQLite state DB ( #114063 )
...
* refactor(infra): move exec approvals into the shared SQLite state DB
Delete the file-runtime exec-approvals store (exec-approvals.json + .lock
sidecar machinery) on both runtimes and make the reserved
exec_approvals_config singleton row canonical. Doctor owns the one-time
import with claim/verify/receipt discipline; runtime fails closed with a
doctor instruction while un-migrated legacy state exists. The wire CAS
contract, socket semantics, and gateway auth-token derivations are
unchanged. Kills the #113929 lock-contention bug class structurally and
nets around -2.9k lines.
* fix(infra): green CI gates and retire file-era exec approvals tests
Break the migration-type import cycle with a leaf contract, regenerate the
plugin-SDK API and native i18n baselines for the intentional surface change,
drop unused exports, and replace the macOS file-era approvals test suite with
SQLite-backed behavior coverage per the obsolete-internals test policy.
* chore: green max-lines ratchet, native i18n baseline, and unused-export scan
2026-07-26 06:39:23 -04:00
1fc81c2054
fix: reusable exec approvals apply to approved arguments ( #112946 )
...
* fix: bind allow-always exec approvals to argv
* test: update exec approval persistence expectations
* fix: hash reusable exec approval arguments
* test: pin POSIX exec approval hash expectation
* fix: match hashed exec approvals in macOS
* fix: encode exec approval argv hashes unambiguously
* fix: bind native exec approval grants to argv
* test: expect hashed exec approval patterns
* fix: ignore legacy broad exec approval grants
* fix: hash shell script allow-always grants
* fix: require argv binding for package manager grants
* fix: bind positional carrier approval grants
* fix: address approval check failures
* fix: format approval policy test
* fix: reject context-changing package manager grants
* fix: keep build-enabled pnpm dlx grants one-shot
* fix: reject npm exec context grants
* fix: catch npm exec tail context options
* fix: block npm package context approvals
* fix: block leading pnpm dlx context grants
* fix: restrict durable positional carrier grants
* docs: clarify generated exec approvals
* fix: block post-dlx pnpm context grants
2026-07-24 15:38:38 +05:30
8fe4eeea9e
fix(exec): stop isolated state dirs from moving live approvals ( #108742 )
...
* fix(exec): isolate approval state directories
* chore: drop release-owned changelog entry
* chore: refresh native i18n inventory
* fix(ci): pin XcodeGen for Periphery scans
2026-07-16 08:57:32 -07:00
2264816f1d
ci(macos): add enforced periphery dead-code lane and delete the 12 current findings ( #105743 )
...
* refactor(macos): delete dead code flagged by periphery
* ci(macos): add enforced periphery dead-code lane
* fix(ci): scope-label the periphery skip message
* chore(i18n): sync native inventory line coordinates
2026-07-12 16:39:15 -07:00
da4a480089
chore(apps): remove more dead code
2026-07-12 00:58:32 -07:00
96f0983a85
fix(onboarding): skip setup for configured gateways and require inference first ( #102883 )
...
* fix(crestodian): keep onboarding RPCs restart-safe
* fix(profiles): isolate approval state migrations
* fix(crestodian): bypass configured gateway setup
* test(crestodian): type onboarding mocks
* fix(onboarding): require inference before Crestodian
* fix(onboarding): enforce verified inference handoff
* fix(macos): reset setup on gateway endpoint edits
* chore(i18n): refresh native source inventory
* fix(gateway): keep socket on request cancellation
* test(packaging): require workspace templates
* fix(onboarding): bind setup to verified inference
* fix(onboarding): align inference gate contracts
* fix(crestodian): classify concurrent policy rejection
* test(crestodian): expect registry restoration
* fix(onboarding): bind setup to configured gateways
* fix(codex): preserve startup phase deadlines
* test(crestodian): match fail-closed policy ordering
* test(onboarding): assert bound gateway handoff
* fix(codex): bind runtime resolution to spawn cwd
* test(crestodian): assert policy rejection order
* fix(cli): preserve gateway routing across restarts
* fix(macos): fail closed during gateway edits
* test(macos): cover gateway route generation races
* chore: keep release notes out of onboarding PR
* fix(ci): refresh onboarding generated checks
* style(swift): align gateway channel formatting
* fix(ci): refresh plugin SDK surface budgets
* fix(ci): resync native string inventory
* refactor(swift): split gateway channel support
* test(doctor): isolate plugin compatibility registry
* test(macos): isolate gateway onboarding fixtures
* test(macos): assert gateway lease health ordering
* fix(codex): reconcile computer-use startup changes
2026-07-11 10:25:14 -07:00
df067770d7
fix(mac): deflake exec-approvals socket guard test and create state dir with 0700 directly ( #104028 )
2026-07-10 18:07:35 -07:00
3ec2a50d6c
fix(exec): prevent revoked policy from authorizing delayed node runs ( #103950 )
...
* fix(cli): fail closed on exec policy rollback races
* refactor(cli): reuse canonical exec policy ordering
* fix(exec): bind delayed approvals to prepared policy
* fix(macos): revalidate delayed exec approvals
* fix(exec): align approval snapshot validation gates
2026-07-11 01:37:37 +01:00
d92d5774f5
fix(node): report Mac exec policy defaults ( #103945 )
2026-07-10 22:07:44 +01:00
9b1c36d23c
fix: prevent exec approval revocation races ( #103515 )
...
* fix(security): serialize exec approval mutations
* fix(security): preserve additive approval writes
* test(cli): expect normalized approval shape
* fix(security): preserve exec approval compatibility
* test(security): exercise locked approval initialization
* test(security): mock serialized approval helpers
* test(exec): derive enforced command path from plan
* fix(gateway): always return approval CAS conflicts
* fix(macos): serialize exec approvals writes
* fix(security): repair approval build errors
* fix(security): serialize exec approval mutations
* fix(security): fail closed on approval persistence errors
* test(security): cover detached approval persistence failures
* fix(security): harden exec approval state
* style(macos): format exec approval sources
* fix(security): complete exec approval hardening
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* fix(macos): preserve approved login-shell semantics
* fix(macos): keep login shell approvals one-shot
* fix(security): linearize exec authorization
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* fix(security): preserve durable approval basis
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* fix(security): bind exec grants to current policy
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
* test(security): fix exec revocation fixtures
* test(security): align gateway approval fixtures
* fix(macos): return approval decisions
* chore(i18n): sync native approval strings
* test(security): align approval hardening fixtures
* test(node): authorize completed event fixture
* test(security): fix approval decision fixtures
* test(security): await durable approval visibility
* fix(exec): preserve concurrent approval grants
* fix(exec): address exact-head CI failures
* fix(exec): preserve concurrent approval promotions
* fix(exec): make Swift shutdown state explicit
* test(macos): handle approval read failures
* fix(macos): harden approval socket paths
* fix(macos): preserve exact shell payload bytes
* test(macos): make approval fixtures explicit
* test(macos): fix approval suite compilation
* fix(macos): bound approval socket JSONL reads
* chore: move exec approval note to release process
* chore: move exec approval note to release process
---------
Co-authored-by: Coy Geek <65363919+coygeek@users.noreply.github.com >
2026-07-10 21:35:05 +01:00
Peter Steinberger