3 Commits

Include renames

Author	SHA1	Message	Date
Martin VogelandSandro Jäckel	50392a4188	fix(scripts): use /usr/bin/env bash shebangs (NixOS has no /bin/bash) ... On NixOS (and other non-FHS systems) /bin/bash does not exist, so scripts with an absolute shebang fail to run. Switch the remaining holdouts to /usr/bin/env bash: eleven scripts/*.sh, test-infrastructure/run.sh, and the three Claude Code hook scripts emitted by src/cli/cli.c (gate, session reminder, subagent reminder). Distilled from PR #674, with parser-test coverage preserved: the infra_parse_shell* fixtures in tests/test_pipeline.c intentionally keep #!/bin/bash so absolute-path shebang extraction stays covered, and tests/repro fixtures are untouched. Also replace the GitHub-PAT-shaped fixture string flagged in the #674 thread with an obviously fake placeholder (ghp_FAKE...) that still matches the ghp_ + 36-alnum secret detector. Co-authored-by: Sandro Jäckel <sandro.jaeckel@gmail.com> Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>	2026-07-03 20:11:49 +02:00
Martin Vogel	cd1417427c	Add 8-layer security test suite + hardening ... Code-level defenses: - cbm_validate_shell_arg(): reject shell metacharacters before popen/system - SQLite authorizer: block ATTACH/DETACH at engine level - CORS localhost-only origin reflection (replaces wildcard *) - Path containment: realpath() check in get_code_snippet - process-kill restricted to server-spawned PIDs - SHA256 checksum verification in update command Security audit scripts (8 layers): - L1: Static allow-list for dangerous calls + URLs - L2: Binary string audit (URLs, payloads, credentials) - L3: Network egress monitoring via strace (Linux) - L4: Install output path + content validation - L5: Smoke test hardening (clean shutdown, residual procs) - L6: Graph UI audit (external domains, CORS, binding) - L7: MCP robustness (23 adversarial JSON-RPC payloads) - L8: Vendored integrity (checksums + dangerous call scan) CI: parallel security-static job (no build needed), binary layers in smoke jobs per-platform. Cleanup of test fixture dirs in clean.sh + .gitignore.	2026-03-20 18:19:15 +01:00
Martin Vogel	fd1640ec29	Add build scripts, fix GCC warnings, unify CI workflows ... - Add scripts/clean.sh, test.sh, build.sh, lint.sh as single source of truth for local and CI builds (always clean, always parallel) - Fix -Wmissing-braces: replace {{0}} with memset for struct arrays - Fix -Wrestrict: use intermediate buffer for same-struct snprintf - Update dry-run.yml and release.yml to use the new scripts	2026-03-18 12:31:53 +01:00