1grzyb1andClaude Opus 5.5 ac56c4b379 Fix(VIM-4350): Limit the YouTrack Area Claude run to its YouTrack scripts ...

The run reads untrusted ticket text, and `Bash(npx tsx:*)` allowed
`npx tsx -e` with YOUTRACK_TOKEN and the Anthropic key in the environment.

- Allow only the youtrack-cli scripts the prompt uses.
- Force every comment from this run to be private, so it can't publish
  anything it read.
- Pass the dispatch input via env instead of interpolating it into `run:`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-27 11:49:17 +01:00

..

src

Fix(VIM-4350): Limit the YouTrack Area Claude run to its YouTrack scripts

2026-10-27 11:49:17 +01:00

.gitignore

[Experiment] Migrate YouTrack analysis scripts to TypeScript

2025-12-26 00:04:28 +02:00

package-lock.json

chore: update package lock

2026-05-22 16:37:53 +03:00

package.json

Update vitest to 4.0.16

2025-12-29 10:30:33 +02:00

tsconfig.json

[Experiment] Migrate YouTrack analysis scripts to TypeScript

2025-12-26 00:04:28 +02:00