@@ -316,61 +316,61 @@ so file operands cannot be smuggled as ambiguous positionals.
316316317317[//]: # "SAFE_BIN_DENIED_FLAGS:START"
318318319- - `grep`: `--dereference-recursive`, `--directories`, `--exclude-from`, `--file`, `--recursive`, `-R`, `-d`, `-f`, `-r`
320- - `jq`: `--argfile`, `--from-file`, `--library-path`, `--rawfile`, `--slurpfile`, `-L`, `-f`
321- - `sort`: `--compress-program`, `--files0-from`, `--output`, `--random-source`, `--temporary-directory`, `-T`, `-o`
322- - `wc`: `--files0-from`
323-324-[//]: # "SAFE_BIN_DENIED_FLAGS:END"
325-326-Safe bins also force argv tokens to be treated as **literal text** at
327-execution time (no globbing and no `$VARS` expansion) for stdin-only
328-segments, so patterns like `*` or `$HOME/...` cannot be used to smuggle
329-file reads.
330-331-</Accordion>
332-333-<Accordion title="Trusted binary directories">
334-Safe bins must resolve from trusted binary directories (system defaults
335-plus optional `tools.exec.safeBinTrustedDirs`). `PATH` entries are never
336-auto-trusted. Default trusted directories are intentionally minimal:
337-`/bin`, `/usr/bin`. If your safe-bin executable lives in
338-package-manager/user paths (for example `/opt/homebrew/bin`,
339-`/usr/local/bin`, `/opt/local/bin`, `/snap/bin`), add them explicitly to
340-`tools.exec.safeBinTrustedDirs`.
341-</Accordion>
342-343-<Accordion title="Shell chaining, wrappers, and multiplexers">
344-Shell chaining (`&&`, `||`, `;`) is allowed when every top-level segment
345-satisfies the allowlist (including safe bins or skill auto-allow).
346-Redirections remain unsupported in allowlist mode. Command substitution
347-(`$()` / backticks) is rejected during allowlist parsing, including inside
348-double quotes; use single quotes if you need literal `$()` text.
349-350-On macOS companion-app approvals, raw shell text containing shell control
351-or expansion syntax (`&&`, `||`, `;`, `|`, `` ` ``, `$`, `<`, `>`, `(`,
352-`)`) is treated as an allowlist miss unless the shell binary itself is
353-allowlisted.
354-355-For shell wrappers (`bash|sh|zsh ... -c/-lc`), request-scoped env
356-overrides are reduced to a small explicit allowlist (`TERM`, `LANG`,
357-`LC_*`, `COLORTERM`, `NO_COLOR`, `FORCE_COLOR`).
358-359-For `allow-always` decisions in allowlist mode, known dispatch wrappers
360-(`env`, `nice`, `nohup`, `stdbuf`, `timeout`) persist the inner executable
361-path instead of the wrapper path. Shell multiplexers (`busybox`, `toybox`)
362-are unwrapped for shell applets (`sh`, `ash`, etc.) the same way. If a
363-wrapper or multiplexer cannot be safely unwrapped, no allowlist entry is
364-persisted automatically.
365-366-If you allowlist interpreters like `python3` or `node`, prefer
367-`tools.exec.strictInlineEval=true` so inline eval still requires an
368-explicit approval. In strict mode, `allow-always` can still persist benign
369-interpreter/script invocations, but inline-eval carriers are not persisted
370-automatically.
371-372-</Accordion>
373-</AccordionGroup>
319+- `grep`: `--dereference-recursive`, `--directories`, `--exclude-from`, `--file`, `--recursive`, `-R`, `-d`, `-f`, `-r`
320+- `jq`: `--argfile`, `--from-file`, `--library-path`, `--rawfile`, `--slurpfile`, `-L`, `-f`
321+- `sort`: `--compress-program`, `--files0-from`, `--output`, `--random-source`, `--temporary-directory`, `-T`, `-o`
322+- `wc`: `--files0-from`
323+324+ [//]: # "SAFE_BIN_DENIED_FLAGS:END"
325+326+ Safe bins also force argv tokens to be treated as **literal text** at
327+ execution time (no globbing and no `$VARS` expansion) for stdin-only
328+ segments, so patterns like `*` or `$HOME/...` cannot be used to smuggle
329+ file reads.
330+331+ </Accordion>
332+333+ <Accordion title="Trusted binary directories">
334+ Safe bins must resolve from trusted binary directories (system defaults
335+ plus optional `tools.exec.safeBinTrustedDirs`). `PATH` entries are never
336+ auto-trusted. Default trusted directories are intentionally minimal:
337+ `/bin`, `/usr/bin`. If your safe-bin executable lives in
338+ package-manager/user paths (for example `/opt/homebrew/bin`,
339+ `/usr/local/bin`, `/opt/local/bin`, `/snap/bin`), add them explicitly to
340+ `tools.exec.safeBinTrustedDirs`.
341+ </Accordion>
342+343+ <Accordion title="Shell chaining, wrappers, and multiplexers">
344+ Shell chaining (`&&`, `||`, `;`) is allowed when every top-level segment
345+ satisfies the allowlist (including safe bins or skill auto-allow).
346+ Redirections remain unsupported in allowlist mode. Command substitution
347+ (`$()` / backticks) is rejected during allowlist parsing, including inside
348+ double quotes; use single quotes if you need literal `$()` text.
349+350+ On macOS companion-app approvals, raw shell text containing shell control
351+ or expansion syntax (`&&`, `||`, `;`, `|`, `` ` ``, `$`, `<`, `>`, `(`,
352+ `)`) is treated as an allowlist miss unless the shell binary itself is
353+ allowlisted.
354+355+ For shell wrappers (`bash|sh|zsh ... -c/-lc`), request-scoped env
356+ overrides are reduced to a small explicit allowlist (`TERM`, `LANG`,
357+ `LC_*`, `COLORTERM`, `NO_COLOR`, `FORCE_COLOR`).
358+359+ For `allow-always` decisions in allowlist mode, known dispatch wrappers
360+ (`env`, `nice`, `nohup`, `stdbuf`, `timeout`) persist the inner executable
361+ path instead of the wrapper path. Shell multiplexers (`busybox`, `toybox`)
362+ are unwrapped for shell applets (`sh`, `ash`, etc.) the same way. If a
363+ wrapper or multiplexer cannot be safely unwrapped, no allowlist entry is
364+ persisted automatically.
365+366+ If you allowlist interpreters like `python3` or `node`, prefer
367+ `tools.exec.strictInlineEval=true` so inline eval still requires an
368+ explicit approval. In strict mode, `allow-always` can still persist benign
369+ interpreter/script invocations, but inline-eval carriers are not persisted
370+ automatically.
371+372+ </Accordion>
373+ </AccordionGroup>
374374375375### Safe bins versus allowlist
376376此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。