Bryan Helmkamp 1ef72fb6bc refactor(server): extract run_files_security with globset denylist (P3-2) ... Moves the sensitive-path denylist, sandbox-git env helper, and metrics emitter into a dedicated run_files_security module so the Run Files Changed endpoint has a single, testable surface for security controls. Denylist upgrades to globset::GlobSet with two explicit lists: - Basename globs: .env, .env.*, *.pem, id_rsa, id_rsa.*, id_ed25519*, *.p12, *.keystore, *.key - Path-suffix globs: .aws/credentials, .git/config, .ssh/** Matching semantics explicitly pinned: - Case-insensitive via lowercased normalization - Path traversal (`../`, `./`, leading `/`) stripped before match - Basename globs match the final segment only — prevents `log/.env_audit/data.txt` from matching `.env.*` - Empty/pathological paths fail closed (sensitive=true safe default) Also ships: - sandbox_git_env() returning the env-hardening map - RunFilesMetrics struct + emit() so tracing never leaks paths/contents Handler migrates to consume the new module; inline denylist and inline info!() call removed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-19 17:35:26 -04:00
..
crates	refactor(server): extract run_files_security with globset denylist (P3-2)	2026-04-19 17:35:26 -04:00
packages/fabro-api-client	feat(api): add GET /runs/{id}/files spec + RunFilesMeta schema	2026-04-19 15:33:24 -04:00