Gate codepilot_cli_tools_install on SDK-emitted tool-input-delta evidence - #676

Open

canblmz1 wants to merge 9 commits into

op7418:mainfrom

canblmz1:fix/cli-install-execution-integrity

Commits on Aug 31, 2026

fix(cli-tools): gate codepilot_cli_tools_install on raw streamed evidence
Can
committed
4cb2c38
test: prove two simultaneous codepilot_cli_tools_install calls resolve independently
Can
committed
e493faa
fix(cli-tools): close permission bypass in codepilot_cli_tools_install manual dispatch
Can
committed
4cb3d4d
chore(cli-tools): rename test files, drop research-only wording from comments
Can
committed
f3ac5ed
fix(cli-tools): make toolExecutionMs/totalRunMs/abort actually govern the manual install dispatch
Can
committed
8e22f2e
fix(cli-tools): POSIX process-tree kill, Windows listener-leak, no-evidence reconciliation
Can
committed
b5f6c46
fix(cli-tools): authority/SDK-projection witness, post-install abort, POSIX output bound
Can
committed
2705ac2
fix(cli-tools): reject pre-aborted signal before spawning, not after
Can
committed
ed8bc26
chore(cli-tools): reduce PR review burden — comment trims, test consolidation
Can
committed
00055b4