Claude c67010c92f revert(ci): remove the check:shell-argv inventory gate ...

The PR author correctly flagged that this gate is an inventory, not a
security invariant: --update lets any site self-approve a raw value, and the
literal-first array heuristic is blind to indirect argv (a variable-built
subcommand, or an argv assembled in a helper). Reproduced: adb(['shell',
'input','text',text]) is inventoried, but const s='shell';
adb([s,'input','text',text]) yields no finding. Shipping it security-framed
gives false assurance.

Remove it. The sound fix — a typed device-shell execution boundary where a
raw string cannot reach adb/hdc shell without being quoted or explicitly
marked — is a ~188-site cross-package migration on device execution paths,
scoped to a dedicated follow-up PR. The two known-dangerous sites (input
text, cmd clipboard set text) already quote through shellQuoteIfNeeded on
main, so no regression. This keeps the PR focused on the MCP tool surface.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wb8EuoySL26UsdtCtRj5X8

2026-08-25 12:20:39 +00:00

..

actions

refactor(ci): make gate ownership structural (#1429) (#1753)

2026-08-12 16:02:18 +02:00

workflows

revert(ci): remove the check:shell-argv inventory gate

2026-08-25 12:20:39 +00:00

FUNDING.yml

chore: Update GitHub Sponsors usernames in FUNDING.yml

2026-08-06 07:58:53 +02:00

renovate.json

chore(deps): Renovate config, packageManager-derived pnpm in CI, repo-wide format (#1444)

2026-07-28 13:50:39 +02:00