Dylan Hurd d68b85a097
Require fresh approval beneath denied permission paths ( #39266 ) ...
## Why
A stored permission grant may allow access to a parent while explicitly denying
a child path. A later request for that child must not be treated as already
approved by the broader parent grant.
## What changed
- Compare materialized permission profiles without intersecting away denied or
reopened paths before deciding that a request is preapproved.
- Execute preapproved commands with the stored grant itself so its denied paths
remain enforced.
- Fail closed when permission profiles cannot be materialized.
## Testing
Added unit and integration coverage for turn and session grants across
`exec_command`, `shell_command`, and `apply_patch`, including approval-disabled
and `Never` approval modes.
GitOrigin-RevId: 5455880328a89c7958f859c7ce87805dff9704fb
2026-08-18 19:17:09 +00:00
2026-07-29 13:53:15 +00:00
2026-06-09 12:48:04 -07:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-17 04:01:37 +00:00
2026-07-29 13:53:15 +00:00
2026-08-18 19:12:30 +00:00
2026-08-18 00:45:00 +00:00
2026-07-21 08:50:21 +00:00
2026-08-18 18:01:39 +00:00
2026-07-30 19:47:30 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-10 18:44:58 +00:00
2026-08-10 01:39:55 +00:00
2026-06-11 18:16:39 -07:00
2026-08-17 13:20:58 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-18 18:15:21 +00:00
2026-08-13 19:35:22 +00:00
2026-08-13 19:35:22 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-08-14 20:42:35 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-05 16:09:01 +00:00
2026-08-18 18:41:40 +00:00
2026-07-30 21:49:53 +00:00
2026-08-13 23:13:37 +00:00
2026-06-15 20:10:53 -07:00
2026-08-18 18:01:39 +00:00
2026-08-04 22:58:02 +00:00
2026-08-18 05:30:11 +00:00
2026-08-07 00:23:38 +00:00
2026-08-03 11:39:51 +00:00
2026-08-18 19:17:09 +00:00
2026-08-17 19:22:45 +00:00
2026-08-18 17:42:48 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-18 06:22:04 +00:00
2026-08-18 18:15:21 +00:00
2026-08-17 21:49:30 +00:00
2026-08-17 04:37:50 +00:00
2026-08-18 19:12:30 +00:00
2026-08-18 16:05:51 +00:00
2026-08-17 18:41:50 +00:00
2026-08-07 19:56:29 +00:00
2026-07-31 21:37:56 +00:00
2026-08-17 21:49:30 +00:00
2026-05-28 23:09:55 -07:00
2026-08-10 15:50:53 +00:00
2026-08-18 12:37:41 +00:00
2026-08-17 04:17:45 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-06-12 19:52:49 +00:00
2026-08-17 23:21:28 +00:00
2026-07-22 04:17:34 +00:00
2026-08-17 22:26:27 +00:00
2026-08-17 10:01:59 +00:00
2026-08-18 14:14:57 +00:00
2026-07-17 20:52:42 +00:00
2026-08-18 15:06:09 +00:00
2026-08-14 01:23:59 +00:00
2026-08-17 23:08:26 +00:00
2026-08-17 19:22:45 +00:00
2026-07-30 04:26:36 +00:00
2026-08-17 19:06:53 +00:00
2026-08-10 14:25:13 +00:00
2026-05-25 17:26:10 -03:00
2026-08-17 21:49:30 +00:00
2026-08-18 17:53:36 +00:00
2026-08-15 01:34:33 +00:00
2026-08-17 23:04:09 +00:00
2026-08-18 12:37:41 +00:00
2026-08-06 03:11:42 +00:00
2026-08-18 19:17:09 +00:00
2026-05-26 20:59:47 -07:00
2026-08-10 15:43:10 +00:00
2026-08-18 14:59:43 +00:00
2026-08-08 16:58:26 +00:00
2026-08-18 03:31:06 +00:00
2026-08-18 05:46:08 +00:00
2026-08-04 03:49:53 +00:00
2026-08-18 00:45:00 +00:00
2026-08-18 18:38:12 +00:00
2026-08-14 05:49:33 +00:00
2026-08-18 18:50:58 +00:00
2026-08-18 19:09:33 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-07-24 00:16:42 +00:00
2026-08-17 21:49:30 +00:00
2026-08-15 14:31:04 +00:00
2026-07-09 17:31:44 -07:00
2026-08-18 14:59:43 +00:00
2026-08-18 14:59:43 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-11 23:40:07 +00:00
2026-06-04 09:16:03 -07:00
2026-05-26 20:59:47 -07:00
Dylan Hurd
d68b85a097