Skip to content

Orchestrator-owned guardrails: protected config, spawn-time hook packs, injection and secret scanning #423

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
currentbits merged 9 commits into from
Aug 17, 2026
Merged

Orchestrator-owned guardrails: protected config, spawn-time hook packs, injection and secret scanning #423

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
98b808f
Add orchestrator-owned guardrails policy module (#409)
Aug 17, 2026
612183f
Enforce classifyTool at the Claude can_use_tool seam (#409)
Aug 17, 2026
5ffb26e
Scan inbound issue bodies and memory_store writes for injection (#409)
Aug 17, 2026
16ea88f
Scan secrets on PR create, push diffs, and commit messages (#409)
Aug 17, 2026
ec6e564
Surface the guardrail reason on ask-tier permission prompts (#409)
Aug 17, 2026
018d561
Merge branch 'coder/fork-orchestrator-owned-guardrails-prote-c24688' …
Aug 17, 2026
3b1acb4
Close two holes in the inbound memory scan (#409)
Aug 17, 2026
78afff4
Merge branch 'coder/fork-orchestrator-owned-guardrails-prote-124124' …
Aug 17, 2026
e1b37ae
Tighten the outbound secret scan (#409)
Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions electron/commitmsg.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

const { spawn } = require("node:child_process");
const { getProvider, resolveBin, isBinAvailable } = require("./providers.js");
const { diff } = require("./worktrees.js");
const { diff, assertNoOutboundSecrets } = require("./worktrees.js");
const { fmRun } = require("./fm.js");

const TIMEOUT_MS = 60000;
Expand Down Expand Up @@ -192,7 +192,10 @@ async function suggestCommitMessage(opts) {
const fmOut = await fmRun(prompt, { env });
if (fmOut) {
const message = cleanSubject(fmOut);
if (message) return { message };
if (message) {
assertNoOutboundSecrets(message, "commit message");
return { message };
}
}

const entry = getProvider(thread.provider);
Expand All @@ -218,6 +221,7 @@ async function suggestCommitMessage(opts) {
if (!message) {
throw new Error(`${entry.name} returned an empty message`);
}
assertNoOutboundSecrets(message, "commit message");
return { message };
}

Expand Down
Loading
Loading