OrbisAI Security 2a16c562a8 fix(bash): narrow credential-file block to ~/.cow/.env only ...

Replace the broad `~/.cow` directory check with a regex that matches
only the credential file path (`\.cow[/\\]\.env`), so legitimate access
to other `~/.cow/` subdirectories (e.g. skills) is no longer blocked.

Drop the incomplete env/printenv blocking rule per reviewer feedback.

Rewrite test_invariant_bash.py to use the correct Bash().execute()
API and cover both the blocked and allowed cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-05 11:36:22 +05:30

13 KiB

Raw Blame History

View Raw