mirror of
https://github.com/stablyai/orca.git
synced 2026-11-01 01:27:35 +00:00
Neil
5784e146de
* feat(wsl): internal distro allowlist for WSL execs on shared test boxes ORCA_INTERNAL_WSL_DISTRO_ALLOWLIST (comma-separated distro names) keeps every wsl.exe call out of distros not on the list: process-host's resolveSpawn, the main and daemon node-pty spawns, and the two codex-accounts calls that bypass process-host. Pure list/status/version calls stay allowed; any other form must name an allowlisted distro, and --shutdown or a default-distro exec is refused. A malformed value refuses every distro and logs once. Unset, the check reads the variable and returns, so behavior is identical to today. * fix(wsl): cover every direct wsl.exe exec with the internal distro allowlist - Restore #34525's worktree-create payload and captured-host test, reverted by accident in the first commit. - Check the allowlist in execFileCapture, the choke point for WSL Git, gh and worker-thread captures, and before the WSL git-read probe, the Codex hook path canonicalization and the CLI login spawn. The WSL watcher now spawns through process-host. - Stop scanning wsl.exe argv at the first positional argument, which wsl.exe runs in the default distro. - check-process-host-imports fails on any direct wsl.exe exec outside process-host that does not call assertWslDistroAllowed. * fix(wsl): check the distro allowlist where resolveCommand produces the wsl.exe form Every Git, gh and glab path into a distro resolves through resolveCommand, so gitExecFileSync, gitSpawn, git stream reads and wslAwareSpawn are covered too; the execFileCapture check is now redundant and removed. The import check also treats buildWslExecArgs as a wsl.exe exec and accepts resolveCommand as covered.