diff options
Diffstat (limited to 'src/Agent.Windows/Security/ExecutablePolicy.cs')
| -rw-r--r-- | src/Agent.Windows/Security/ExecutablePolicy.cs | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/Agent.Windows/Security/ExecutablePolicy.cs b/src/Agent.Windows/Security/ExecutablePolicy.cs index 02306fd..f42569a 100644 --- a/src/Agent.Windows/Security/ExecutablePolicy.cs +++ b/src/Agent.Windows/Security/ExecutablePolicy.cs @@ -33,7 +33,7 @@ public sealed class EntryExecutablePolicy( if (_artifactRoots.Any(root => IsAtOrBelow(resolved, root))) return new(resolved, ComputeSha256(resolved), EntryExecutableClassification.WorkspaceArtifact); throw new SandboxPolicyException("process.entry_unknown", $"External Unknown Executable cannot be started as an Entry Process: '{resolved}'.", - "process", resolved, "execute", "Configure an Executable Alias and approve it, or place the Workspace Artifact in a development Workspace."); + "process", resolved, "execute", "Add an execution.entries item to YAML and run agent-mcp apply, or place the Workspace Artifact in a development Workspace."); } public string? ManagedEntryPoint(string executable, IReadOnlyList<string> arguments, string? baseDirectory = null) @@ -77,7 +77,7 @@ public sealed class EntryExecutablePolicy( string actualHash = ComputeSha256(resolved); if (!CryptographicOperations.FixedTimeEquals(Convert.FromHexString(approval.Sha256), Convert.FromHexString(actualHash))) throw new SandboxPolicyException("process.hash_denied", $"Approved Entry Executable SHA-256 changed: '{resolved}'.", - "process", resolved, "execute", $"Re-run executable approve for Alias '{approval.Alias}'."); + "process", resolved, "execute", $"Review Alias '{approval.Alias}' in YAML and run agent-mcp apply."); return new(resolved, actualHash, approval.IsShell ? EntryExecutableClassification.ApprovedShellExecutable : EntryExecutableClassification.ApprovedEntryExecutable, approval.Alias); } |