You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by po...@apache.org on 2026/10/18 12:59:23 UTC
(magpie) branch perf/security-2-triage updated (6c5027ca -> 52530e0e)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a change to branch perf/security-2-triage
in repository https://gitbox.apache.org/repos/asf/magpie.git
discard 6c5027ca perf(security-issue-invalidate): decide and render the invalid close as code
discard 6667a62e perf(security-issue-triage): decide and render the triage rules as code
omit 7015ef31 fix(jira, local-tracker): explain the probe loop's ignored not-found
omit 0f55d316 fix(github-body-field): never take a quoted heading for a field
omit e69f455f fix(jira, local-tracker): read and write body fields through the one parser
omit 2fabaca3 fix(github-body-field): one parser for reading and writing, on the body-field contract's boundaries
omit f97e7810 fix(security-management): drop an implicit string concatenation flagged by CodeQL
omit 9e866d0a docs(security-issue-import): restore the recap-draft and parse-warning boundaries
omit a7be014c fix(generate-cve-json): attach after the last template field and state the DRAFT rule exactly
omit 1b012d4a fix(github-body-field): verify the rewritten body and keep CRLF spacing
omit 564c9c0a docs(spec-loop): sync specs with the security import split
omit 1e20e8fe fix(security-issue-sync): keep the record in DRAFT while required fields are unresolved
omit 812cc1aa fix(github-body-field): guard every field boundary and keep fenced payloads exact
omit dc2106c6 fix(generate-cve-json): find attachment markers only outside report text and verify fields survive an attach
omit b763d321 fix(github-body-field): match field names case-sensitively, as before
omit 5a7e3644 fix(github-body-field): strip any number of quote and list markers before a heading
omit 0618e449 fix(security-management): escape known-field headings in the inert block and unify body-field readers
omit 1fac6b54 fix(github-body-field): refuse ambiguous fields at the read and write layer, in linear time
omit 753d2fe2 fix(security-management): import the report as an inert fenced block, then verify the body
omit 37f67215 fix(github-body-field): fail closed on nested field headings instead of modelling lists
omit 12035db5 feat(security-issue-sync): propose missing or ambiguous CVE fields with the session's own model
omit 442dca0e fix(github-body-field): never take a heading inside a list item or block quote for a field
omit e984c53d fix(generate-cve-json): normalise the body before reading fields and refuse ambiguous duplicates cleanly
omit 246e86e2 feat(github-body-field): normalise tracker bodies into the shape every reader agrees on
omit eea22fcd perf(security-issue-import-from-scan): enforce the bucket rule and render the scan report as code
omit 805e6592 perf(security-issue-import-via-forwarder): decide preflight, detection and routing as code
omit 995d3928 fix(security-management): escape HTML openers anywhere in report text
omit e5fd7bd8 fix(security-management): resolve reply, ledger, dedup, recap and scope edge cases
omit c9f80337 fix(security-management): keep fenced headings and HTML blocks from overriding body fields
omit 7b7b0564 fix(security-management): defuse inside code spans and normalise line breaks before sanitising
omit de66b2ef perf(security-issue-import-from-md): parse and render the findings import as code
omit c3da5ce5 fix(security-management): fail closed on unsafe report text and pair code fences strictly
omit ac168a08 perf(security-issue-import-from-pr): decide and render the PR import as code
omit fc804f57 perf(security-issue-import): decide and render the import as code
add 1d773a87 fix(sandbox-lint): refuse wholesale weakenings and keep the vetted-ops checkout read-only (#1693)
add 76cc6e8e perf(security): decide and render the five import skills as code, and read tracker fields through one normaliser (#1680)
add c947e6d7 perf(security-issue-triage): decide and render the triage rules as code
add 52530e0e perf(security-issue-invalidate): decide and render the invalid close as code
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (6c5027ca)
\
N -- N -- N refs/heads/perf/security-2-triage (52530e0e)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
CONTRIBUTING.md | 7 +-
docs/setup/sandbox-troubleshooting.md | 27 ++-
docs/setup/secure-agent-setup.md | 66 ++++----
.../skills/isolated-setup-doctor/SKILL.md | 14 +-
.../scripts/probe-9-working-dirs.sh | 53 ++++--
.../skills/isolated-setup-install/SKILL.md | 36 ++--
.../skills/isolated-setup-update/SKILL.md | 7 +-
.../skills/isolated-setup-verify/SKILL.md | 14 +-
.../setup/setup_preflight/isolated_fingerprint.py | 2 +-
tools/agent-isolation/sandbox-add-project-root.sh | 42 +++--
.../tests/test_sandbox_add_project_root.py | 16 +-
tools/sandbox-lint/README.md | 35 ++++
tools/sandbox-lint/src/sandbox_lint/__init__.py | 172 +++++++++++++++++++
tools/sandbox-lint/tests/test_layered.py | 188 +++++++++++++++++++++
tools/skill-evals/README.md | 4 +-
.../evals/setup-isolated-setup-doctor/README.md | 4 +-
.../expected.json | 2 +-
.../report.md | 4 +-
.../interpret-probes/fixtures/output-spec.md | 2 +-
.../evals/setup-isolated-setup-verify/README.md | 4 +-
.../case-10-working-dirs-missing/expected.json | 2 +-
.../case-10-working-dirs-missing/report.md | 2 -
.../case-16-magpie-working-dir/expected.json | 15 ++
.../report.md | 24 ++-
tools/spec-loop/specs/agent-isolation-sandbox.md | 36 ++--
tools/spec-loop/specs/sandbox-diagnostics.md | 12 +-
tools/spec-loop/specs/vetted-command-surface.md | 12 +-
27 files changed, 656 insertions(+), 146 deletions(-)
copy tools/skill-evals/evals/setup-isolated-setup-doctor/interpret-probes/fixtures/{case-17-git-hooks-unreadable => case-19-working-dirs-magpie-writable}/expected.json (71%)
copy tools/skill-evals/evals/setup-isolated-setup-doctor/interpret-probes/fixtures/{case-18-working-dirs-glob => case-19-working-dirs-magpie-writable}/report.md (55%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-16-magpie-working-dir/expected.json
copy tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/{case-10-working-dirs-missing => case-16-magpie-working-dir}/report.md (59%)