Repository navigation

fix(sandbox): deny reads of Zero credential stores - #681

Merged

kevincodex1 merged 26 commits into

Twigpine:mainfrom

PierrunoYT:agent/deny-zero-credential-reads

Aug 9, 2026

Commits on Jul 14, 2026
- fix(sandbox): deny reads of zero credential stores
  PierrunoYT
  committed
  51b2ea2
- fix(sandbox): address PR review comments
  
  PierrunoYT
  and
  claude
  committed
  0547046
Commits on Jul 15, 2026
- fix(sandbox): deny the whole Zero config dir, not itemized filenames
  
  PierrunoYT
  and
  claude
  committed
  43e81fd
Commits on Jul 17, 2026
- fix(sandbox): address macOS deny-path test and config parity
  
  cursoragent
  and
  PierrunoYT
  committed
  5b4f743
Commits on Jul 18, 2026
- fix(sandbox): harden credential deny paths
  PierrunoYT
  committed
  750328c
- test(cli): normalize credential deny baseline
  PierrunoYT
  committed
  c92e0ed
- fix(sandbox): close credential path gaps
  PierrunoYT
  committed
  63adeb4
- test(sandbox): normalize command credential path
  PierrunoYT
  committed
  5b4c216
Commits on Jul 19, 2026
- fix(sandbox): handle absent credential paths safely
  PierrunoYT
  committed
  9f8147e
- fix(sandbox): protect MCP OAuth siblings
  PierrunoYT
  committed
  b8e7a99
Commits on Jul 20, 2026
- fix(sandbox): protect OAuth lock siblings
  PierrunoYT
  committed
  800de12
- docs(sandbox): clarify Linux future-path limits
  PierrunoYT
  committed
  662770c
Commits on Jul 25, 2026
- Merge remote-tracking branch 'upstream/main' into agent/deny-zero-credential-reads
  PierrunoYT
  committed
  841088d
- test(sandbox): probe credential store reads in the Linux smoke test
  PierrunoYT
  committed
  46d071d
Commits on Jul 26, 2026
- fix(sandbox): keep the credential deny usable, current, and unguessable
  PierrunoYT
  committed
  0f6c87a
- Merge remote-tracking branch 'upstream/main' into agent/deny-zero-credential-reads
  ampagent
  committed
  07f99bf
- fix(sandbox): close credential deny review gaps
  
  ampagent
  and
  PierrunoYT
  committed
  a62bd8c
- fix(sandbox): normalize credential carveout paths
  
  ampagent
  and
  PierrunoYT
  committed
  e79b46b
- fix(sandbox): canonicalize backend credential masks
  
  ampagent
  and
  PierrunoYT
  committed
  083d6f0
- test(sandbox): normalize backend mask expectations
  
  ampagent
  and
  PierrunoYT
  committed
  497aeb5
Commits on Jul 27, 2026
- Merge upstream/main into credential deny-read hardening
  
  ampagent
  and
  PierrunoYT
  committed
  bf75c60
Commits on Jul 28, 2026
- fix(sandbox): fail closed for replaceable token stores
  
  ampagent
  and
  PierrunoYT
  committed
  f25b3e7
Commits on Jul 29, 2026
- Merge upstream/main into credential deny-read hardening, with review fixes
  
  PierrunoYT
  and
  claude
  committed
  64ca22e
Commits on Aug 1, 2026
- fix(sandbox): allow keyring token path overrides
  
  ampagent
  and
  PierrunoYT
  committed
  e106d06
- fix(sandbox): harden command credential roots
  
  ampagent
  and
  PierrunoYT
  committed
  56fa645
Commits on Aug 2, 2026
- fix(sandbox): close credential deny review gaps
  
  ampagent
  and
  PierrunoYT
  committed
  b14e659

Commits

Commits on Jul 14, 2026

Commits on Jul 15, 2026

Commits on Jul 17, 2026

Commits on Jul 18, 2026

Commits on Jul 19, 2026

Commits on Jul 20, 2026

Commits on Jul 25, 2026

Commits on Jul 26, 2026

Commits on Jul 27, 2026

Commits on Jul 28, 2026

Commits on Jul 29, 2026

Commits on Aug 1, 2026

Commits on Aug 2, 2026