Prasanth Kotaru 2d636c50bf security: narrow Bash(bun run:*) to the six shipped portal CLIs (#396) ...

The upstream template pre-approves `Bash(bun run:*)`, which auto-approves
`bun run <any file>` — arbitrary TypeScript from anywhere on disk — on every
fork. Each portal SKILL.md already declares the tight form in its own
allowed-tools; this makes settings.json agree with them.

Blast radius drops from "any file on the machine" to the repo's own CLIs,
with no new prompts in the /scrape path. tools/security_guards.py's
ALLOWED_PERMISSIONS is updated in the same commit, as its docstring requires.

Local: security_guards OK, lint_skills OK, 318 tests pass.

Claude-Session: https://claude.ai/code/session_01HHqEAQqGS2KKXASiYcrAHQ

2026-08-30 20:27:31 +02:00

..

check_framework_version.py

feat(agents-config): add root AGENTS.md thin-pointer specification (#159)

2026-07-15 22:33:42 +02:00

check_upstream_updates.py

feat(upstream): add commit-level triage and weekly watch for forks (#305) (#320)

2026-08-11 19:11:24 +02:00

convert_salary_excel.py

fix(salary-tools): decide number locale by last separator, pair compound headers

2026-08-19 19:48:50 +02:00

lint_skills.py

fix(lint): report malformed settings shapes without crashing (#146)

2026-07-13 20:45:22 +02:00

README_SALARY_TOOL.md

fix(salary): validate category shape and add --validate preflight (#156)

2026-07-15 07:53:01 +02:00

robots_check.py

fix(robots): the gate did not fail closed on a soft 200 or an encoded Disallow (#286)

2026-08-06 07:59:34 +02:00

security_guards.py

security: narrow Bash(bun run:*) to the six shipped portal CLIs (#396)

2026-08-30 20:27:31 +02:00

upstream_triage.py

feat(upstream): add commit-level triage and weekly watch for forks (#305) (#320)

2026-08-11 19:11:24 +02:00

verify_pdf.py

style(verify_pdf): align fallback comment indentation, restore EOF newline (#369 fixup)

2026-08-26 20:07:39 +02:00