fix(safeoutputs): prevent symlink exfiltration in create-pr Stage 3#549

Merged

jamesadevine merged 9 commits into

mainfrom

copilot/fix-symlink-exfiltration

May 17, 2026

Commits on May 17, 2026

Initial plan

Copilot
authored and
jamesadevine
committed
fix(safeoutputs): prevent symlink exfiltration in create-pr Stage 3

Copilot
and
jamesadevine
committed
refactor(safeoutputs): extract push_file_change_skipping_symlinks helper

jamesadevine
and
Copilot
committed
fix(safeoutputs): surface metadata errors and allow symlink-removal patches

jamesadevine
and
Copilot
committed
feat(safeoutputs): surface skipped symlinks in PR description and tighten patch check

jamesadevine
and
Copilot
committed
fix(safeoutputs): sanitize symlink paths embedded in PR description markdown

jamesadevine
and
Copilot
committed
fix(safeoutputs): trim() mode-line check and differentiate NotFound metadata errors

jamesadevine
and
Copilot
committed
fix(safeoutputs): surface symlink-skip count and anchor mode check to non-ws header lines

jamesadevine
and
Copilot
committed
fix(safeoutputs): filter bidi controls in symlink paths and sanitize executor messages

jamesadevine
and
Copilot
committed