From b4acf3c3e80b0be74ff190887db69726045a6006 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 02:14:55 +0000 Subject: [PATCH] agent: audit-attempt allows /dev/null like the applier; tokei-005 re-audited clean Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2 --- scripts/audit-attempt.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/audit-attempt.py b/scripts/audit-attempt.py index d321c8a..c59dd8d 100644 --- a/scripts/audit-attempt.py +++ b/scripts/audit-attempt.py @@ -75,7 +75,9 @@ def main() -> int: for line in patch.splitlines(): if line.startswith(("--- ", "+++ ")): p = line[4:].strip() - if p.startswith("/") or "../" in p: + # /dev/null is git's marker for new/deleted files — the one + # absolute path the harness allowlist also accepts. + if (p.startswith("/") and p != "/dev/null") or "../" in p: problems.append(f"patch path escapes workspace: {p}") print("\npatch:")