Bring hackbot1 up to date with hackbot (19 commits)#1
Merged
Conversation
The agent runs LLM-generated commands via ToolRunner. Execution was inconsistent across paths: POSIX sync used shlex.split (safe), but the Windows sync path used shell=True (cmd.exe) and execute_async() used create_subprocess_shell — both shell-injection surfaces. validate_command only checked the first token against the allowlist and never rejected shell operators or command substitution. - execute(): use shell=False on all platforms. On Windows the raw string goes to CreateProcess (no cmd.exe), so metacharacters are not interpreted. - execute_async(): replace create_subprocess_shell with create_subprocess_exec and bring it to parity with execute() (plugin interception, risky-command confirmation, output truncation, FileNotFoundError handling, logging, on_output) so it can never become a future footgun. - validate_command(): reject command substitution ($(...), backticks) and standalone shell-operator tokens (; | || & && > >> < <<) via a token-based check that does not false-positive on URLs (& inside a quoted arg). Handle unbalanced quotes gracefully instead of crashing. - Factor truncation into _truncate_output() (removes a duplicated long line). Adds 12 tests covering operator/substitution rejection, URL-with-ampersand acceptance, unbalanced-quote handling, shell-free proof (chained command's second half never runs; $HOME not interpolated), and async parity. Full suite: 755 passed, 40 skipped.
Harden command execution: shell-free and consistent across all paths
…lover [codex] feat: add DeepSeek key management
…un-sidebar-collapse [codex] Improve GUI agent auto-run and sidebar collapse
Spec for a new agent `install` action plus ToolInstaller module that auto-installs missing security tools through the existing hardened ToolRunner boundary. Allowlist-bounded by default, layered package managers (apt/dnf/pacman/brew + pipx/pip/go), respects safe_mode. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tall drivers Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Remove package managers from the global allowlist so the agent cannot run them via a normal execute action. ToolInstaller.install now invokes them through a dedicated allow_install_drivers bypass on ToolRunner that permits only config.INSTALL_DRIVERS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…l-install feat: autonomous security-tool installation
fix: make runner tests pass on Windows
JMAN730
marked this pull request as ready for review
June 23, 2026 16:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves all commits from
hackbotintohackbot1.The two repositories shared the commit
8f0a97e Update README.md, which was the tip ofhackbot1/mainand a strict ancestor ofhackbot/main.hackbothad built 19 additional commits on top of it thathackbot1was missing.hackbot1had no unique commits, so this is a clean fast-forward — no conflicts and nothing discarded.Commits added
/installCLI command, allowlist-bounded + safe_mode gate (PR Harden command execution and implement autonomous tool installation yashab-cyber/hackbot#4)hackbotwas left unchanged (copy, not a destructive move).