From 5a24a009547f7a2d93ed468011eed3734e67f317 Mon Sep 17 00:00:00 2001 From: Florian DAVID Date: Sun, 4 Oct 2026 20:48:23 +0200 Subject: [PATCH 1/2] docs: PRIVACY.md, the four claims the second audit round caught (#466) The scratch file holds the log line in every project, not only opted-in ones; a tool call logs every "/" word of its command (URLs included), not its first 120 bytes; bytes-shown markers are not aged out (#469); the worktree check reads git metadata outside the project. Co-Authored-By: Claude Opus 5.5 (1M context) --- PRIVACY.md | 48 ++++++++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 18 deletions(-) diff --git a/PRIVACY.md b/PRIVACY.md index c4a006a..cff60a0 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -10,32 +10,44 @@ and it sends nothing over the network: none of its scripts opens a connection. kept beyond what the log below records. - The entries in your project's `.claude/jit-context/` directory, and its `config.env`. -Nothing outside the project is read, apart from the plugin's own files. The one exception -is `/jit-context:doctor`, run by hand: to say which copy of the plugin is active, it reads -`~/.claude/settings.json` and lists the plugin's own copies in Claude Code's plugin cache. -It prints what it finds to you and keeps nothing. +Outside the project, it reads only the plugin's own files, with two exceptions: + +- On every prompt and tool call, the hooks ask git for the top of the repository you are + standing in and of the project Claude Code opened (`git rev-parse --show-toplevel`). When + the two differ, they tell the model both paths, so it does not edit the wrong worktree. + This reads git's own metadata, nothing else, and is not kept. +- `/jit-context:doctor`, run by hand: to say which copy of the plugin is active, it reads + `~/.claude/settings.json` and lists the plugin's own copies in Claude Code's plugin + cache. It prints what it finds to you and keeps nothing. ## What it writes **In every project, opted in or not:** each prompt and tool-call hook creates a few scratch -files in your temporary directory (`$TMPDIR`, or `/tmp`), named `claude-jit-...`, and deletes -them when the hook exits. They hold the hook's own working data and, in an opted-in project, -the log line below before it is appended to the log. A hook killed outright can leave one -behind; your system's temporary-directory cleanup removes it. +files in your temporary directory (`$TMPDIR`, or `/tmp`), named `claude-jit-...`, readable +by you only, and deletes them when the hook exits. They hold the hook's own working data and +the log line described below, the start of your prompt included, **even in a project that has +not opted in**; there the line is then discarded instead of appended to a log. A hook that is +killed can leave one behind; your system's temporary-directory cleanup removes it. **Only in a project that has opted in**, by having a `.claude/jit-context/` directory, and only inside its `.claude/jit-context/.discovery/`: -- `logs/hooks.log`: one line per hook run, whether or not an entry matched, with the time, - the hook, which entries fired and on which word or path, and the start of what it was - given: the first 80 bytes of the prompt, or of a tool call the first 120 bytes of its - command or the first 200 bytes of its file path. The words that recur in your prompts - with no entry behind them are reported from this log. So anything you type at the very - start of a prompt, a pasted secret included, can end up in this file on your disk. The - log rotates at 20 MB by default and keeps one previous copy, `hooks.log.1`. The size is - set by `JIT_CONTEXT_LOG_MAX_BYTES` in `config.env`. -- `state/`: small per-session markers, so an entry is shown once per session. Markers - older than seven days are removed at the start of the next session. +- `logs/hooks.log`: one line per prompt or tool call, whether or not an entry matched, with + the time, the hook, which entries fired and on which word or path, and part of what it was + given: + - for a prompt, its first 80 bytes; + - for a tool call, up to 120 bytes made of the file path and of every word in the command + that contains a `/` (paths and URLs), wherever it sits in the command, lowercased; + - for a file being touched, up to 200 bytes of the paths involved. + + The words that recur in your prompts with no entry behind them are reported from this + log. So the start of a prompt, and a URL or path anywhere in a command, can end up in this + file on your disk, a secret included if it was pasted there (a token in a URL, say). The + log rotates at 20 MB by default, checked when a session starts, and keeps one previous + copy, `hooks.log.1`. The size is set by `JIT_CONTEXT_LOG_MAX_BYTES` in `config.env`. +- `state/`: small per-session markers, so an entry is shown once per session. Most are + removed after seven days, at the start of a session; the `bytes-shown-*` markers (entry + names and sizes) are currently not, and accumulate until you delete them (#469). Delete `.claude/jit-context/.discovery/` at any time; it holds no configuration, only these records, and is recreated as needed. From f3fabfba66c4391738c69111354ed5dad463f79a Mon Sep 17 00:00:00 2001 From: Florian DAVID Date: Sun, 4 Oct 2026 20:48:32 +0200 Subject: [PATCH 2/2] docs: changelog fragment for the PRIVACY.md correction (#466) Co-Authored-By: Claude Opus 5.5 (1M context) --- changelog.d/466.changed.privacy-precision.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 changelog.d/466.changed.privacy-precision.md diff --git a/changelog.d/466.changed.privacy-precision.md b/changelog.d/466.changed.privacy-precision.md new file mode 100644 index 0000000..09d79a5 --- /dev/null +++ b/changelog.d/466.changed.privacy-precision.md @@ -0,0 +1,6 @@ +- **`PRIVACY.md` is exact about what the hooks keep** (#466). The scratch file in `$TMPDIR` + holds the start of the prompt in every project, not only opted-in ones; a tool call logs + every word of its command that contains a `/`, URLs included, rather than its first 120 + bytes; the `bytes-shown-*` markers are not aged out yet (#469); and the hooks read git's + metadata outside the project to spot a wrong worktree. The second release audit of v0.16.0 + caught all four.