matevip 4ae4731d54 fix(tool-guard): harden filesystem-root skip and chat-upload fallback in boundary checks ... - Shell scan: a token normalizing to the filesystem root (//, /., /..) is only skipped when the command carries no destructive verb; with rm/rmdir/shred/srm present the scan fails closed, so 'rm -rf //' is refused while sed empty replacements (s/pattern//) stay allowed. - Chat-upload fallback: a boundary violation is waived only when the requested path itself normalizes inside one of the conversation's candidate upload directories; a basename match against a stored attachment no longer clears the violation. Resolver/DB failures keep the BLOCK finding. The unused candidate-roots resolve overload is removed. - Regression tests for destructive root tokens, sed allowance, the fail-closed compound case, stored-upload-path allowance, basename collisions, cross-conversation paths, and resolver failure.		2026-07-09 15:04:34 +08:00
..
guardian	fix(tool-guard): harden filesystem-root skip and chat-upload fallback in boundary checks	2026-07-09 15:04:34 +08:00
service	chore(test): backfill mateclaw-server/src/test/ that earlier PRIVATE_ITEMS pattern accidentally excluded	2026-05-12 17:38:08 +08:00
DefaultToolGuardTest.java	feat(tool): add execute_code for running agent-authored code (#257)	2026-06-09 08:05:50 +08:00
WorkspacePathGuardSandboxTest.java	fix(tool-guard): resolve relative file paths against the workspace root, not process CWD (#494)	2026-07-07 18:33:16 +08:00
WorkspacePathGuardShellTest.java	fix(tool-guard): harden filesystem-root skip and chat-upload fallback in boundary checks	2026-07-09 15:04:34 +08:00