External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): disposition all 104 code-scanning + dependabot alerts (#375)

Browse Source 
Fix the 4 real CodeQL path-injection alerts (open_conventions_pr trusted the
API-settable project.workspace_path with no containment) plus defense-in-depth
segment validation at the get_workspace_path chokepoint. Bump next 16.1.1->16.1.7
and transitive lockfile deps to clear 24 Dependabot alerts. Close the intake
subagent-ban gap: the Claude intake driver still carried the Task tool and the
prompter prompt told it to fan out research subagents, contradicting the
fleet-wide ban. The remaining 47 CodeQL + 29 Dependabot alerts are dismissed on
GitHub with per-alert justifications (guard patterns CodeQL can't model across
call hops; next 16.2.x blocked by the verified tab-hostage router regression).

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This commit is contained in:
Renzo F
2026-07-10 00:15:04 +02:00
committed by GitHub
co-authored by Renn F
parent 0450ec9e89
commit 7be725cc13
12 changed files with 438 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/agent_sdk/test_intake_driver.py
+18
View File
@@ -14,6 +14,7 @@ from typing import TYPE_CHECKING
import pytest
from roboco.agent_sdk.intake_driver import (
_INTAKE_BASE_TOOLS,
IntakeDriver,
StreamChunk,
normalize,
@@ -408,3 +409,20 @@ async def test_driver_denies_prompt_injection_without_sending() -> None:
assert "prompt-injection" in collected[0].text
assert collected[-1].kind == "text"
assert collected[-1].text == "ok"
# ---------------------------------------------------------------------------
# Fleet-wide subagent ban (CEO, 2026-07-09)
# ---------------------------------------------------------------------------
def test_intake_base_tools_carry_no_subagent_tool() -> None:
"""The intake allowlist is read-only built-ins ONLY — no ``Task``.
The fleet-wide subagent ban includes the intake interviewer: it reads the
codebase directly instead of fanning out research subagents (observed
live: intake stalled the interview waiting on seven Task spawns). Both
``allowed_tools`` and the ``can_use_tool`` gate derive from this tuple,
so pinning the literal pins the ban on the Claude path.
"""
assert _INTAKE_BASE_TOOLS == ("Read", "Grep", "Glob")