CodeWhale BotandCodeWhaleBot
e86d67711f
Hardening across the Engine, the bundled Computer Use plugin and the chat bridges. Each item reuses the existing authority instead of adding a second one. - Computer control: a consent or script call runs only on an exact decision a person gave on its own approval card; rules, autonomous postures, child agents and code-mode programs cannot produce one. The bundled plugin carries the matching consent, script, helper and SSH argument checks and known-host routing. - Git status and review: automatic status, worktree and log reads go through the sanitized review command, refuse unsupported runtime configuration overrides, and stay pinned to the executable that was checked. - Redaction: persisted config backups, config dumps, MCP listings and notification payloads share one sensitive-key vocabulary in codewhale-sanitize. - Recursive RLM: each round of Python a child model writes is admitted by the turn serving the direct `rlm` call, through the same planning and approval as an inline repl block, and runs only as admitted; `rlm` is not available inside execute_tools programs. Python kernels are discarded when the applied posture narrows. - Gate commands and the cargo test runner start inside the session's shell sandbox with the sanitized environment. - Chat bridges decide an approval only for the human who started that turn, on the Runtime's current pending approval, and consume a stored action only after delivery. Upgrade note: approvals for turns started before the upgrade are decided from the TUI; WeCom `/allow` no longer takes `remember`. - Mutable session artifacts are written through the pinned session-relative replace; the owned-artifact pager reads through the pinned open with a 64 MiB display cap. - The stdio bridge's Runtime child binds an ephemeral loopback port itself and reports it; the parent validates that report, never follows redirects with the bearer token, and reaps the child on a bad or late report. Known limits: Python kernels are approval-gated local subprocesses, not OS-sandboxed; where no enforcing sandbox is configured (Linux without bubblewrap, Windows) a workspace-write policy runs runners unsandboxed, as it already does for exec_shell; an approval wait counts against an RLM turn's deadline; verifier, plugin, hook and lane child processes are unchanged. Local macOS evidence on this exact tree: CI-policy Clippy on Rust 1.99, whole workspace, all targets: exit 0. Focused Rust selection: app-server 7 passed / 0 failed, config 7/0, sanitize 2/0, codewhale-tui 1346/0. Bridges: core 37/0, feishu 19/0, telegram 39/0, wecom 17/0, weixin 13/0. Computer Use plugin: 401 passed / 0 failed / 16 skipped. npm test: 75/0, 19/0, 63/0 with 1 skipped; check:web passes. With each new guard disabled in turn, its regression tests fail and pass again on the restored source. A native run confirmed the stdio parent reaches a real Runtime child through the endpoint the child reported. Hosted three-OS, shared-process and release-candidate results are still required for this head; no Linux or Windows native run is claimed. Co-authored-by: CodeWhaleBot <[email protected]> Signed-off-by: CodeWhale Bot <[email protected]>
2.7 KiB
Dependency maintenance
Reviewed against the 0.9.13 Core dependency graph on September 8, 2026. This records maintenance decisions, not a security clearance or release test.
The terminal Markdown renderer uses Syntect's embedded syntax and theme dumps
with the existing fancy-regex backend. It does not load external syntax YAML,
theme plists, or emit Syntect HTML. Selecting those features explicitly removes
the unused yaml-rust, plist, and quick-xml dependency path. The embedded
YAML language grammar remains available for highlighting YAML code blocks.
derivative, fxhash, paste, and ttf-parser are absent from the Core lockfile.
Their obsolete advisory exceptions are removed so a future reintroduction is
visible to the advisory checks. No cargo-audit advisory is ignored.
The remaining cargo-deny maintenance exception is
RUSTSEC-2025-0141
for bincode 1.3.3. Syntect 5.3.0 requires it to deserialize its compiled-in
syntax and theme assets and for its parser's internal lazy-context encoding.
Codewhale does not pass arbitrary external dump files to these loaders. The
maintenance warning remains visible in cargo-audit; the lack of an identified
exploit in this advisory does not guarantee safety.
Revisit the exception when upgrading or replacing Syntect, or before adding external dump, grammar, or theme loading. Remove it when the dependency leaves the graph. A replacement must preserve embedded language/theme coverage, multiline highlighting and error recovery, and pass the existing Markdown renderer tests with a resolver-verified lockfile. Adding ignores for new advisories requires a separate assessment.
The Apps desktop lockfile and its platform dependencies are a separate graph; this Core cleanup does not resolve their maintenance or GLib qualification work.
Automatic Git review and workspace polling require the runtime configuration override interface introduced in Git 2.31. The shared read authority probes the resolved absolute executable once per process and pins subsequent commands to that executable even if PATH changes. It refuses automatic reads if the executable cannot honor those overrides; explicit user Git writes retain their existing behavior. The porcelain-v1 display fallback does not waive this safety requirement. The absolute path fixes executable search selection; it does not authenticate an executable replaced at that path by the same local user.
Local fixtures cover native modern Git and an emulated executable that ignores runtime overrides. They do not qualify a real older-Git installation, partial clones, or all platform-specific Git behavior.