Skip to content

feat: effect-based danger classifier and hardening - #237

Merged
jkyberneees merged 2 commits into
mainfrom
hardening-fix
Sep 13, 2026
Merged

jkyberneees merged 2 commits into
mainfrom
hardening-fix

Conversation

@jkyberneees

Copy link
Copy Markdown
Contributor

Summary

  • Classify shell commands by effect so routine compile, format, inspect, and reversible local work allow, while hard-to-undo mutations still prompt or deny.
  • Close remaining fail-closed gaps: path hijacks, home credential files, persist/recoverability, and IPI/injection scan coverage.
  • Expand the known-command surface (toolchains, archives, docker/podman, brew/apt inspect vs install, kubectl/helm/terraform) so everyday agent work is no longer unknown → deny.

Test plan

  • go test -count=1 ./internal/danger/
  • Targeted cmd/odek classifier / security-report tests
  • CI green on this PR

Made with Cursor

jkyberneees and others added 2 commits September 13, 2026 21:09
Close fail-closed gaps (path hijacks, credential homes, persist/recoverability)
while keeping reversible local work (git porcelain, cargo/go test, docker
inspect, archives, ln/kill) off the prompt path so approval stays reserved
for hard-to-undo mutations.

Co-authored-by: Cursor <cursoragent@cursor.com>
Stop denying everyday compile, format, and inspect work as unknown,
and split brew/apt/kubectl/terraform inspect from mutating verbs so
approval stays reserved for hard-to-undo changes.

Co-authored-by: Cursor <cursoragent@cursor.com>
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
odek b8dfe75 Commit Preview URL

Branch Preview URL
Sep 13 2026, 08:32 PM

@jkyberneees
jkyberneees merged commit 4bea4ec into main Sep 13, 2026
10 checks passed
@jkyberneees
jkyberneees deleted the hardening-fix branch September 13, 2026 20:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant