fix(security): P0-1 config/permissions trust model — deny-by-default project config + grant provenance#103

Merged

shoom1 merged 6 commits into

fix/p01-config-trust-model

Jul 12, 2026

Commits on Jul 12, 2026

feat(config): deny-by-default allowlist for project settings.json (P0-1)
shoom1
committed
feat(config): filter cwd-relative .env like project settings (P0-1)
shoom1
committed
test(config): pin list/tuple env_file trusted path (Task 2 review)
shoom1
committed
feat(permissions): write Allow-always grants to user project_grants.json (P0-1)
shoom1
committed
feat(permissions): load grants from user project_grants.json; drop repo-local trust (P0-1)
shoom1
committed
fix(config): expanduser + list-aware dotenv trust guard; soften brick claim (P0-1 review)
shoom1
committed