Banked: 2026-07-14, cycle304 (command auto-approve bypass fleet on cline/continue/roo - all WALK).
Unlike the file-symlink GhostApproval class (which Wiz left OSS-unswept -> we confirmed cline/continue), the COMMAND auto-approval / allowlist-bypass class is HEAVILY picked-over:
- cline: no allowlist at all - executeSafeCommands is an all-or-nothing boolean (tool-name-only, never inspects the command; raw string -> bash -c). Publicly disclosed: Manifold Security ("Cline Safety Checks Bypassed"), Mindgard, issue #8347 (closed "Not planned"), #7572 (P0 "deleted home directory"). Saturated + by-design.
- Roo-Code: strong parseCommand validator, but the class already has CVE-2026-30307 + GHSA-2rm5-cvcm-7592 + CVE-2025-65946 + others. Residual regex-ordering bypasses exist but are the same CVE'd class AND the repo is ARCHIVED/EOL (see below).
- continue: robust (see #2).
RULE: the command-allowlist-bypass surface on mainstream OSS agents is saturated/disclosed -> do NOT mine it. The file-path/symlink surface was the fresh one.
packages/terminal-security/evaluateTerminalCommandSecurity.ts: a tokenized (shell-quote) 3-tier classifier - isCriticalCommand->disabled (hard-blocked even under --auto), isHighRiskCommand->needs-permission, isSafeCommand->auto, unknown->needs-permission. Reconciliation (evaluateToolPolicies) can only make policy MORE restrictive; a repo/workspace .continue config CANNOT raise tool policy (no schema field, no code path). Default always prompts. This is how to do command auto-approval right. NOTE the inversion: continue was the WORST target on the file-symlink class (auto-read, no prompt) but the BEST on the command class.
A single agent can be weak in one surface and strong in another (continue: weak file-symlink, strong command; cline: weak both). When auditing an agent, score EACH tool-surface independently - do not generalize "this project is secure/insecure" from one subsystem.
Roo-Code's parseCommand masks ${...} BEFORE $(...), hiding subshells nested in param-expansion (echo ${x:-$(rm -rf /)}), and validates a subshell inner as an opaque prefix instead of recursively re-parsing (echo $(echo a && rm -rf /)). Only a real shell AST parse (or bash -n-style) closes the class; regex allowlists always leave residuals. Reusable for any allowlist-by-string-parsing gate.
The roo command finding AND the cycle303-A roo symlink finding both died on target status: RooCodeInc/Roo-Code was archived 2026-05-15 (read-only, shut down). The last-commit date on a shallow clone (2026-05-15) was the tell; confirmed via the GitHub repo page ("archived by owner", users directed to Cline/ZooCode). LESSON: check target archived/EOL status as part of Gate-0 - an archived repo = no fix, no bounty, low value regardless of the bug. A shallow-clone HEAD date >~1 month stale is a prompt to verify archived status BEFORE deep review.
No new finding this cycle (correct - the command class is saturated). Live confirmed OSS GhostApproval findings remain cline + continue (roo downgraded to EOL). Sweep-forward for the FILE-symlink class (the fresh one): ZooCode, void, pearai, aide, melty (apply shell-tool screen + EOL check first).