Development record
The headless approver reads the command line it is asked about, not the writes of a script that line runs: a script the approver lets run is read for the registry's hazards only, so a file the script writes, a protected one included, is not checked by the approver. The OS sandbox for launched agents, spc-2610161751056096, is the change that bounds those writes. <!-- record-lint: forward-looking -->
issueopenminoriss-2610161930038953
The headless approver reads the command line it is asked about, not the writes of a script that line runs: a script the approver lets run is read for the registry's hazards only, so a file the script writes, a protected one included, is not checked by the approver. The OS sandbox for launched agents, spc-2610161751056096, is the change that bounds those writes.
Frontmatter
| id | iss-2610161930038953 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2610161930038953-the-headless-approver-reads-the-command.md
open on GitHub ↗ · commit history ↗
mentions1
- spc-2610161751056096a-person-who-leaves-abcd-to-run-on-its