feat: --print-tcc-path 顯示執行 context（parent chain）與 context-dependence 警告 (#169) - #174
Merged
kiki830621 merged 5 commits intoJul 10, 2026
Merged
Conversation
…th execution context (#169)
…ning in --print-tcc-path (#169)
Verify finding (security lens + Codex cross-model, DA-confirmed real): ps comm is ancestor-controlled and reached stdout unescaped — CWE-150 terminal escape injection, bypassing the repo's own escapeForStderr discipline (#37/#73/#150). All three interpolated fields (hop.command, selfPath, failureReason) now route through the sanitizer.
This was referenced Jul 10, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #169
Summary
--print-tcc-path輸出尾端新增「Execution context (parent process chain)」段（self → … → launchd，單次ps -A快照 + in-memory walk，cycle guard / hop cap 15 / graceful degrade）+ context-dependence 警告行 — 使用者從此看得到「這次查詢是在哪個 host context 下跑的」，消除 #168 診斷的 context 誤判。實作：新
ParentChainSourceseam（<Domain>Source慣例）+ 純邏輯ParentChainWalker/ParentChainFormatter（#117 抽出先例）；--help同步。Verification
6-AI cross-model verification PASS（4 lens Agents + sequenced Devil's Advocate + Codex gpt-5.5 xhigh）。詳見 issue #169 的 Verify master report。
唯一實質 finding（security+Codex 跨模型同源：ps
comm未消毒直印 stdout，CWE-150）已 in-scope 修復於 37e9e32（三插補點全過escapeForStderr+ 2 消毒測試）。470 tests，僅 2 pre-existing 失敗（版本漂移 → #172，非本 diff）。Checklist
Related
🤖 Generated by /idd-all. Do NOT add a GitHub close trailer (Closes/Fixes/Resolves) — IDD discipline requires manual close via the skill after merge to enforce checklist gate + closing summary.