agent: audit-attempt allows /dev/null like the applier; tokei-005 re-audited clean

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2
This commit is contained in:
Claude
2026-07-11 02:14:55 +00:00
parent 09bcde5bf4
commit b4acf3c3e8
+3 -1
View File
@@ -75,7 +75,9 @@ def main() -> int:
for line in patch.splitlines(): for line in patch.splitlines():
if line.startswith(("--- ", "+++ ")): if line.startswith(("--- ", "+++ ")):
p = line[4:].strip() p = line[4:].strip()
if p.startswith("/") or "../" in p: # /dev/null is git's marker for new/deleted files — the one
# absolute path the harness allowlist also accepts.
if (p.startswith("/") and p != "/dev/null") or "../" in p:
problems.append(f"patch path escapes workspace: {p}") problems.append(f"patch path escapes workspace: {p}")
print("\npatch:") print("\npatch:")