fix(sandbox): close classifier evidence gaps (round 2)

2026-08-03 17:48:41 +08:00
parent 6343d8f6e6 731f16ceb0
commit 295a799785
118 changed files with 2770 additions and 262 deletions
@@ -52,7 +52,12 @@ export function classifyRunnerFailure(
  for (const rule of rules) {
    if (rule.allowedExitCodes !== undefined && !rule.allowedExitCodes.includes(exitCode)) continue
    const informationalLines = new Set((rule.informationalLines ?? []).map(line => line.toLowerCase()))
-    const fatalSignatures = rule.fatalSignatures.map(signature => signature.toLowerCase())
+    // An empty substring matches every string in JavaScript. Ignore it so a
+    // malformed public rule cannot turn a gated exit status into evidence by
+    // itself; keep any valid signatures beside it active.
+    const fatalSignatures = rule.fatalSignatures
+      .filter(signature => signature.length > 0)
+      .map(signature => signature.toLowerCase())
    for (const line of lines) {
      const lowered = line.toLowerCase()
      if (informationalLines.has(lowered)) continue