chore: sync public mirror from internal#781
Conversation
PR SummaryHigh Risk Overview Sandbox GitHub CLI tools stop shell-quoting full commands: they run Enterprise network policy gains a much deeper shell parser in Guardian Reviewed by Cursor Bugbot for commit e36ce74. Bugbot is set up for automated code reviews on this repo. Configure here. |
haasonsaas
force-pushed
the
sync/public-release-mirror
branch
from
d49c2cc to
2a4c56c
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Docker abort ignores container process
- DockerSandbox now records the in-container child PID, forwards aborts with a second docker exec, and routes abortable exec() calls through the same cancellation path.
You can send follow-ups to the cloud agent here.
Reviewed by Cursor Bugbot for commit 2a4c56c. Configure here.
haasonsaas
left a comment
haasonsaas
left a comment
There was a problem hiding this comment.
🔒 Hermes automated security scan flagged this PR.
🟠 Unsafe patterns (review):
src/tools/bash.ts— exec():const result = await sandbox.exec(interpolatedCommand, cwd, env, signal);test/packages/core/daytona-sandbox.test.ts— exec():const result = await sandbox.exec(test/sandbox/native-sandbox-max-buffer.test.ts— exec():const promise = sandbox.exec("gh api");
Automated gitleaks + pattern scan. Dismiss this review if it's a false positive.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 610758ac5a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
… policy Restore the recursive URL scan over the full bash args (including the command string) alongside the bash-token aware extractor. The token-aware path alone misses URLs embedded mid-string in shell arguments (e.g. curl "see https://... here", echo "https://...", heredocs), which let enterprise network policy be bypassed. Union both scans so neither path can be evaded independently. Addresses Codex P1 finding on PR #781.
|
Addressed the Codex P1 in cef6e3b: restored the recursive URL scan over the bash args (including the command string) while keeping the bash-token aware extractor. The two scans are now unioned and deduped, so URLs embedded mid-string ( Updated two existing tests that asserted |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cef6e3b80e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ions OpenSSH lets `-o HostName=evil.com github.com`, `-J evil.com github.com`, or `-W evil.com:22 jumpbox` override the positional host, so the real connection goes somewhere policy never sees. Walk these options, extract the destination host (or recurse into ProxyCommand/RemoteCommand shell), and return them alongside the positional target so callers re-validate. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e36ce74159
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (lowered === "proxycommand" || lowered === "remotecommand") { | ||
| // Commands are opaque arbitrary shell — recursively extract any hosts | ||
| // they reference so policy enforcement can still see them. | ||
| return extractUrlsFromShellCommand(trimmed); |
There was a problem hiding this comment.
Fresh evidence after the SSH-option handling change: this branch treats ProxyCommand/RemoteCommand by returning only URLs extracted from the option value, so an opaque proxy such as ssh -o ProxyCommand='nc $TARGET 22' 127.0.0.1 yields no option target and checkNetworkPolicy(..., {allowedHosts:['127.0.0.1']}) allows it after validating only the positional host. OpenSSH confirms this option is active (ssh -G ... prints proxycommand nc $TARGET 22), so enterprise allowed/blocked-host policy can be bypassed whenever the proxy command's host is variable or otherwise not statically parsed; make these option values fail closed when extraction finds no validatable target.
Useful? React with 👍 / 👎.
2 participants
Summary
evalops/maestro-internalevalops/maestroas a generated public mirror of the private source of truth9e0c36821d05d08fd2dcfd45b480b06f9c07099ee18fb040ace9cad9fbfcb81903938a54cf5825d025file(s) to copy/update and0stale file(s) to delete0Source-of-truth status
Public Mirror Drift Audit
@evalops/maestrohttps://github.com/evalops/maestro-internal@main (9e0c36821d05)https://github.com/evalops/maestro@main (e18fb040ace9)250public_projection_has_driftSample Changed Paths
Guidance
Let internal main generate and merge the public sync PR before relying on public main.
Drift sample
Public-only commits since last generated sync
Validation
sync-public-release-mirrorworkflow inpublic-treemodeTest Plan
sync-public-release-mirrorworkflow inpublic-treemoderequire-internal-prcheck confirms internal source PR lineageStaged Rollout
evalops/maestro-internal@9e0c36821d05d08fd2dcfd45b480b06f9c07099e, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.Supersedes
9e0c36821d05d08fd2dcfd45b480b06f9c07099e