feat: add Tool Script Safety Guard#108

Open

lll-peanut wants to merge 36 commits into

trpc-group:mainfrom

lll-peanut:feat/tool-safety-guard

Commits on Jul 19, 2026

feat: add Tool Script Safety Guard
lll-peanut
committed
feat: add Tool Script Safety Guard
lll-peanut
committed
style: fix flake8 warnings in safety module (unused imports, f-string)
lll-peanut
committed
fix: add AST Python scanner and shlex Bash scanner, fix whitelist_commands dead code, improve redaction, fix 9 false positives

lll-peanut
and
claude
committed
docs: add cd-to-root notice in README quick start
lll-peanut
committed
docs: remove duplicate README, add cd note inline in CLI section
lll-peanut
committed
docs: fix pip install comment breaking copy-paste
lll-peanut
committed
docs: fix CLI and test code blocks for one-click run
lll-peanut
committed
docs: merge cd and commands into single code block per section
lll-peanut
committed
chore: update example reports
lll-peanut
committed
fix: block oversized script bypass — DENY instead of needs_human_review, run blocklist pre-check
lll-peanut
committed
fix: address code review issues in Tool Safety Guard

lll-peanut
and
claude
committed
fix: address second-round code review issues in Tool Safety Guard

lll-peanut
and
claude
committed
fix: enforce max_script_bytes, fix decorator silent skip, rm flag parsing, tee dead branch
lll-peanut
committed
fix: filter type None crash and blocklist Bash bypass
lll-peanut
committed
fix: double-escape regex bypass and multi-field scan
lll-peanut
committed
fix: block_on_review switch, dead code removal, \n in regex
lll-peanut
committed
fix: echo bypass, VAR=val extraction, multi-cmd analysis
lll-peanut
committed
fix: resolve W504 line break after binary operator CI error
lll-peanut
committed
fix: safety_wrapper fail-closed by default (require_script=True)
lll-peanut
committed
fix: echo "$(...)" command substitution bypass
lll-peanut
committed
fix: python alias pollution, pipe splitting, dynamic exec bypass, dd sensitive path
lll-peanut
committed
fix: blocklist_commands enforcement, &-split, scanner cache, W605
lll-peanut
committed

Commits on Jul 20, 2026