Repository navigation
damage-control: class-C narrow mitigations (rows 20/22/24-27) - #1148
Merged
Merged
Conversation
dotdevdotdev
added a commit
that referenced
this pull request
Oct 19, 2026
…ath expression (#1148 review) Program text only from -c/-e or an interpreter heredoc; the control word must sit in the sink's path expression; memory/wiki/artifacts exempt; reads never fire; receiver/getattr/non-literal-mode/heredoc-program sinks now covered. Audit replay: 6853 commands, 1 new ask. Docs/test claims corrected. Built by dotdev.dev
dotdevdotdev
force-pushed
the
dc-classc
branch
from
October 19, 2026 12:16
d807646 to
5e50b80
Compare
dotdevdotdev
added a commit
that referenced
this pull request
Oct 19, 2026
…ring data (#1148 review 2) The agent-owned exemption no longer applies to an expression that can climb out of it. Adds File.open/new, io/codecs/os.open, createWriteStream, openSync, fopen, php -r, archive extraction sinks. Calls quoted as data are not calls. Docs: replay count and residuals corrected. Built by dotdev.dev
dotdevdotdev
added a commit
that referenced
this pull request
Oct 19, 2026
…ath expression (#1148 review) Program text only from -c/-e or an interpreter heredoc; the control word must sit in the sink's path expression; memory/wiki/artifacts exempt; reads never fire; receiver/getattr/non-literal-mode/heredoc-program sinks now covered. Audit replay: 6853 commands, 1 new ask. Docs/test claims corrected. Built by dotdev.dev
dotdevdotdev
added a commit
that referenced
this pull request
Oct 19, 2026
…ring data (#1148 review 2) The agent-owned exemption no longer applies to an expression that can climb out of it. Adds File.open/new, io/codecs/os.open, createWriteStream, openSync, fopen, php -r, archive extraction sinks. Calls quoted as data are not calls. Docs: replay count and residuals corrected. Built by dotdev.dev
dotdevdotdev
force-pushed
the
dc-classc
branch
from
October 19, 2026 12:40
4085529 to
e0a8fb0
Compare
dotdevdotdev
added a commit
that referenced
this pull request
Oct 19, 2026
…review 3) Exempt only ONE static path literal (optionally in expanduser/Path) that lies inside the agent-owned dir on a whole segment; any non-literal piece, or a chdir in a program naming the control plane, means no exemption. Replaces the '..' spelling denylist. Built by dotdev.dev
- inline interpreter writing to a run-time-computed path while naming the control plane asks (unverifiable) - existing aliases reached through a literal `cd <dir> &&` are resolved - non-bash hooks get the SIGALRM scan deadline; every hook gets a watchdog thread that blocks before the harness timeout - `agentwire doctor` "Residuals you own" (informational) + wiki table of closed / fail-closed / user-owned - rows 20 (brace cap) and in-command `ln` verified already closed; pinned Built by dotdev.dev
…ath expression (#1148 review) Program text only from -c/-e or an interpreter heredoc; the control word must sit in the sink's path expression; memory/wiki/artifacts exempt; reads never fire; receiver/getattr/non-literal-mode/heredoc-program sinks now covered. Audit replay: 6853 commands, 1 new ask. Docs/test claims corrected. Built by dotdev.dev
…ring data (#1148 review 2) The agent-owned exemption no longer applies to an expression that can climb out of it. Adds File.open/new, io/codecs/os.open, createWriteStream, openSync, fopen, php -r, archive extraction sinks. Calls quoted as data are not calls. Docs: replay count and residuals corrected. Built by dotdev.dev
…review 3) Exempt only ONE static path literal (optionally in expanduser/Path) that lies inside the agent-owned dir on a whole segment; any non-literal piece, or a chdir in a program naming the control plane, means no exemption. Replaces the '..' spelling denylist. Built by dotdev.dev
dotdevdotdev
force-pushed
the
dc-classc
branch
from
October 19, 2026 13:17
1447a59 to
98c1cc2
Compare
dotdevdotdev
marked this pull request as ready for review
October 19, 2026 13:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Class-C residuals: fail closed on the unknowable shape; document the rest honestly.
-c/-e(or heredoc fed to one) whose write/exec sink takes a non-literal path expression that itself names.agentwire/.claude/damagecontrol/settings.json-> ask (unverifiable). Control words elsewhere (comments, printed/written data, argv), reads, literal paths and.claude/projects/*/memory,.agentwire/wiki|artifactsdo not fire. Audit replay (6853 distinct commands): 1 new ask (a scratch-dir script writingS+"/ks/damagecontrol.yml"). An earlier, looser version produced 5.cd <dir> &&. In-commandlnand existing-alias realpath predate this PR (pinned, guard nothing new).agentwire doctor"Residuals you own" (unscored) + wiki table.Declared residual: a control word split across a variable assigned elsewhere in the program.
Built by dotdev.dev