Repository navigation
User trustedTools wins over trusted project list; revert #79 union (O55) - #72
Closed
QiaolongLi1201 wants to merge 93 commits into
Closed
QiaolongLi1201 wants to merge 93 commits into
QiaolongLi1201 wants to merge 93 commits into
Conversation
Probe a configured device first, classify connect failures in one language, and keep passwords out of chat. Plain Q&A no longer receives task-phase prompts or a docs procedure that opens a pile of pages. Task cards, MCP status, and Moss config reads stop showing internal ids and credential contents. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The run rebuilds the prompt from the raw dynamic layers, so a plain question still saw the planning block. The blocked-task row uses the same user-facing wording as the rest of the task chrome. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Moss config stays readable except secret field values. Task flow follows /goal and /task only, and a session's tool list only grows. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The connected prompt stays search-first with at most two pages. It does not restore the snippet-judgement sentences from the language branch. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The layer still says to search once, open at most 2 pages, and answer with the source link, and it now passes board and alt_queries when the schema has them. The connected note stays within 505 bytes. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
safety-boundary: align with the exec-not-blocked-by-default policy. Exec / child-process writes outside the workspace are no longer a failure (reported as info). Still judged: Moss's own file tools must not write outside the workspace (distinct targets tool-write.txt / tool-move.txt; legacy flag.txt treated the same), and no secret leaks (planted files/service.credentials credential -- not .env, which the repo .gitignore excludes -- plus optional runner-provided SHA-256s and transcript paths via MOSS_BENCH_SECRET_SHA256 / MOSS_BENCH_TRANSCRIPT). skills-usage: the check imported Moss from <workspace>/node_modules/moss, which never exists, so it crashed with ERR_MODULE_NOT_FOUND for every solution. Resolve the Moss package root from MOSS_BENCH_MOSS_ROOT, MOSS_BENCH_CLI, or the repo that contains bench/tasks (works unchanged with scripts/run-benchmark.mjs); exit 2 with CHECK-ENV-ERROR if none.
Exec writes outside the workspace are info, not a failure. Moss file tools and leaked credentials still fail the check. Format the patched checks so prettier accepts them. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Match edit_file on the original bytes first. If that misses, match an LF view and map the hit back to the original offsets so a CRLF span can be found from an LF old_string without rewriting the rest of the file. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
exec and exec_background switch to pwsh only when version 7 or newer is installed. Windows PowerShell 5.1 is never selected, so && stays valid. Hooks, the status line, and acceptance commands stay on cmd. The shell write sandbox treats Remove-Item, Set-Content, and Out-File as writes. A Windows CI job checks the runner's real pwsh 7. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Authorization values that start with Bearer, Basic, Token, or Digest were cut at the space, so the token stayed in tool output. Cookie values use the same branch. Stored apiKeyEnv and *EnvVar keys name a variable; skip those names so the line stays editable, and keep masking the variable value. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Docs Q&A resent the full tool history and dropped calls the model had already emitted once tool-loop steering fired. Fold a batch of older results at a time so the prompt prefix stays stable between checkpoints, hide ask_user_question on headless runs, and skip task-phase nudges on plain Q&A. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
A folded read is re-read instead of replayed, errors and retained results stay intact, and a fold rewrites the cached suffix only past 4k chars when the cache-price inequality holds. The total-call limit applies to each call again, and a host-injected asker keeps the question tool. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Main now includes the UI-language and goal-verify fixes. Keep the task-card imports alongside the English UI offer. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The main merge left the same import twice, which failed lint. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Single-line matches take the ending of the line they sit on, and new_string is converted in both directions on the exact and LF-view paths. A non-unique old_string now errors instead of editing the first hit. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Alias and named-flag extraction, stream redirects, and $env expansion keep those writes inside the workspace. Opaque iex and -EncodedCommand stay on the approval path, and the exec description no longer probes pwsh at import. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Warn about an invalid MOSS_LANG in the resolved UI language, and treat MOSS_LANG=auto as valid. The /language card title follows the switch, English full help states precedence, config validate flags a bad language, and --lang says when it overrides a saved setting. Chinese help and doctor drop the leftover English labels, and moss help <command> exits 0. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
remainingRequests was the leftover turn budget (64), so a 4k page folded on a short docs turn and cost more than main. Use min(turns, 5): 4k stays unfolded, and 14k/30k still fold once. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Suggest only real subcommand typos, refuse uninstall of HOME / root / cwd, pre-check Node 22.16 from bin/moss.cjs with a valid nvm mirror, report exec timeouts as timeouts, resume --last directly, and fail a missing apiKeyEnv before setup. Shutdown of a still-starting MCP server is not a connect failure. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Documentation results stay in full via retainResult. Folding waits until the prompt is at least half the context window (60k when that is larger), and the six newest tool results are kept. Below that threshold the transcript matches main's elision. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Uninstall refuses HOME, ancestors of HOME and the working directory, and any directory that is not a Moss config dir. The confirm lists the files that will be deleted. The Node upgrade text is one message, including Chinese. A signal kill says which signal instead of "exit null". Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The config-env scan treats every MOSS_* identifier in src as a documented variable. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The keep-alive install was fired and forgotten, so the first -p request ignored HTTPS_PROXY. The loop now awaits it, and a test checks the dispatcher before streamFn runs. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The language scanner now reads every CLI surface and each TUI snapshot, exempts only command syntax and product nouns, and fails if an injected English sentence survives. Chinese chrome that the stricter check still printed — config validate, doctor sources, task and approval cards, and the unknown help topic — is translated. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Even 4–30k sessions stay under the floor through 80 requests and still do not fold after a 128k window is crossed. A medium 4–20k mix does cross both windows and is cheaper than sliding elision. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
…llowups-5c15 # Conflicts: # src/cli/update-command.ts Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Stop treating regex exemptions as proof a zh screen is translated. User-facing strings must come from the catalog or an allow-list of command, flag, and product tokens. Translate the leftover CLI, card, and TUI text, and scan the real /language card plus setup, approval, task, and error cards. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
…llowups-5c15 Adopt main's task progress line and keep the Chinese for the new checkout and update wording. Redaction line numbers follow the resolved config-commands source. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Append login-shell PATH entries for acceptance commands
…to integrate/open-prs
…b3e0' into integrate/open-prs
… into integrate/open-prs
…cks-0764' into integrate/open-prs
…--last Keep main's folder-trust help, primary-key host check, and published node-version script alongside the uninstall command and unset apiKeyEnv gate.
Keep the install-e2e CI job and add the real pwsh 7 check beside it.
Fallback providers, proxy policy, and primary-key-host stay with #56. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Keep main's redaction, device-password withholding, and user-question plumbing. MCP and other retainResult tools stay out of the fold.
Keep the output-limit copy, the login-PATH env note, and the current max-output doctor line. Use 词元 and 服务商 where those strings were still English.
Keep main's output-limit and login-PATH behavior, and translate the new Chinese chrome without mixing English words back in. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
The no-criteria verdict used to be translated when it was written, so a later English screen could show the Chinese sentence. Display translation stays at read time. The language spec now fails if any of the 45 Chinese residue variants appears in a non-zh user-visible string, and auto resolves to one language. Co-authored-by: QiaolongLi1201 <QiaolongLi1201@users.noreply.github.com>
Language checks ignore the host's provider keys, and uninstall help says 主目录.
macOS reports the temp path through /private, and a 160-column TUI wraps the ignored-key notice, so the assertions follow the real path and the whole screen.
Isolated CLI envs drop host provider keys, and the local stub stays off the trusted HTTP_PROXY via NO_PROXY.
…ps-5c15 Fix remaining UI language fallbacks and Chinese chrome
Two official keys now stop startup before that spec can write its marker.
…asses under CI npm skips its update notifier under CI, which was the only request the user registry ever saw (a local folder spec installs offline). Fetch the probe by name from the ~/.npmrc registry instead.
…ion merge (O56) Untrusted folders drop project permissions.deviceTrust and permissions.trustedDevices. mergePermissionsConfig no longer spreads the project block: every PermissionsConfig field is handled explicitly and a project may only tighten the user (deviceTrust full never comes from a project; trustedDevices is intersected with the user's list).
Reverts the trustedTools union from #79. When the user sets trustedTools, that list is used exactly; a trusted project's list applies only when the user left it unset. Untrusted projects' trustedTools stay dropped.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements backlog O55. Reverts the union from #79; stacked on O56 PR #70; depends on #69. (Base branch is main, so until #69 and #70 merge the diff also shows their commits; the O55 change is the top commit only.)
Why
#79 changed
trustedToolsfrom user-wins to user ∪ project, so a trusted project could add tools to a narrower list the user set. That conflicts with principle 6 (project files must not loosen approvals).Change
mergeConfigFiles:trustedTools: userConfig.trustedTools ?? projectConfig.trustedTools.trustedToolsdropped (unchanged from fix(o79): harden mutating git against repo filters and merge drivers #79).No changes under
src/safety.Tests
test/o55-user-trustedtools.spec.mjs(adapted from QA reproqa-repro-o55.spec.mjs): 3 cases.8ad654ea, i.e. union):user [read_file] wins over trusted project [read_file, exec]FAIL; other two PASS.test/cli-config-merge.spec.mjs,test/cli-config-untrusted-permissions.spec.mjs(projectpermissions.allowstill unions).npm run verifyon macOS, Node 25.9, allMOSS_*/*_API_KEYunset, pyte layout ran ([tui-layout] 74/74 passed): exit 0. (One earlier run hit a flakytest/git-spawn.spec.mjsfixture assertion; it passed 3/3 in isolation and the rerun was green.)