Resolve the CLI and helper programs via a safe PATH lookup (never the working directory) - #1188

Draft

seanyeoh-ant wants to merge 7 commits into

anthropics:mainfrom

seanyeoh-ant:seanyeoh/safe-executable-resolution

Commits on Aug 5, 2026

feat(internal): add safe executable resolution module
seanyeoh-ant
committed
98f21b5
fix: never resolve the CLI or helper programs from the working directory
seanyeoh-ant
committed
bb88473
build: enforce safe executable resolution (ruff banned-api + AST test)
seanyeoh-ant
committed
62f1408
fix(transport): set NoDefaultCurrentDirectoryInExePath on Windows at import
seanyeoh-ant
committed
78c1545
docs: document the "never spawn by bare name" rule for contributors
seanyeoh-ant
committed
9c896da
fix(internal): keep ExecutableNotFoundError picklable
seanyeoh-ant
committed
c3374ab
fix(internal): harden run()/resolve_argv() edges for parity with anthropic-sdk-python
seanyeoh-ant
committed
8ffa35d