CI

ci.yml

2500+ workflow runs

claude_code shell guard: program-level output-file handlers (sort -o, uniq, git --output, tee, time -o) tag /dev/null as output-redirect while shell redirection exempts it (CodeRabbit Minor on #3947, pre-existing class on dev)
completed successfully:
CI#9210:Pull request#3950openedbyjaylfc
exec/tsk-sggrai
Oct 24, 202637m 35s
Merge pull request #3949 from jaylfc/exec/tsk-apy6di
completed successfully:
CI#9209:Commit6dfac4bpushedbyjaylfc
dev
Oct 24, 202634m 10s
Orb core: Agent Buddy UDP 4666 discovery probe in tinyagentos/orb/discovery.py (spec s1/s5 R3 bridge)
completed successfully:
CI#9208:Pull request#3948synchronizebyjaylfc
exec/tsk-4hzmaf
Oct 24, 202636m 44s
claude_code shell guard: time clustered short options (-ao FILE, -po FILE, -af FMT) drop the wrapped program so a profile deny rule on it is bypassed (pre-existing on dev, found in the lead review of #3947)
completed successfully:
CI#9207:Pull request#3949synchronizebyjaylfc
exec/tsk-apy6di
Oct 24, 202639m 8s
claude_code shell guard: time clustered short options (-ao FILE, -po FILE, -af FMT) drop the wrapped program so a profile deny rule on it is bypassed (pre-existing on dev, found in the lead review of #3947)
cancelled:
CI#9206:Pull request#3949openedbyjaylfc
exec/tsk-apy6di
Oct 24, 202624m 23s
Merge pull request #3947 from jaylfc/exec/tsk-ewkvsx
completed successfully:
CI#9205:Commit3864e13pushedbyjaylfc
dev
Oct 24, 202629m 55s
claude_code shell guard: tag time -o/--output and tee FILE writes as output-redirect so profile deny rules see program-level file writes (CodeRabbit Major on #3946, pre-existing on dev)
completed successfully:
CI#9204:Pull request#3947synchronizebyjaylfc
exec/tsk-ewkvsx
Oct 24, 202636m 29s
Orb core: Agent Buddy UDP 4666 discovery probe in tinyagentos/orb/discovery.py (spec s1/s5 R3 bridge)
completed successfully:
CI#9203:Pull request#3948openedbyjaylfc
exec/tsk-4hzmaf
Oct 24, 202628m 25s
claude_code shell guard: tag time -o/--output and tee FILE writes as output-redirect so profile deny rules see program-level file writes (CodeRabbit Major on #3946, pre-existing on dev)
cancelled:
CI#9202:Pull request#3947openedbyjaylfc
exec/tsk-ewkvsx
Oct 24, 202632m 0s
Merge pull request #3946 from jaylfc/exec/tsk-gdxqyz
completed successfully:
CI#9201:Commit74dd1d6pushedbyjaylfc
dev
Oct 24, 202636m 39s
fix-forward #3945 (tsk-bmcphm): claude_code shell guard misses gh behind time -f/-o and xargs --process-slot-var, env clustered-S detection eats the next word (CodeRabbit on 7ce599571, all pre-existing on dev)
completed successfully:
CI#9200:Pull request#3946openedbyjaylfc
exec/tsk-gdxqyz
Oct 24, 202631m 50s
Merge pull request #3945 from jaylfc/exec/tsk-bmcphm
completed successfully:
CI#9199:Commit218c0f6pushedbyjaylfc
dev
Oct 24, 202651m 19s
Merge pull request #3944 from jaylfc/exec/tsk-jreuii
completed successfully:
CI#9198:Commit306d39dpushedbyjaylfc
dev
Oct 24, 202631m 29s
fix-forward #3941 (tsk-jaxit5): claude_code guard fails OPEN on an unparseable command ("${HOME}" in double quotes), env -iS clusters and sudo/env long value options still hide g""h (CodeRabbit Majors, measured pre-existing)
completed successfully:
CI#9197:Pull request#3945synchronizebyjaylfc
exec/tsk-bmcphm
Oct 24, 202629m 1s
CI
failed:
CI#9196:Scheduled
master
Oct 24, 202612m 57s
fix-forward #3941 (tsk-jaxit5): claude_code guard fails OPEN on an unparseable command ("${HOME}" in double quotes), env -iS clusters and sudo/env long value options still hide g""h (CodeRabbit Majors, measured pre-existing)
completed successfully:
CI#9195:Pull request#3945synchronizebyjaylfc
exec/tsk-bmcphm
Oct 24, 202639m 34s
fix-forward #3941 (tsk-jaxit5): claude_code guard fails OPEN on an unparseable command ("${HOME}" in double quotes), env -iS clusters and sudo/env long value options still hide g""h (CodeRabbit Majors, measured pre-existing)
cancelled:
CI#9194:Pull request#3945openedbyjaylfc
exec/tsk-bmcphm
Oct 24, 20266m 53s
fix-forward #3943 (tsk-4wadcj): agent reply route returns 500 when the channel lookup raises or channel_id is not a string (CodeRabbit Minor, introduced by #3940, untouched by #3943)
completed successfully:
CI#9193:Pull request#3944openedbyjaylfc
exec/tsk-jreuii
Oct 24, 202636m 28s
fix-forward #3942 (tsk-bnohyn): agent reply route returns 202 when the trace_id message lookup raises (CodeRabbit Major, pre-existing)
completed successfully:
CI#9192:Pull request#3943openedbyjaylfc
exec/tsk-4wadcj
Oct 24, 202629m 4s
fix-forward #3940 (tsk-wfkhb2): fail closed on registry errors and unknown channels in the agent reply route
completed successfully:
CI#9191:Pull request#3942openedbyjaylfc
exec/tsk-bnohyn
Oct 24, 202634m 15s
fix-forward #3939 (tsk-r3knpi): env -S split-string state leaks and sudo/env clustered value options still hide g""h from the hard refusal (CodeRabbit Majors on #3938 and #3939, measured)
completed successfully:
CI#9190:Pull request#3941openedbyjaylfc
exec/tsk-jaxit5
Oct 24, 202628m 10s
fix-forward #3772 (tsk-lwkv4t): guest agent chat reply can post into any channel; same-name agents share one session slug
completed successfully:
CI#9189:Pull request#3940synchronizebyjaylfc
exec/tsk-wfkhb2
Oct 24, 202634m 11s
fix-forward #3938 (tsk-zgkahd): hard gh refusal still bypassed by clustered short flags (exec -la NAME, sudo -Eu USER) and chroot --userspec/--groups with a separate value
completed successfully:
CI#9188:Pull request#3939openedbyjaylfc
exec/tsk-r3knpi
Oct 23, 202636m 39s
fix-forward #3934 (tsk-3siko5): hard gh refusal bypassed by chroot root operand, exec -a NAME, and env -S split strings (3 CodeRabbit security findings, measured on head d183ed709)
completed successfully:
CI#9187:Pull request#3938openedbyjaylfc
exec/tsk-zgkahd
Oct 23, 202653m 6s
Merge pull request #3937 from jaylfc/exec/tsk-3ldnu5
completed successfully:
CI#9186:Commitd6bafccpushedbyjaylfc
dev
Oct 23, 202637m 31s

Navigation Menu

CI

2500+ workflow runs

claude_code shell guard: program-level output-file handlers (sort -o, uniq, git --output, tee, time -o) tag /dev/null as output-redirect while shell redirection exempts it (CodeRabbit Minor on #3947, pre-existing class on dev)

Merge pull request #3949 from jaylfc/exec/tsk-apy6di

Orb core: Agent Buddy UDP 4666 discovery probe in tinyagentos/orb/discovery.py (spec s1/s5 R3 bridge)

claude_code shell guard: `time` clustered short options (`-ao FILE`, `-po FILE`, `-af FMT`) drop the wrapped program so a profile deny rule on it is bypassed (pre-existing on dev, found in the lead review of #3947)

claude_code shell guard: `time` clustered short options (`-ao FILE`, `-po FILE`, `-af FMT`) drop the wrapped program so a profile deny rule on it is bypassed (pre-existing on dev, found in the lead review of #3947)

Merge pull request #3947 from jaylfc/exec/tsk-ewkvsx

claude_code shell guard: tag `time -o/--output` and `tee FILE` writes as output-redirect so profile deny rules see program-level file writes (CodeRabbit Major on #3946, pre-existing on dev)

Orb core: Agent Buddy UDP 4666 discovery probe in tinyagentos/orb/discovery.py (spec s1/s5 R3 bridge)

claude_code shell guard: tag `time -o/--output` and `tee FILE` writes as output-redirect so profile deny rules see program-level file writes (CodeRabbit Major on #3946, pre-existing on dev)

Merge pull request #3946 from jaylfc/exec/tsk-gdxqyz

fix-forward #3945 (tsk-bmcphm): claude_code shell guard misses gh behind `time -f/-o` and `xargs --process-slot-var`, env clustered-S detection eats the next word (CodeRabbit on 7ce599571, all pre-existing on dev)

Merge pull request #3945 from jaylfc/exec/tsk-bmcphm

Merge pull request #3944 from jaylfc/exec/tsk-jreuii

fix-forward #3941 (tsk-jaxit5): claude_code guard fails OPEN on an unparseable command ("${HOME}" in double quotes), env -iS clusters and sudo/env long value options still hide g""h (CodeRabbit Majors, measured pre-existing)

CI

fix-forward #3941 (tsk-jaxit5): claude_code guard fails OPEN on an unparseable command ("${HOME}" in double quotes), env -iS clusters and sudo/env long value options still hide g""h (CodeRabbit Majors, measured pre-existing)

fix-forward #3941 (tsk-jaxit5): claude_code guard fails OPEN on an unparseable command ("${HOME}" in double quotes), env -iS clusters and sudo/env long value options still hide g""h (CodeRabbit Majors, measured pre-existing)

fix-forward #3943 (tsk-4wadcj): agent reply route returns 500 when the channel lookup raises or channel_id is not a string (CodeRabbit Minor, introduced by #3940, untouched by #3943)

fix-forward #3942 (tsk-bnohyn): agent reply route returns 202 when the trace_id message lookup raises (CodeRabbit Major, pre-existing)

fix-forward #3940 (tsk-wfkhb2): fail closed on registry errors and unknown channels in the agent reply route

fix-forward #3939 (tsk-r3knpi): env -S split-string state leaks and sudo/env clustered value options still hide g""h from the hard refusal (CodeRabbit Majors on #3938 and #3939, measured)

fix-forward #3772 (tsk-lwkv4t): guest agent chat reply can post into any channel; same-name agents share one session slug

fix-forward #3938 (tsk-zgkahd): hard gh refusal still bypassed by clustered short flags (exec -la NAME, sudo -Eu USER) and chroot --userspec/--groups with a separate value

fix-forward #3934 (tsk-3siko5): hard gh refusal bypassed by chroot root operand, exec -a NAME, and env -S split strings (3 CodeRabbit security findings, measured on head d183ed709)

Merge pull request #3937 from jaylfc/exec/tsk-3ldnu5

Workflow runs for CI

2500+ workflow runs