From de9df98ffa4e1c63bae1c325fe3e861485ac3a50 Mon Sep 17 00:00:00 2001 From: jiezeng2004-design Date: Sat, 25 Jul 2026 15:37:22 +0800 Subject: [PATCH 1/3] docs(security): document external policy gateway pattern --- SECURITY.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 8646b7e2..f21b8c62 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -23,6 +23,21 @@ If the AI client should never be able to reach the rest of your machine, that gu Terminal command execution is a first-class feature. Because it can launch arbitrary programs, path-based and command-based restrictions can be circumvented by design — for example via shell substitution, absolute paths, or invoking another interpreter. These controls are advisory: they make common mistakes less likely; they are not a boundary against a client that is actively trying to escape them. +## Optional external policy gateway + +Deployments that need a policy decision for each operation can place an external +policy gateway between the AI client and Desktop Commander. A gateway can +normalize a tool call, apply file and command policy, request human approval, +forward allowed calls, and write a redacted audit record. + +This is an additional governance layer, not a sandbox. It can govern only calls +that are routed through it; a client connected directly to Desktop Commander can +bypass the gateway. Keep OS-level isolation in place when containment is required. + +The gateway should be implementation-neutral. A local policy service or a tool +such as PatchWarden can implement the pattern, but Desktop Commander does not +require or imply support for any particular gateway. + ## Recommended deployment for stronger isolation For any workload where the AI client must not access the wider machine, run Desktop Commander inside an isolated environment: @@ -64,4 +79,4 @@ If you'd prefer not to disclose publicly, reach out via Discord to arrange priva --- -*Last updated: July 2026* \ No newline at end of file +*Last updated: July 2026* From dd694ad1fe73deef81b647801e7200921d7f0a1b Mon Sep 17 00:00:00 2001 From: jiezeng2004-design Date: Sat, 25 Jul 2026 17:34:48 +0800 Subject: [PATCH 2/3] docs(security): keep gateway guidance vendor-neutral --- SECURITY.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f21b8c62..17192c77 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -34,9 +34,8 @@ This is an additional governance layer, not a sandbox. It can govern only calls that are routed through it; a client connected directly to Desktop Commander can bypass the gateway. Keep OS-level isolation in place when containment is required. -The gateway should be implementation-neutral. A local policy service or a tool -such as PatchWarden can implement the pattern, but Desktop Commander does not -require or imply support for any particular gateway. +Desktop Commander does not require or imply support for any particular gateway +implementation. ## Recommended deployment for stronger isolation From fdac04b05e9905e899b5925399af33141d6e7100 Mon Sep 17 00:00:00 2001 From: jiezeng2004-design Date: Sat, 25 Jul 2026 19:14:07 +0800 Subject: [PATCH 3/3] docs(security): require fail-closed gateway behavior --- SECURITY.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 17192c77..cbb16dfe 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -30,6 +30,9 @@ policy gateway between the AI client and Desktop Commander. A gateway can normalize a tool call, apply file and command policy, request human approval, forward allowed calls, and write a redacted audit record. +Gateway timeouts, errors, and missing policy decisions should fail closed: do +not forward a call without an explicit allow decision or completed approval. + This is an additional governance layer, not a sandbox. It can govern only calls that are routed through it; a client connected directly to Desktop Commander can bypass the gateway. Keep OS-level isolation in place when containment is required.