[John-David Dalton (jdalton)]

Ports the Bazel socket.json trust boundary from PR #1632 to the v1.x command layout. Adds --trust-socket-json; rejects repository-controlled Bazel executables and options, and output paths outside the project, unless trusted. Command-line flags continue to override socket.json. Adds resolver and command tests.

---

Note

Medium Risk
Changes default behavior for scans of untrusted repos and gates which Bazel binary and flags run, but the change is intentional hardening with an explicit escape hatch.

Overview
socket manifest bazel no longer honors repository-controlled Bazel execution settings from socket.json unless the user opts in. By default it now rejects bazel/bin, bazelFlags, bazelRc, and bazelOutputBase from the scanned repo’s config, and blocks an out path that resolves outside the project (including symlink escapes). Command-line flags still override without trusting the file.

The inline defaulting logic in cmd-manifest-bazel is replaced by resolveBazelManifestSettings in a new bazel-socket-json-trust module, wired through a --trust-socket-json flag (default off) with structured failure output for JSON and human modes. Resolver and command tests cover refusal, override, trust, and path containment.

^{Reviewed by Cursor Bugbot for commit 4a14490. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.