[currentbits]

Closes #305.

One policy module, electron/installScan.js, applied at three install surfaces. Regex-only, local, no network, no ML. Reuses the existing guardrails.js injection and secret scanners rather than reimplementing them, and honours the existing CODER_GUARDRAILS=off escape hatch. Every scan fails open — a feed or parse bug must not brick a shell call.

Each surface reports trusted / caution / blocked. blocked refuses; caution is shown and the user can proceed.

Package installs in agent shells

classifyTool now routes install commands (npm/pnpm/yarn/bun/npx/bunx, pip/uv/poetry, cargo, gem, go) through scanPackageInstall. New setting packageInstallScan:

• blocklist (default) — deny known-malicious names, allow the rest
• ask — prompt on every package install, still deny the blocklist
• off — no intercept

The blocklist is a bundled seed of 16 well-known typosquats plus an optional userData/malware-packages.json overlay (60s TTL).

Also adds run_terminal_command to SHELL_TOOLS — that is grok's shell tool name, which was previously not classified at all.

MCP servers

Enabling a server scans its URL. Blocked: non-http(s) scheme, credentials in the URL, secret-shaped query string, remote plaintext http. Remote https is caution (the server sees agent context); localhost is trusted. Only newly enabled servers are checked, so existing config still saves. getSettings returns a derived trust per server; it is stripped on write and never persisted.

Skills

SKILL.md is scanned on write and on list. Blocked: curl/wget piped to a shell or interpreter, strings that try to disable Solenta guardrails, embedded secrets, prompt-injection patterns, blocklisted package installs. Caution: "run this skill on every request", "rewrite CLAUDE.md/.claude/settings". skills.add takes force: true to override a block; the Skills tab shows a Trusted/Caution/Blocked badge with the findings as its tooltip, and confirms before writing anything non-trusted.

Verification

Run on the branch:

• npm run typecheck — clean
• npx vite build — clean
• npm run test:electron — 1884 pass / 0 fail
• npm run test:renderer — 1476 pass / 0 fail

New coverage: electron/test/install-scan.test.js, plus additions to guardrails.test.js, skills.test.js, settingsModal.test.tsx, skillsTab.test.tsx.

Base

Stacked on #663 (reconcile local main with origin/main). Review and merge that first; this PR retargets to main automatically when it lands. Rebased onto the reconciled history, so this diff is now just the security work: +1527/-50 across 28 files.

An earlier revision of this PR read +2838/-159 across 56 files because the branch was sitting on 5 unpushed local-main commits. That is fixed, not hidden.

Known ceilings

• The blocklist is a static bundled seed with no refresh feed; the overlay file is the upgrade path.
• A blocked MCP URL cannot be forced through the UI (skills can be, with force).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[currentbits]

Rebased onto coder/reconcile-main (#663) and force-pushed. Diff is now the #305 work alone: +1527/-50 across 28 files, no conflicts.

Re-verified after the rebase: typecheck clean, npx vite build clean, electron 1951 pass / 0 fail, renderer 1496 pass / 0 fail.