fix(runtime): allow safe relative executable PATH entries

[mldangelo-oai]

Summary

Allow a user-selected relative executable search path when it resolves outside the scanned repository.

Changes

• Resolve nonempty relative PATH entries through the existing canonical-path checks.
• Continue excluding repository directories, repository-linked symlinks or junctions, empty entries, and unsafe executables.
• Add a cross-platform regression covering a trusted relative entry alongside repository-local and repository-linked entries.

Testing

• Confirmed the new regression failed before the production change.
• bun test tests-ts/trusted-executable.test.ts tests-ts/targets.test.ts tests-ts/multiscan.test.ts tests-ts/bulk-scan-discovery.test.ts --timeout 30000 (71 passed; 1 Windows-only test skipped).
• bun test tests-ts/runtime.test.ts --timeout 30000 (117 passed; 7 Windows-only tests skipped).
• pnpm --pm-on-fail=ignore run types.
• prettier --check src/trusted-executable.ts tests-ts/trusted-executable.test.ts.
• git diff --check.

Risk and rollout

The resolved executable and inherited PATH remain canonical absolute paths outside the protected repository. Existing repository-shim, symlink, Windows extension, case-insensitive PATH, and credential-configuration protections are unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 1a1fb919ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 1a1fb919ec

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 1dfb39b00b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 1dfb39b00b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[zcrab-oai]

Looks good. Relative executable search paths are canonicalized safely while repository-controlled paths and Windows executable protections remain enforced.