feat(execpolicy): phase-2 deny-matching expressiveness + subagent wiring - #37

Open

asto18089 wants to merge 9 commits into

Pinvou:pinvou3-cleanfrom

asto18089:execpolicy-phase2

Commits on Sep 1, 2026

feat(execpolicy): skip cmd.exe single-letter slash flags
asto18089
committed
bfcf2e8
feat(execpolicy): add middle wildcard token to deny rules
asto18089
committed
e5a6261
feat(execpolicy): fold .exe suffix on deny command word
asto18089
committed
468c9c0
feat(execpolicy): share live rulesets across clones
asto18089
committed
cd79e58
feat(subagent): enforce execpolicy on tool calls
asto18089
committed
17cf60b
style(execpolicy): wrap lock guard expression
asto18089
committed
817d46a
feat(execpolicy): match absolute path rules exactly
asto18089
committed
5313d01
fix(subagent): refuse approval-gated calls in children
asto18089
committed
aa0bf1e
test(execpolicy): pin absolute fallback exact matching
asto18089
committed
aaae513