Phase 1 Track 1.3: Browser clean profile + allow_from default-deny#28

Open

richard-devbot wants to merge 17 commits intoCursorTouch:mainfrom

richard-devbot:richardson/phase1-auth-access

Commits on Apr 19, 2026

Add security hardening design doc and roadmap

authored and
Richardson Gunde
committed
Replace os.system() with subprocess.run() for safe process spawning

authored and
Richardson Gunde
committed
Add bandit, gitleaks, pip-audit, coverage to CI pipeline

authored and
Richardson Gunde
committed
Add AI_PRINCIPLES.md and operator_use/guardrails/ module

authored and
Richardson Gunde
committed
Add security and e2e test suite scaffolds

authored and
Richardson Gunde
committed
Update uv.lock for new dev dependencies (bandit, pip-audit, pytest-cov)

authored and
Richardson Gunde
committed
Fix Qodo review findings: browser classification, path containment, CI cache

authored and
Richardson Gunde
committed
Fix CI failures: bandit, gitleaks org license, pip-audit CVEs

authored and
Richardson Gunde
committed
Default browser to clean profile — copy_auth=false by default [#20]

authored and
Richardson Gunde
committed
Fix allow_from to default-deny on empty list across all channels [#21]

authored and
Richardson Gunde
committed
Add _is_user_allowed and _cfg to BaseChannel — wire default-deny allow_from [#21]

authored and
Richardson Gunde
committed
Gate auth file copying behind copy_auth flag with WARNING log [#20]

authored and
Richardson Gunde
committed
Add copy_auth_domains field to BrowserConfig [#20]

authored and
Richardson Gunde
committed
ci: fix ruff lint errors and upgrade aiohttp to 3.13.5

Richardson Gunde
authored and
Richardson Gunde
committed
test: update plugin tests to match refactored hook architecture

Richardson Gunde
authored and
Richardson Gunde
committed
fix: restore correct import path in mcp/tool.py after rebase (operator_use.agent.tools.service)

Richardson Gunde
authored and
Richardson Gunde
committed
fix: update test imports for refactored tools paths; bump CVE deps

Richardson Gunde
authored and
Richardson Gunde
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Phase 1 Track 1.3: Browser clean profile + allow_from default-deny#28

Phase 1 Track 1.3: Browser clean profile + allow_from default-deny#28
richard-devbot wants to merge 17 commits intoCursorTouch:mainfrom
richard-devbot:richardson/phase1-auth-access

Commits on Apr 19, 2026

Add security hardening design doc and roadmap

Replace os.system() with subprocess.run() for safe process spawning

Add bandit, gitleaks, pip-audit, coverage to CI pipeline

Add AI_PRINCIPLES.md and operator_use/guardrails/ module

Add security and e2e test suite scaffolds

Update uv.lock for new dev dependencies (bandit, pip-audit, pytest-cov)

Fix Qodo review findings: browser classification, path containment, CI cache

Fix CI failures: bandit, gitleaks org license, pip-audit CVEs

Default browser to clean profile — copy_auth=false by default [#20]

Fix allow_from to default-deny on empty list across all channels [#21]

Add _is_user_allowed and _cfg to BaseChannel — wire default-deny allow_from [#21]

Gate auth file copying behind copy_auth flag with WARNING log [#20]

Add copy_auth_domains field to BrowserConfig [#20]

ci: fix ruff lint errors and upgrade aiohttp to 3.13.5

test: update plugin tests to match refactored hook architecture

fix: restore correct import path in mcp/tool.py after rebase (operator_use.agent.tools.service)

fix: update test imports for refactored tools paths; bump CVE deps