garrytanandcapy-ai[bot] d65304a0e1 fix(pregate): refuse a user policy whose link chain passes through the checkout ...

userConfigRejection checked the lexical path and the final realpath only. A
state root linked into the checkout, or a link hop inside it, let a branch pick
which existing out-of-repo policy governs it. Every hop of the resolution chain
is now checked. Found by the security review of #3286.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

2026-10-24 23:46:44 +00:00

..

checks

Merge PR #3286 (arlophoenix): user-owned pregate policy file and local lanes

2026-10-24 23:36:47 +00:00

config.ts

Merge remote-tracking branch 'upstream/main' into feat/pregate-user-policy

2026-10-20 17:33:59 +13:00

context.ts

fix(pregate): refuse a user policy whose link chain passes through the checkout

2026-10-24 23:46:44 +00:00

django.ts

v1.91.161.0 fix(pregate): Django, Dart, asset and tool-config lanes; init drafts from the repo (#3266-#3269) (#3306)

2026-10-20 01:38:26 +00:00

docs-lane.ts

v1.91.161.0 fix(pregate): Django, Dart, asset and tool-config lanes; init drafts from the repo (#3266-#3269) (#3306)

2026-10-20 01:38:26 +00:00

import-graph.ts

fix(pregate): Rust crate lanes and nested JS package runners

2026-10-24 20:08:40 +00:00

index.ts

fix(pregate): a checkout's .env cannot pick the user policy; verify re-checks it

2026-10-20 11:27:08 +13:00

init-draft.ts

fix(pregate): Rust crate lanes and nested JS package runners

2026-10-24 20:08:40 +00:00

lane-selection.ts

Merge remote-tracking branch 'upstream/main' into feat/pregate-user-policy

2026-10-20 17:33:59 +13:00

regate.ts

v1.91.98.0 fix: plan obligations meet repo gates; priced paid gates; machine-proved restamps (field wave C, items 14-17) (#3166)

2026-10-13 15:38:41 +00:00

runtime.ts

v1.91.110.0 fix(capy): install the project's pinned Node; launch Bun through a bun-only directory (#3233)

2026-10-17 00:41:41 +00:00

rust.ts

fix(pregate): past the members size cap, a crate's run root is undecided and its tests unclaimed

2026-10-24 20:43:29 +00:00

supervise.ts

v1.91.107.0 fix: the GBRA-40 field list (one Bun for install and check, rec gate approval, pregate never silent) (#3190)

2026-10-16 23:09:23 +00:00

types.ts

fix(pregate): a checkout's .env cannot pick the user policy; verify re-checks it

2026-10-20 11:27:08 +13:00

workflows.ts

v1.91.161.0 fix(pregate): Django, Dart, asset and tool-config lanes; init drafts from the repo (#3266-#3269) (#3306)

2026-10-20 01:38:26 +00:00