feat(agent): add privilege escalation for least-privilege mode#344

Merged

retr0h merged 21 commits intomainfrom

feat/agent-privilege-escalation

Apr 2, 2026

Commits on Apr 2, 2026

docs: add agent hardening guide with sudoers and capabilities

retr0h
and
claude
committed
docs: add privilege escalation design to agent hardening guide

retr0h
and
claude
committed
docs: remove agent-hardening from sidebar docs

retr0h
and
claude
committed
docs: add agent privilege escalation design spec

retr0h
and
claude
committed
docs: add agent privilege escalation implementation plan

retr0h
and
claude
committed
feat(agent): add privilege escalation config

retr0h
and
claude
committed
feat(agent): add preflight checks for sudo and capabilities

retr0h
and
claude
committed
refactor(service): use RunPrivilegedCmd for write operations

retr0h
and
claude
committed
refactor(providers): use RunPrivilegedCmd for sysctl, host, timezone, ntp writes

retr0h
and
claude
committed
refactor(providers): use RunPrivilegedCmd for user, apt, power, certificate, dns writes

retr0h
and
claude
committed
docs: add agent hardening feature page and config reference

retr0h
and
claude
committed
chore(agent): fix lint errors in preflight

retr0h
and
claude
committed
chore(config): add privilege_escalation to dev config

retr0h
and
claude
committed
chore(config): uncomment privilege_escalation, enable preflight

retr0h
and
claude
committed
refactor(agent): remove preflight config, verify automatically

retr0h
and
claude
committed
refactor(agent): simplify privilege escalation to single enabled field

retr0h
and
claude
committed
refactor(exec): add CommandExecutor interface for testable sudo

retr0h
and
claude
committed
refactor(exec): add CommandExecutor interface for testable sudo

retr0h
and
claude
committed
test(agent): add coverage for readCapEff and preflight Start paths

retr0h
and
claude
committed
test(agent): cover scanner.Err path in readCapEff

retr0h
and
claude
committed
style(agent): fix multi-line function call formatting

retr0h
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(agent): add privilege escalation for least-privilege mode#344

feat(agent): add privilege escalation for least-privilege mode#344
retr0h merged 21 commits intomainfrom
feat/agent-privilege-escalation

Commits on Apr 2, 2026

docs: add agent hardening guide with sudoers and capabilities

docs: add privilege escalation design to agent hardening guide

docs: remove agent-hardening from sidebar docs

docs: add agent privilege escalation design spec

docs: add agent privilege escalation implementation plan

feat(agent): add privilege escalation config

feat(agent): add preflight checks for sudo and capabilities

refactor(service): use RunPrivilegedCmd for write operations

refactor(providers): use RunPrivilegedCmd for sysctl, host, timezone, ntp writes

refactor(providers): use RunPrivilegedCmd for user, apt, power, certificate, dns writes

docs: add agent hardening feature page and config reference

chore(agent): fix lint errors in preflight

chore(config): add privilege_escalation to dev config

chore(config): uncomment privilege_escalation, enable preflight

refactor(agent): remove preflight config, verify automatically

refactor(agent): simplify privilege escalation to single enabled field

refactor(exec): add CommandExecutor interface for testable sudo

refactor(exec): add CommandExecutor interface for testable sudo

test(agent): add coverage for readCapEff and preflight Start paths

test(agent): cover scanner.Err path in readCapEff

style(agent): fix multi-line function call formatting