Reduce approval prompts for causal Bash diagnostic chains - #1925
Merged
Conversation
Comment on lines
+121
to
+129
| foreach (var root in _temporaryRoots) | ||
| { | ||
| if ((IsWithinRoot(normalized, root.Authored) | ||
| || IsWithinRoot(normalized, root.Canonical)) | ||
| && IsSafeTemporaryPath(normalized, root)) | ||
| { | ||
| return true; | ||
| } | ||
| } |
Comment on lines
+149
to
+160
| foreach (var command in analysis.Commands) | ||
| { | ||
| if (command.WorkingDirectoryEffect is | ||
| ShellWorkingDirectoryEffect.ChangesOnSuccess | ||
| { | ||
| Target: ShellValueDomain.Exact exact | ||
| } | ||
| && TryGetTemporaryRoot(exact.Value, out temporaryRoot)) | ||
| { | ||
| return true; | ||
| } | ||
| } |
Comment on lines
+321
to
+329
| foreach (var root in _temporaryRoots) | ||
| { | ||
| if (PathEquals(normalized, root.Authored) | ||
| || PathEquals(normalized, root.Canonical)) | ||
| { | ||
| temporaryRoot = root; | ||
| return true; | ||
| } | ||
| } |
Comment on lines
+276
to
+300
| foreach (var argument in occurrence.Arguments.Where(static argument => | ||
| argument.Argument.IsPath)) | ||
| { | ||
| IReadOnlyList<string> values = argument.Value switch | ||
| { | ||
| ShellValueDomain.Exact exact => [exact.Value], | ||
| ShellValueDomain.FiniteSet finite => finite.Values, | ||
| _ => [] | ||
| }; | ||
| if (values.Count == 0) | ||
| return false; | ||
|
|
||
| foreach (var value in values) | ||
| { | ||
| var resolved = ShellTokenizer.NormalizePathToken( | ||
| value, | ||
| intentDirectory, | ||
| ShellPathStyle.Posix); | ||
| if (string.IsNullOrWhiteSpace(resolved) | ||
| || !IsSafePath(resolved, intentDirectory)) | ||
| { | ||
| return false; | ||
| } | ||
| } | ||
| } |
Comment on lines
+288
to
+299
| foreach (var value in values) | ||
| { | ||
| var resolved = ShellTokenizer.NormalizePathToken( | ||
| value, | ||
| intentDirectory, | ||
| ShellPathStyle.Posix); | ||
| if (string.IsNullOrWhiteSpace(resolved) | ||
| || !IsSafePath(resolved, intentDirectory)) | ||
| { | ||
| return false; | ||
| } | ||
| } |
Comment on lines
+460
to
+470
| foreach (var value in values) | ||
| { | ||
| var path = ShellTokenizer.NormalizePathToken( | ||
| value, | ||
| workingDirectory, | ||
| pathStyle); | ||
| if (string.IsNullOrWhiteSpace(path)) | ||
| return null; | ||
|
|
||
| resolved.Add(path); | ||
| } |
Comment on lines
+100
to
+102
| var testRoot = Path.Combine( | ||
| Path.GetTempPath(), | ||
| $"netclaw-causal-alias-{Guid.NewGuid():N}"); |
| var testRoot = Path.Combine( | ||
| Path.GetTempPath(), | ||
| $"netclaw-causal-alias-{Guid.NewGuid():N}"); | ||
| var canonicalTemp = Path.Combine(testRoot, "canonical-temp"); |
This was referenced Aug 13, 2026
Aaronontheweb
added a commit
that referenced
this pull request
Aug 20, 2026
* Sync delta specs for the last two completed changes Apply the redirect-shared-temp-to-session-scratch delta to session-cwd and tool-approval-gates. The OpenSpec CLI applied both files. Merge the surface-reminder-schedule-failures delta into netclaw-scheduling by hand. PR #2024 already corrected that requirement against the merged code, so a programmatic apply would undo those corrections. Keep the corrected text and add the scheduling-failure content: - An execution failure and a scheduling failure share one ConsecutiveFailures count. - A successful reschedule alone does not reset the count. - An unattended reschedule site emits ReminderScheduleFailed at Warning severity, and ReminderAutoDisabled at Critical severity on the threshold. - The set_reminder create path and update path return the error to the caller and emit no alert. Drop three stale delta claims. The merged code disables a reminder. It does not set a "paused" status and it does not write tasks.json. ReminderExecutionActor has no ExecutionTimeoutSeconds constant, so the one-hour absolute limit stands. * Archive the last two completed OpenSpec changes Move each change to openspec/changes/archive/2026-08-19-<name>/. The code of both changes is merged on dev. - surface-reminder-schedule-failures: PR #1886. - redirect-shared-temp-to-session-scratch: PRs #1890, #1925, #1926, #1945, and #1956. Tick task 4.3 of redirect-shared-temp-to-session-scratch. The full pr_validation suite ran green on Windows against current dev. Leave the other boxes unticked. The maintainer accepts tasks 4.5 and 4.6 of surface-reminder-schedule-failures as guaranteed by construction. The maintainer accepts task 6.4 of that change and task 4.4 of redirect-shared-temp-to-session-scratch as an eval-credentials gap.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This change lets Netclaw evaluate a bounded Bash diagnostic chain under its authored directory intent.
Netclaw consumes ShellSyntaxTree 0.3.4 working-directory effects. It does not parse command names or executable-specific options.
Policy boundary
/tmpaliases map through host-resolved path facts.The policy never rewrites source, arguments, the working directory, or model history.
Motivating case
Stored authority covers
cdandgh api. Reviewed-safe policy can then coverwcandheadunder exact/tmpintent.Validation
git diff --check: passedNative platform CI remains the delivery gate.