🛡️ Sentinel: Fix symlink hijacking in termux-multi-agent activity_listener

docs/ops/generated/automation-workflow-catalog.json

@@ -27,8 +27,8 @@
     ]
   },
   "schema_version": 1,
-  "source_fingerprint": "3f1b209352bd80b6937bf05995579896881a3d2a4a8a062bd1ec10bbe9dbf2d5",
-  "workflow_count": 77,
+  "source_fingerprint": "efaac6b4b80c3c2dc03a16aa15acd12c1e1537f464a50a35eb984afca9bef348",
+  "workflow_count": 79,
   "workflows": [
     {
       "action_pins": [
@@ -74,9 +74,9 @@
       "concurrency": "group: actions-run-watcher-${{ github.event.workflow_run.id }} cancel-in-progress: false",
       "domain": "agentic-development",
       "jobs": [
-        "notify-failure"
+        "observe-completion"
       ],
-      "name": "Actions Run Watcher — incident notification",
+      "name": "Actions Run Watcher \u2014 incident notification",
       "path": ".github/workflows/actions-run-watcher.yml",
       "schedules": [],
       "triggers": [
@@ -139,7 +139,7 @@
       "jobs": [
         "sync-linear"
       ],
-      "name": "Agent feedback → Linear subtasks",
+      "name": "Agent feedback \u2192 Linear subtasks",
       "path": ".github/workflows/agent-feedback-linear-sync.yml",
       "schedules": [],
       "triggers": [
@@ -190,7 +190,7 @@
         "detect-bot-feedback",
         "invoke-jules-api"
       ],
-      "name": "Agent review → auto Jules",
+      "name": "Agent review \u2192 auto Jules",
       "path": ".github/workflows/agent-review-auto-jules.yml",
       "schedules": [],
       "triggers": [
@@ -240,7 +240,7 @@
       "jobs": [
         "audit"
       ],
-      "name": "Audit Cycle — Single PR Feed-Forward",
+      "name": "Audit Cycle \u2014 Single PR Feed-Forward",
       "path": ".github/workflows/audit-cycle.yml",
       "schedules": [],
       "triggers": [
@@ -327,7 +327,7 @@
       "jobs": [
         "watch"
       ],
-      "name": "\ud83d\udee1️ Direct Master Empty-Commit Watcher",
+      "name": "\ud83d\udee1\ufe0f Direct Master Empty-Commit Watcher",
       "path": ".github/workflows/commit-diff-watcher.yml",
       "schedules": [],
       "triggers": [
@@ -496,7 +496,7 @@
       "jobs": [
         "deepseek-agent"
       ],
-      "name": "DeepSeek CI – Agentic Automation",
+      "name": "DeepSeek CI \u2013 Agentic Automation",
       "path": ".github/workflows/deepseek-ci.yml",
       "schedules": [],
       "triggers": [
@@ -706,7 +706,7 @@
       "jobs": [
         "invoke"
       ],
-      "name": "▶️ Invoke (Gemini PRIMARY → peer Omni ↔ OpenRouter secondary)",
+      "name": "\u25b6\ufe0f Invoke (Gemini PRIMARY \u2192 peer Omni \u2194 OpenRouter secondary)",
       "path": ".github/workflows/gemini-invoke.yml",
       "schedules": [],
       "triggers": [
@@ -725,7 +725,7 @@
       "jobs": [
         "review"
       ],
-      "name": "\ud83d\udd0d Gemini PR Review (Gemini PRIMARY → peer Omni ↔ OpenRouter secondary)",
+      "name": "\ud83d\udd0d Gemini PR Review (Gemini PRIMARY \u2192 peer Omni \u2194 OpenRouter secondary)",
       "path": ".github/workflows/gemini-review.yml",
       "schedules": [],
       "triggers": [
@@ -744,7 +744,7 @@
       "jobs": [
         "triage"
       ],
-      "name": "\ud83c\udff7️ Issue Triage (Gemini PRIMARY → peer Omni ↔ OpenRouter secondary)",
+      "name": "\ud83c\udff7\ufe0f Issue Triage (Gemini PRIMARY \u2192 peer Omni \u2194 OpenRouter secondary)",
       "path": ".github/workflows/gemini-triage.yml",
       "schedules": [],
       "triggers": [
@@ -1058,6 +1058,28 @@
         "workflow_dispatch"
       ]
     },
+    {
+      "action_pins": [
+        "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8",
+        "actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b",
+        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+      ],
+      "authority": "writer",
+      "concurrency": "group: lane-matrix-sweep cancel-in-progress: false",
+      "domain": "agentic-development",
+      "jobs": [
+        "sweep"
+      ],
+      "name": "Lane matrix recursive sweep",
+      "path": ".github/workflows/ops-lane-matrix-sweep.yml",
+      "schedules": [
+        "11 */6 * * *"
+      ],
+      "triggers": [
+        "schedule",
+        "workflow_dispatch"
+      ]
+    },
     {
       "action_pins": [
         "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8"
@@ -1170,7 +1192,7 @@
         "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b"
       ],
       "authority": "read-only-or-advisory",
-      "concurrency": "# Include event_name so comment storms do not cancel PR-sync ledger runs. # cancel-in-progress:false — concurrent ledgers are cheap; cancelled ones are failures. group: pr-production-ledger-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}-${{ github.event_name }} cancel-in-progress: false",
+      "concurrency": "# Include event_name so comment storms do not cancel PR-sync ledger runs. # cancel-in-progress:false \u2014 concurrent ledgers are cheap; cancelled ones are failures. group: pr-production-ledger-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}-${{ github.event_name }} cancel-in-progress: false",
       "domain": "agentic-development",
       "jobs": [
         "ledger"
@@ -1340,6 +1362,26 @@
         "workflow_dispatch"
       ]
     },
+    {
+      "action_pins": [],
+      "authority": "read-only-or-advisory",
+      "concurrency": "",
+      "domain": "agentic-development",
+      "jobs": [
+        "inventory-score"
+      ],
+      "name": "refTemplates continuous eval",
+      "path": ".github/workflows/refTemplates-eval.yml",
+      "schedules": [
+        "17 6 * * *"
+      ],
+      "triggers": [
+        "pull_request",
+        "push",
+        "schedule",
+        "workflow_dispatch"
+      ]
+    },
     {
       "action_pins": [],
       "authority": "read-only-or-advisory",
@@ -1470,7 +1512,7 @@
         "evaluate",
         "lane"
       ],
-      "name": "Team MVT — simultaneous provider lanes",
+      "name": "Team MVT \u2014 simultaneous provider lanes",
       "path": ".github/workflows/team-mvt.yml",
       "schedules": [
         "*/15 * * * *"

termux-multi-agent/dashboard.py

@@ -16,6 +16,43 @@
 except ImportError:
     _has_rich = False
 
+    class Text:
+        def __init__(self, text="", style=None):
+            self.text = text
+            self.style = style
+
+        def append(self, text, style=None):
+            self.text += text
+            return self
+
+        def __str__(self):
+            return self.text
+
+    class Panel:
+        def __init__(self, renderable, title=None, box=None, border_style=None, expand=True):
+            self.renderable = renderable
+            self.title = title
+            self.box = box
+            self.border_style = border_style
+            self.expand = expand
+
+    class Group:
+        def __init__(self, *renderables):
+            self.renderables = renderables
+
+    class Table:
+        def __init__(self, box=None, border_style=None, expand=True):
+            self.columns = []
+            self.rows = []
+
+        def add_column(self, header="", style=None, no_wrap=False, justify="left"):
+            self.columns.append(header)
+
+        def add_row(self, *vals):
+            self.rows.append(vals)
+
+    ROUNDED = None
+
 TELEMETRY_LOG = "agent_telemetry_stream.json"
 if _has_rich:
     console = Console()

termux-multi-agent/workspace/activity_listener.py

@@ -76,6 +76,8 @@ def _init_sandbox(self):
 
         # 🏗️ Self‑building scaffold
         scaffold = PIPELINE_DIR / 'bridge_scaffold.py'
+        if scaffold.is_symlink():
+            raise ValueError("Symlink scaffold path rejected for security")
         if not scaffold.exists():
             scaffold.write_text(self._generate_scaffold())
             scaffold.chmod(0o755)