Skip to content

fix(acp): preserve one-time permission scope - #10450

Merged
alexhancock merged 1 commit into
mainfrom
jbg/security-acp-allow-once
Jul 15, 2026
Merged

fix(acp): preserve one-time permission scope#10450
alexhancock merged 1 commit into
mainfrom
jbg/security-acp-allow-once

Conversation

@jbg

@jbg jbg commented Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • preserve one-time permission scope when mapping ACP responses
  • fail closed when no matching one-time option is available
  • keep the existing safe narrowing fallback for broader requests

Validation

  • cargo test -p goose --lib acp::common::tests
  • cargo build -p goose
  • cargo clippy -p goose --all-targets -- -D warnings

This finding was discovered by Project Loupe.

@jbg
jbg requested review from DOsinga, alexhancock, baxen and codefromthecrypt and removed request for baxen and codefromthecrypt July 14, 2026 12:01
@alexhancock
alexhancock merged commit 8b3fa59 into main Jul 15, 2026
23 checks passed
@alexhancock
alexhancock deleted the jbg/security-acp-allow-once branch July 15, 2026 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants