fix(security): trust resolved skill-bin paths in allowlist auto-allow

2026-02-24 03:12:22 +00:00
parent 204d9fb404
commit ffd63b7a2c
7 changed files with 243 additions and 32 deletions
--- a/src/node-host/invoke-types.ts
+++ b/src/node-host/invoke-types.ts
@@ -1,3 +1,5 @@
+import type { SkillBinTrustEntry } from "../infra/exec-approvals.js";
+
 export type SystemRunParams = {
  command: string[];
  rawCommand?: string | null;
@@ -35,5 +37,5 @@ export type ExecEventPayload = {
 };

 export type SkillBinsProvider = {
-  current(force?: boolean): Promise<Set<string>>;
+  current(force?: boolean): Promise<SkillBinTrustEntry[]>;
 };