From de8282c6c7edc72e2a7510a850119eb7b7f6d973 Mon Sep 17 00:00:00 2001
From: zhangtaibo <55699410+zhangtaibo@users.noreply.github.com>
Date: Sat, 4 Jul 2026 04:21:32 +0800
Subject: [PATCH] fix(agent-sec-core): require copilot-shell >= 2.4.0 in
 cosh-hook subpackage

The cosh-hook subpackage provides security hooks (prompt-scanner,
pii-checker, etc.) for copilot-shell. Without a version dependency,
it can be installed against copilot-shell 2.3.0, which lacks the
UserPromptSubmit safety-priority merge fix (commit 42d6cac3).

In copilot-shell 2.3.0, HookAggregator.mergeOutputs uses
last-write-wins (mergeSimple) for UserPromptSubmit, causing a later
'allow' decision to silently override an earlier 'ask' security
interception.

Add Requires: copilot-shell >= 2.4.0 to ensure the safety-priority
merge logic is present.

Fixes #1321
---
 src/agent-sec-core/agent-sec-core.spec.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/agent-sec-core/agent-sec-core.spec.in b/src/agent-sec-core/agent-sec-core.spec.in
index 192e7a0c2..5b8fd6e7f 100644
--- a/src/agent-sec-core/agent-sec-core.spec.in
+++ b/src/agent-sec-core/agent-sec-core.spec.in
@@ -110,6 +110,7 @@ Built with maturin as a Rust native Python extension.
 %package -n agent-sec-cosh-hook
 Summary:        CoPilot Shell security hooks with linux-sandbox
 Requires:       agent-sec-cli = %{version}-%{release}
+Requires:       copilot-shell >= 2.4.0
 Requires:       bubblewrap
 Requires:       python3 >= 3.11
 Requires:       python3 < 3.12