Source PR: #203
Automated docs-drift finding — needs triage.
PR #203 introduced TargetPathGuardScript, which injects a PowerShell guard into every remote WinRM activity. The guard enforces FileSystemOperation:AllowedRoots and reparse-point rejection on the executing host, not just locally in the C# layer. This is a material change from the previous behaviour, where the docs stated "Remote-WinRM-Ziele bleiben eine explizite Grenze: die API kann die Reparse-Point-Map des Remote-Hosts nicht lokal auflösen" — that sentence is now inverted.
The docs-ui copy (src/nodepilot-docs-ui/content/security/hardening.md) was updated by PR #203 with the full new behaviour. Root docs were not updated with equivalent detail.
Affected doc surfaces:
Why not auto-applied:
The information belongs in docs/claude-reference.md but the exact placement and scope requires a judgment call: it could go as a note on the FileSystemOperation:RejectTraversal hardening-flags row, as an expansion of the FileSystemOperation hot-reload row, or as a new "File Path Roots" section mirroring the docs-ui. All three are plausible; picking the wrong one produces docs that are internally inconsistent in scope/style.
Suggested fix direction: Add a short note to the FileSystemOperation:RejectTraversal hardening-flags table row (or the hot-reload row) stating that remote activities also run the equivalent check on the WinRM target, and point to FileSystemOperation:AllowedRoots. Alternatively, mirror the full "File Path Roots" section from the docs-ui verbatim.
Source PR: #203
Automated docs-drift finding — needs triage.
PR #203 introduced
TargetPathGuardScript, which injects a PowerShell guard into every remote WinRM activity. The guard enforcesFileSystemOperation:AllowedRootsand reparse-point rejection on the executing host, not just locally in the C# layer. This is a material change from the previous behaviour, where the docs stated "Remote-WinRM-Ziele bleiben eine explizite Grenze: die API kann die Reparse-Point-Map des Remote-Hosts nicht lokal auflösen" — that sentence is now inverted.The docs-ui copy (
src/nodepilot-docs-ui/content/security/hardening.md) was updated by PR #203 with the full new behaviour. Root docs were not updated with equivalent detail.Affected doc surfaces:
docs/claude-reference.md— the Hardening-Flags table rowFileSystemOperation:RejectTraversaland the hot-reload table rowFileSystemOperationtogether cover the C# layer, but neither mentions that remote activities now also repeat the check on the WinRM target via the injected PowerShell script. The docs-ui "File Path Roots" section says: "Remote-Aktivitäten wiederholen die Prüfung im PowerShell-Kontext des tatsächlichen WinRM-Ziels." This fact is absent from root docs.Why not auto-applied:
The information belongs in
docs/claude-reference.mdbut the exact placement and scope requires a judgment call: it could go as a note on theFileSystemOperation:RejectTraversalhardening-flags row, as an expansion of theFileSystemOperationhot-reload row, or as a new "File Path Roots" section mirroring the docs-ui. All three are plausible; picking the wrong one produces docs that are internally inconsistent in scope/style.Suggested fix direction: Add a short note to the
FileSystemOperation:RejectTraversalhardening-flags table row (or the hot-reload row) stating that remote activities also run the equivalent check on the WinRM target, and point toFileSystemOperation:AllowedRoots. Alternatively, mirror the full "File Path Roots" section from the docs-ui verbatim.