jif 7d9990fa30 Bind unified exec approvals to shell executables (#39311) ...

## Why

An unfamiliar executable can ignore its arguments, so trust in an apparent
inner command must not implicitly trust the executable that runs it.

## What changed

- Evaluate unfamiliar shell executables alongside their parsed commands when
  determining unified exec approval requirements. Inner commands can add
  restrictions, but cannot grant trust to the executable.
- Include the executable in reusable approval keys so approval for one custom
  shell does not apply to another.
- Parse literal PowerShell scripts without launching the requested executable,
  preserving command policy checks before approval.

## Testing

Add cross-platform coverage for spoofed shell paths, allowed and forbidden
inner commands, explicit custom-shell approval, and session approval isolation.

GitOrigin-RevId: 0dd2c7e9a2ac30965ef5fe5de1a8d2968bb5f9d0

2026-08-18 23:00:53 +00:00

..

src

Bind unified exec approvals to shell executables (#39311)

2026-08-18 23:00:53 +00:00

BUILD.bazel

Add a fail-closed Tree-sitter PowerShell lowerer (#39213)

2026-08-18 14:59:43 +00:00

Cargo.toml

Add a fail-closed Tree-sitter PowerShell lowerer (#39213)

2026-08-18 14:59:43 +00:00