Repository navigation
fix(setup): make isolated-setup-verify checks catch false passes - #1808
Merged
Merged
Conversation
github-actions
Bot
added
family:setup
11 tasks done
shahar1
marked this pull request as ready for review
October 25, 2026 06:53
potiuk
requested changes
Oct 25, 2026
potiuk
left a comment
potiuk
left a comment
Member
There was a problem hiding this comment.
Thanks, this is a clear improvement over the old cat/echo probes. A few of the new rules still let a false pass or false fail through; details inline. The first is the one that matters most.
shahar1
force-pushed
the
fix/verify-skill-accuracy
branch
from
October 26, 2026 03:57
20df286 to
457e09f
Compare
A verify run on a Linux host launched from an IDE extension, with the project settings only in settings.local.json, reported several checks as passing that proved nothing: - Check 1 read only the committed project file and never asked for sandbox.filesystem.denyRead. Without "~/" there, bubblewrap reads are deny-only and credential files stay readable. Check 1 now evaluates the merged project, project-local and user settings, requires the home denyRead entry, and names the file each key came from. - Check 7a treated bubblewrap's "No such file or directory" as a pass, which a missing file also prints. It now probes common credential paths with test -r and stat, never cat, and reports inconclusive until the user confirms from a terminal that one exists. - Check 7b echoed AWS_ACCESS_KEY_ID, which the reference sandbox.credentials already unsets, wrapper or not. It now lists variable names only, flags credential-shaped ones, and reports an IDE CLAUDE_CODE_ENTRYPOINT as a warning, since such a session never went through claude-iso. The clean-env wrapper doc says so too. - Checks 5, 10a and 13c compare against a framework checkout the skill never located. A pre-flight now finds it, and reports those comparisons as unchecked when there is none. - Check 10 ran the touch-overlay sub-checks for any signed commit. They now apply only to a hardware key; 10c still applies to every ssh-format key. - Sandbox /dev/null placeholders (character special 1,3) looked like empty untracked files. The verify and doctor skills now say how to recognise them and to take host state from git or the user. The mirrored prompt in secure-agent-setup.md is kept in sync, and the step-1-classify eval suite gains four cases for these verdicts. Generated-by: Claude Code (Claude Opus 5.5)
Check 10 counted a key as hardware only for an sk- public key or an OpenPGP-format card. ssh-format signing through gpg-agent uses the card's aut slot and shows a plain ssh-ed25519 or ssh-rsa key, so a card gpg --card-status finds now counts whatever gpg.format is. Check 7a was inconclusive on every correctly secured host, because with denyRead covering ~/ every path under it looks missing. It now proves the denial with a sentinel: a file known to exist on the host, such as the shell rc, that the sandbox cannot see. Inconclusive is left for the case with no sentinel. The step-1 output spec gains the inconclusive and unchecked verdicts the skill now emits, with cases for both and a step-2 case for the unchecked routing. The rest is review follow-up: managed settings in check 1's merge, the opt-in question for flagged variable names, the running claude-code version beside an unchecked check 5, the credential-shaped wording of the no-print rule, the update prompt's denial probes, and probe output attributed to stat in the fixtures. Generated-by: Claude Code (Claude Opus 5.5)
With no framework checkout, the claude-code min_version floor could not be compared and was reported unchecked, so a marketplace-only install below the minimum passed. Report that floor as warn instead, and route the re-run accordingly. Under zsh on macOS, test -e on a denied sentinel still returns 0, so the 7a sentinel uses test -r with the /dev/null placeholder exception. A sentinel that stays readable and is not a placeholder now means denyRead is not in effect (fail). A one-call test -r ~/.ssh/id_* misreads as "not readable" with two or more matches (a key plus its .pub is enough), and zsh errors out on no match, so keys are listed with find -H (follows a symlinked ~/.ssh), which behaves the same in bash and zsh. A plugged-in smart card that does not hold the signing key made the touch-overlay checks mandatory for software-key users. A card now counts only when it holds the ssh-format signing key, an OpenPGP signing-capable key (looked up by user.signingkey, else the committer email), or the key a gpg-agent ssh remote authenticates with. A new eval case covers a software signing key with an unrelated card. 7b gains more credential-name patterns, and the docs prompt matches the skill. Generated-by: Claude Code (Opus 5.5, Sonnet 5.5)
shahar1
force-pushed
the
fix/verify-skill-accuracy
branch
from
October 26, 2026 05:47
457e09f to
f065e53
Compare
potiuk
approved these changes
Oct 26, 2026
potiuk
left a comment
potiuk
left a comment
Member
There was a problem hiding this comment.
All seven points from my earlier review are addressed on the current head; thanks for the thorough follow-ups and the reasoning on the two you scoped differently.
This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.More on how Apache Magpie handles maintainer review:
Contributing guide.
potiuk
added a commit
that referenced
this pull request
Oct 27, 2026
#1838) * feat(hook-manager): register managers that need no install fix (#1825) Add install strategy 'none' to the hook-manager contract and register managers that write directly to the repository's local hooks directory without requiring global core.hooksPath rewrites: simple-git-hooks, cargo-husky, git-build-hook, and git-code-format-maven-plugin. Document known worktree and configuration caveats. * chore(hook-manager): fix markdownlint blank line and ruff formatting * docs(security): Vulnogram review comments cannot be resolved (#1840) Sync told the operator to "open the CVE record and resolve the review comment". Vulnogram has no resolve action for comments, in the API or the UI, so the step could never be done. A comment is now handled once the body change it asked for is applied, its slug is in the processed-comments ledger, and the reviewer has a courtesy reply. The REVIEW -> READY note in apply-and-push.md and the round trip in the Vulnogram adapter's record.md (which still described the manual #source paste) now say the same. Generated-by: Claude Opus 5 * fix(setup): make isolated-setup-verify checks catch false passes (#1808) * fix(setup): make isolated-setup-verify checks catch false passes A verify run on a Linux host launched from an IDE extension, with the project settings only in settings.local.json, reported several checks as passing that proved nothing: - Check 1 read only the committed project file and never asked for sandbox.filesystem.denyRead. Without "~/" there, bubblewrap reads are deny-only and credential files stay readable. Check 1 now evaluates the merged project, project-local and user settings, requires the home denyRead entry, and names the file each key came from. - Check 7a treated bubblewrap's "No such file or directory" as a pass, which a missing file also prints. It now probes common credential paths with test -r and stat, never cat, and reports inconclusive until the user confirms from a terminal that one exists. - Check 7b echoed AWS_ACCESS_KEY_ID, which the reference sandbox.credentials already unsets, wrapper or not. It now lists variable names only, flags credential-shaped ones, and reports an IDE CLAUDE_CODE_ENTRYPOINT as a warning, since such a session never went through claude-iso. The clean-env wrapper doc says so too. - Checks 5, 10a and 13c compare against a framework checkout the skill never located. A pre-flight now finds it, and reports those comparisons as unchecked when there is none. - Check 10 ran the touch-overlay sub-checks for any signed commit. They now apply only to a hardware key; 10c still applies to every ssh-format key. - Sandbox /dev/null placeholders (character special 1,3) looked like empty untracked files. The verify and doctor skills now say how to recognise them and to take host state from git or the user. The mirrored prompt in secure-agent-setup.md is kept in sync, and the step-1-classify eval suite gains four cases for these verdicts. Generated-by: Claude Code (Claude Opus 5.5) * fix(setup): address review of isolated-setup-verify checks Check 10 counted a key as hardware only for an sk- public key or an OpenPGP-format card. ssh-format signing through gpg-agent uses the card's aut slot and shows a plain ssh-ed25519 or ssh-rsa key, so a card gpg --card-status finds now counts whatever gpg.format is. Check 7a was inconclusive on every correctly secured host, because with denyRead covering ~/ every path under it looks missing. It now proves the denial with a sentinel: a file known to exist on the host, such as the shell rc, that the sandbox cannot see. Inconclusive is left for the case with no sentinel. The step-1 output spec gains the inconclusive and unchecked verdicts the skill now emits, with cases for both and a step-2 case for the unchecked routing. The rest is review follow-up: managed settings in check 1's merge, the opt-in question for flagged variable names, the running claude-code version beside an unchecked check 5, the credential-shaped wording of the no-print rule, the update prompt's denial probes, and probe output attributed to stat in the fixtures. Generated-by: Claude Code (Claude Opus 5.5) * fix(setup): address second review of isolated-setup-verify With no framework checkout, the claude-code min_version floor could not be compared and was reported unchecked, so a marketplace-only install below the minimum passed. Report that floor as warn instead, and route the re-run accordingly. Under zsh on macOS, test -e on a denied sentinel still returns 0, so the 7a sentinel uses test -r with the /dev/null placeholder exception. A sentinel that stays readable and is not a placeholder now means denyRead is not in effect (fail). A one-call test -r ~/.ssh/id_* misreads as "not readable" with two or more matches (a key plus its .pub is enough), and zsh errors out on no match, so keys are listed with find -H (follows a symlinked ~/.ssh), which behaves the same in bash and zsh. A plugged-in smart card that does not hold the signing key made the touch-overlay checks mandatory for software-key users. A card now counts only when it holds the ssh-format signing key, an OpenPGP signing-capable key (looked up by user.signingkey, else the committer email), or the key a gpg-agent ssh remote authenticates with. A new eval case covers a software signing key with an unrelated card. 7b gains more credential-name patterns, and the docs prompt matches the skill. Generated-by: Claude Code (Opus 5.5, Sonnet 5.5) * fix(container-gateway): refuse driver options on volume create (#1842) A volume mount entry with a driver configuration is already refused, but POST /volumes/create (compat and libpod) only checked key spelling before labelling the volume, and the relay then lets a container mount any labelled volume by name. Apply the same rule where the volume is made: only the stock local driver with no options is allowed. The empty options map and local driver both CLIs send on a plain create still pass. Generated-by: Claude Opus 5 * feat(security): add deterministic public-surface scrub Claude Code mod (part of #1497) (#1676) * feat(security): add deterministic public-surface scrub Claude Code mod (part of #1497) Adds a zero-token Claude Code mod in plugins/magpie-security/hooks/ that intercepts Bash commands (git commit, gh pr create, gh pr comment) and guards public surfaces against accidental security embargo leaks (CVE IDs, vulnerability wording, security fix phrasing, and vulnerability classes). - Intercepts tool.call on Bash commands, parsing commit messages (-m, -am, -sm, -F) and PR descriptions (-t, -b, -F, --body-file). - Ingests heredocs and shell pipelines to prevent stdin bypasses. - Exempts private security tracker repositories (-s suffix convention). - Provides MAGPIE_ALLOW_EMBARGO_TERMS=1 maintainer escape hatch for legitimate post-coordinated-disclosure maintenance. - Passes clean behavioral changes through with zero token consumption. - Includes 29 unit tests covering all matching rules, command syntax, edge cases, and hook middleware integration. * fix(security): address maintainer review on deterministic public-surface scrub mod - Limit escape hatch strictly to options.env set by human, removing in-command bypasses. - Scope checks to upstream_repo from project.md; evaluate private tracker exemption per subcommand. - Split multi-command pipelines on shell separators (including newlines) and accept attached short flags. - Fail closed on unreadable message files and indeterminate dynamic input. - Resolve file paths relative to git -C directory without node:path. - Expand test suite to 47 unit tests covering all review shapes. * fix(security): address maintainer review on canonical terms and fail-closed gates (#1676) - Derive forbidden terms directly from canonical magpie_vcs.publication.DEFAULT_TERMS using tools/dev/sync-forbidden-terms.py, with pre-commit hook to prevent drift. - Tokenize shell commands with POSIX shell-words parser to handle quotes and escaped quotes. - Track directory context across chained sub-commands (cd <dir> && git ...). - Parse git -C only from global options and disambiguate clustered/attached flags. - Inspect remotes and worktrees to detect contributor fork checkouts as upstream scope. - Fail closed on indeterminate dynamic input with -F <file> guidance. - Pass environment from hook event and add register()-level tests for MAGPIE_ALLOW_EMBARGO_TERMS. - Document mod architecture, tradeoffs, and escape hatch in secure-agent-setup.md. * docs: document sync-forbidden-terms.py and update issue-fix token count stamp * fix(security): address maintainer review #3 on Claude Code hook and CLI parser - Correct Claude Code hook registration: register on('tool.call', { tool: 'Bash' }), read e.command directly, and return { deny: evaluation.reason } on block. - Read environment bypass via $.env.get('MAGPIE_ALLOW_EMBARGO_TERMS') to pass strict plugin validation. - Drop isTrackerCheckout shortcut; inspect git remotes directly and probe fallback user.md for upstream identification. - Expand CLI subcommand parsing in parseSubcommand: * Extract repository targets from PR/issue URLs (https://github.com/<owner>/<repo>/pull/<id>). * Extract leading GH_REPO= environment variables. * Support --body-file in gh pr review. * Inspect gh api --input, -F body=@file, and GraphQL mutations. - Enhance shell splitting and dynamic tokenization: * Split on single & command separator (unless part of >&). * Ignore literal $VAR inside single quotes (e.g. -m 'costs $HOME'). - Calibrate documentation in secure-agent-setup.md regarding zero-token deterministic guard. Generated-by: Antigravity * fix(security): address maintainer review round 4 on public-surface scrub hook - Parse environment.upstream_clone from user.md to detect upstream clone sessions without project.md; expand ~ via HOME/USERPROFILE - Follow .git gitdir pointer in linked worktrees to find common dir - Never exempt gh api graphql mutations from tracker checkout; inspect all -f/-F field values in graphql calls, not just body/title - Extract --trailer values; treat -C, -c, --reuse-message, --reedit-message, --fixup, --squash as dynamic input (fail closed) - Recognise clustered short flags containing m/F in git tag hasMsg gate - Use exact owner/repo slug matching (extractSlugFromUrl) instead of substring .includes(); upstream match takes precedence over tracker - Preserve separator type in splitShellSubcommands; cd only persists across sequential operators (&&, ;, newline), not pipes - Resolve git -C relative to virtualCwd; compose repeated -C flags - Track same-command file redirections; flag referenced files written earlier in the composite command as dynamic input - Remove dead reporterNames/privateTexts/shingle code and orphaned forbidden-terms.json; sync-forbidden-terms.py generates .ts only - Remove (e?.env ?? {}) fallback; read bypass exclusively via $.env.get - Guard process.env access with typeof check for sandbox safety - Add 9 targeted tests for review round 4 hardening * fix(security): address maintainer review round 5 on public-surface scrub hook * fix(security-scrub): invert default to fail-closed on unresolvable shapes and address review 6 findings - Track subshell parenthesis and brace depth in splitShellSubcommands to preserve grouped directory transitions - Extract binary basename to detect absolute and relative git/gh paths (/usr/bin/git, ~/bin/gh, ./git) - Limit command wrapper checking to known wrappers and avoid false positives on plain arguments (grep git, which gh) - Fail closed on repository redirection flags (--git-dir, --work-tree, GIT_DIR, GIT_WORK_TREE) and prevent tracker remote exemption - Skip gh api option values (--input, -F, -H, etc.) when extracting target repository - Treat gh api graphql with --input or @file as mutation to prevent tracker checkout exemption - Strip quotes, trailing slashes, and comments during git remote URL parsing - Track previous mutating commands on composite shell lines and fail closed when reading files - Fall through on dynamic target repositories (-R "$REPO") and unconfigured upstream - Update generateBlockingReason and documentation with accidental-leak guard framing - Add 15 regression tests covering all Round 6 review findings (94/94 passing) * fix(security-scrub): address maintainer review round 7 on public-surface scrub hook - Seed virtualCwd from $.session.root() and event cwd in register() hook to reliably evaluate bare git commit in upstream clones without explicit cd. - Track virtualCwd persistence across subshells vs brace groups: restore cwd after ( ... ) subshell while preserving cwd updates across { ...; }. - Treat wrapped commands as wrapped if git/gh appears in any subsequent token, skipping wrapper options and arguments (timeout 30 git, nice -n 10 git, sudo -u x git). - Strip leading slash and API host prefix in gh api endpoints; do not exempt literal endpoints without owner/repo placeholders via tracker cwd. - Scan all REST field values in gh api (-f, -F, --field, --raw-field) rather than whitelisting body/title. - Consume heredoc bodies up to delimiter without splitting or quote toggling; fail closed on unclosed quotes when git/gh is present. - Treat transparent shell control prefixes (then, do, else, elif, !, if, while, until, {, }) transparently, and fail closed on eval or sh/bash/zsh -c invoking git/gh. - Avoid false positives in unconfigured repositories by falling through to term scan instead of failing closed unconditionally on unconfigured upstream or --git-dir/GIT_DIR. - Restrict --git-dir and GIT_DIR checking to public-surface commands (commit/tag) and fall through to term scan without cwd remote exemption. - Fix typo in gh issue comment commandType. - Add comprehensive regression tests for all review findings (121 passing tests). * fix(security-scrub): guard against misparsing GitHub API non-repo routes as target repos and handle escaped heredoc delimiters * test(security-scrub): add mockup tests for session root and private tracker bare commits * fix(security-scrub): harden public-surface scrub against cd || guards, v3 API routes, env -C, and git merge * fix(security-scrub): address maintainer review round 8 on public-surface scrub hook * build(codex): declare no-op codex-hooks for magpie-security * fix(security-scrub): name --repo <tracker> when the cwd fallback blocks a tracker command The Bash tool call carries no cwd, so register() always takes the session-root fallback and the tracker cwd exemption never applies. A bare tracker command that mentions a CVE id is therefore always blocked; the block message now says to pass --repo <tracker>, the docs say the same, and a register() test covers an event with no cwd. Generated-by: Claude Opus 5 --------- Co-authored-by: Jarek Potiuk <[email protected]> * chore: bump dev version to 0.9.0.dev202610262031 (#1843) Move the dev stamp so adopters' `claude plugin update` picks up the work merged since the previous stamp. The marketplace is served from `main` and the update check compares version strings, so a frozen suffix is a silent no-op: an adopter running that command is told they are already current while sitting behind. Run from the Actions tab by @potiuk. Generated by .github/workflows/bump-dev-version.yml with the documented steps: bump `project.version` in `pyproject.toml`, then `tools/dev/check-family-plugins.py --fix` and `uv lock` to propagate to every manifest. The stamp is UTC at minute resolution. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Jarek Potiuk <[email protected]> * chore(deps): bump certifi from 2026.7.22 to 2026.10.18 (#1844) Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.7.22 to 2026.10.18. - [Commits](https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.18) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.10.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(agent-isolation): hint on container-gateway policy refusals (#1810) * fix(agent-isolation): hint on container-gateway policy refusals A tool that drives the docker CLI (e.g. Airflow's breeze) hides the gateway's 403 body, or gets only "unable to upgrade to h2c, received 403" from an HTTP-upgrade endpoint, so the agent never saw why it was refused and routed around the gateway. Add a hint-hook branch for both signatures and document the refusals (BuildKit, socket bind-mount, untyped docker inspect) and the expected behaviour: report, don't bypass. Generated-by: Claude Code (Opus 5.5, Sonnet 5.5) * test(agent-isolation): parenthesize concatenated parametrize case CodeQL flagged the implicit string concatenation in the gateway-refusal case list as a possible missing comma. Wrap the two-part literal in parentheses so the concatenation is explicit. Generated-by: Claude Code (Opus 5.5) --------- Co-authored-by: Jarek Potiuk <[email protected]> * feat(tools/discourse): list category topics by latest activity (#1841) * feat(tools/discourse): list recent category activity Projects using Discourse need to discover category discussions before fetching individual topics. Resolve category IDs and catalog paths, then read explicit activity-ordered lists through the existing GET client. Filter on bumped_at without substituting the last-message timestamp. Deduplicate matches and look ahead for an additional match so truncation reports evidence rather than assuming that another page contains results. Fail incomplete reads through the existing CLI error channel, and keep the adapter partial until the remaining archive operations are available. Generated-by: Codex (GPT-6) * fix(tools/discourse): bound activity scans and resolve category slugs Use the requested native descending activity order to stop when an explicitly non-pinned topic is older than since. Missing pin evidence must not be replaced by the output default when deciding the cutoff. Keep category metadata separate from slug matching so an empty or unusable slug does not block numeric ID reads or unrelated selections. Resolve bare slugs only at the catalog root, requiring full ancestry or a numeric ID for subcategories and incomplete catalogs. Retain evidence-based truncation and the integer-conversion error channel. Add regressions and clarify the supported CLI behavior. Generated-by: Codex (GPT-6) * refactor(tools/discourse): simplify category list handling Resolve category IDs from native references and restrict catalog lookup to top-level slugs. Treat continuations as signals while rebuilding every request with the fixed category and activity order. Keep whole-page validation and exact truncation, consolidate regressions, and clarify that pinned category topics count toward the result limit. Generated-by: Codex (GPT-6) * fix(tools/discourse): accept rooted category paths Resolve category paths against the configured forum without duplicating its base path. Keep full URL boundaries and reject protocol-relative references before any request. Clarify unsupported list-view suffixes and cover rooted paths on root and subfolder installations. Generated-by: Codex (GPT-6) * refactor(tools/discourse): parenthesise the tag-name lookup The expression in _summary already bound as (name or slug) if dict else tag; the parentheses make that explicit. Generated-by: Claude Opus 5 --------- Co-authored-by: Jarek Potiuk <[email protected]> * feat(harness): support Antigravity, remove Gemini CLI (#1845) * feat(harness): support Antigravity, remove Gemini CLI Google retired Gemini CLI for individual accounts on 2026-06-18 and replaced it with the Antigravity CLI (`agy`). Magpie now supports Antigravity and drops the Gemini CLI harness. - agent-guard: `--antigravity` adapter for the PreToolUse hook on `run_command` (JSON deny decision on stdout); `--gemini` removed. - Secure setup is per user: tools/agent-isolation/antigravity/ ships the settings.json profile (terminal sandbox, proceed-in-sandbox, workspace-only file access, allow/ask/deny rules mapped from the Claude Code baseline) and the hooks.json guard registration for ~/.gemini/config/hooks.json. - sandbox-lint: `--antigravity` checks the profile, deriving the required asks and denies from expected.json; the Gemini profile checks and runtime integration tests are removed. - adversarial-review: `antigravity` backend (stream-json over stdin, plan mode, refuses trees that carry agy workspace hooks or MCP config); the `gemini` backend is removed and a configured `gemini` reviewer gets a pointer to its replacement. - spec-loop: `antigravity` runner profile replaces `gemini`. - setup skills, setup-preflight, evals, docs and specs: Antigravity replaces Gemini CLI; new docs/adapters/antigravity.md and an Antigravity install section; .gemini/, GEMINI.md, gemini-extension.json and docs/adapters/gemini.md are removed. Generated-by: Claude Opus 5 * fix(antigravity): require absolute paths and a confined reviewer mode - sandbox-lint: an installed Antigravity profile with `~/` path rules now fails. Whether agy expands `~` is unverified, so such a rule may enforce nothing; only the shipped template may keep the `~/` form. - adversarial-review: agy takes its permission mode only from the user's settings, so the backend reads it from the `init` event and discards a review run under any mode other than request-review, strict or proceed-in-sandbox. - docs: record that whether the workspace-hook write deny also binds sandboxed shell writes is unverified. Generated-by: Claude Opus 5 * chore: bump dev version to 0.9.0.dev202610270025 (#1846) Move the dev stamp so adopters' `claude plugin update` picks up the work merged since the previous stamp. The marketplace is served from `main` and the update check compares version strings, so a frozen suffix is a silent no-op: an adopter running that command is told they are already current while sitting behind. Run from the Actions tab by @potiuk. Generated by .github/workflows/bump-dev-version.yml with the documented steps: bump `project.version` in `pyproject.toml`, then `tools/dev/check-family-plugins.py --fix` and `uv lock` to propagate to every manifest. The stamp is UTC at minute resolution. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Jarek Potiuk <[email protected]> * feat(harness): support Pi; fix OpenCode install docs (#1847) * WIP: Pi harness (temporary, to be re-committed) Generated-by: Claude Opus 5 * WIP: Pi policy hardening (plain-word unsandboxed rule, symlinks, directory tools) Generated-by: Claude Opus 5 * WIP: Pi integrations (guard tests, spec-loop, adversarial-review, setup, docs, evals; OpenCode docs fix) Generated-by: Claude Opus 5 * build(pi): commit the Pi package lockfile Pi installs a git package's dependencies with `npm install --omit=dev --legacy-peer-deps` in its clone, which honours a committed package-lock.json and does not pass --ignore-scripts. Committing the lockfile pins the sandbox runtime's whole tree to exact versions and integrity hashes, so every user gets the reviewed packages instead of whatever resolves on the day. The lockfile was generated with the same flags plus `--package-lock-only --ignore-scripts` and the repository's 7-day cooldown (`--before`); no package in it has an install script. A Dependabot npm entry keeps it current with the same cooldown. Generated-by: Claude Opus 5 * feat(pi): confirm native writes outside the working folder A native write or edit whose real path, symlinks resolved, falls outside the working folder now needs the user's confirmation, and is refused in a non-interactive run, matching the Antigravity profile's allowNonWorkspaceAccess: false. Generated-by: Claude Opus 5 * fix(pi): follow dangling links and pin the approved write target A write through a dangling symlink is now checked at the link's target, the confirmation shows the resolved target with control characters stripped, and a target that changes while the prompt is open is refused. The node test wrapper's skips are explicit returns (CodeQL py/mixed-returns). Generated-by: Claude Opus 5 * chore(deps): bump the python-deps group across 1 directory with 3 updates (#1850) Bumps the python-deps group with 3 updates in the / directory: [prek](https://github.com/j178/prek), [zizmor](https://github.com/zizmorcore/zizmor) and [ruff](https://github.com/astral-sh/ruff). Updates `prek` from 0.5.5 to 0.5.6 - [Release notes](https://github.com/j178/prek/releases) - [Changelog](https://github.com/j178/prek/blob/main/CHANGELOG.md) - [Commits](https://github.com/j178/prek/compare/v0.5.5...v0.5.6) Updates `zizmor` from 1.30.1 to 1.31.1 - [Release notes](https://github.com/zizmorcore/zizmor/releases) - [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md) - [Commits](https://github.com/zizmorcore/zizmor/compare/v1.30.1...v1.31.1) Updates `ruff` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.17.0...0.17.1) --- updated-dependencies: - dependency-name: prek dependency-version: 0.5.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-deps - dependency-name: zizmor dependency-version: 1.31.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-deps - dependency-name: ruff dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-deps ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the github-actions group with 3 updates (#1849) Bumps the github-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [actions/setup-java](https://github.com/actions/setup-java). Updates `github/codeql-action/init` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump @anthropic-ai/sandbox-runtime (#1848) Bumps the pi-package group with 1 update: [@anthropic-ai/sandbox-runtime](https://github.com/anthropics/sandbox-runtime). Updates `@anthropic-ai/sandbox-runtime` from 0.0.80 to 0.0.81 - [Release notes](https://github.com/anthropics/sandbox-runtime/releases) - [Commits](https://github.com/anthropics/sandbox-runtime/compare/v0.0.80...v0.0.81) --- updated-dependencies: - dependency-name: "@anthropic-ai/sandbox-runtime" dependency-version: 0.0.81 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pi-package ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(harness): Goose plugin hook and whole-process sandbox (#1851) * feat(goose): plugin hook and whole-process sandbox (WIP) Generated-by: Claude Opus 5 * fix(goose): Goose-only skill manifest, file URLs, read-only config Generated-by: Claude Opus 5 * fix(goose): no URL exemption on writes; on-disk letter case for path rules Generated-by: Claude Opus 5 * fix(sandbox): add resolved paths to the sandbox rules (macOS /tmp) Generated-by: Claude Opus 5 * fix(sandbox): resolve only macOS system links in allow lists Generated-by: Claude Opus 5 * feat(goose): integrations, docs, evals; ignore non-Goose hook payloads Generated-by: Claude Opus 5 * fix(goose): fail closed on unexpected hook payloads; reviewer runs outside the tree Generated-by: Claude Opus 5 * fix(hook-manager): address review on #1838 * fix(adversarial-review): keep the end of a reviewer's raw output and its stderr (#1854) The report kept the first 2000 characters of a reviewer's output. A streamed reply ends with the event that says how the run finished, so the part that explains a failure was the part cut off, and stderr from a reviewer that exited 0 without an answer was not kept at all. Keep the first 500 and the last 1500 characters, mark the cut, and add stderr to a malformed reply. Generated-by: Claude Opus 5 * fix(adversarial-review): say why an Antigravity review came back empty (#1852) Headless agy cannot ask for approval, and the first tool it denies ends the turn with an empty response, still marked SUCCESS. A reviewer that reached for a shell command lost its whole review, and the report said only "malformed output". Ask agy to stick to file reads and searches, name the denied tool when it ends without an answer, and correct the docs that called the denial a soft one. Generated-by: Claude Opus 5 * fix(hook-manager): address review 2 on #1838 * fix(code-review): give inline comments the finding's text, not just its rule (#1853) render built each inline comment from `comment`, `explanation` or `rule_id`. Findings in the shape review-flow.md documents carry `quoted_rule` and `suggestion` instead, so every inline comment was posted as the bare rule label and told the contributor nothing. An inline comment now carries the finding as the review body does, minus the excerpt it sits on, and a folded finding falls back to its suggestion before its rule. Generated-by: Claude Opus 5 * Restructure the threat model project-wide and add SECURITY.md (#1859) Rebuild docs/security/threat-model.md on the Alpha-Omega threat-model rubric (sections 1.1-1.19) and widen it from the security skill family to the whole project: enforcement layer, ingest adapters, distribution and configuration. The previous model is carried over unchanged as Appendix B, with a back-map from its sections to the new claims. Add SECURITY.md (report privately to [email protected], link the threat model) and point AGENTS.md and the project manifest at it. Generated-by: Claude Opus 5 * security: one reply, one thread -- never combine replies across threads (#1858) Make it a golden rule that every drafted email answers exactly one inbound thread. Combining the responses to several threads into one message -- the consolidated receipt in security-issue-import, or one foundation-security note listing several dashboard cases -- confuses reporters, who cannot tell which report the reply answers, and the security team, who track each case by its thread and Message-ID. - AGENTS.md and tools/gmail/threading.md carry the rule; issue-import and issue-sync add it as a golden rule; bulk sync, bulk invalidate, deduplicate and cve-allocate point at it. - issue-import drops the cross-thread consolidated receipt; one thread split into several trackers still gets one reply on that thread. - issue-sync's dashboard drafts one asf-security note per case. - security-management wording follows; evals flip the same-reporter case to separate receipts and add a one-thread-split case. Generated-by: Claude Opus 5 * agent-guard: see through more wrappers; read MAGPIE_GUARD_OFF from the hook env (#1860) The guards now unwrap exec, nohup and time as well as env and command, and check a shell's -c string (bash/sh/zsh) as a command line of its own, one level deep. A command line whose quoting cannot be parsed is refused when it names git or gh, instead of being allowed unchecked. MAGPIE_GUARD_OFF is read from the hook's own environment only, so the switch is set by whoever launches the agent rather than written into a command. Per-guard MAGPIE_ALLOW_* overrides work as before, inline or from the hook environment. Generated-by: Claude Opus 5 * container-gateway: refuse writable binds over agent and git config (#1861) * container-gateway: refuse writable binds over agent and git config A container may no longer get a writable bind whose source is, contains or sits under the paths the agent harness and git read their configuration from: .claude/settings*.json, .claude/hooks, .claude/skills, .claude/commands, .claude/agents, .mcp.json, .git, the common git directory's hooks and config, a linked worktree's git directory, the run directory and the personal config layer. The same binds read-only are still allowed, as is a writable bind of a subdirectory that covers none of them. Only an exact `ro` makes a bind read-only, and podman's `U` beside it counts as writable. Generated-by: Claude Opus 5 * container-gateway: refuse overlay mount options Generated-by: Claude Opus 5 * container-gateway: protect agent config inside nested worktrees Generated-by: Claude Opus 5 * Tighten adapter defaults: TLS, collaborator rollups, HTTPS-only bridge (#1862) * Tighten adapter defaults: TLS, collaborator rollups, HTTPS-only bridge - imap: connect with a verified TLS context (ssl.create_default_context()). - github-rollup and vetted-ops: a status-rollup comment is read only when its author is the authenticated gh user or a repository collaborator. - jira bridge.groovy: refuse non-HTTPS base URLs and do not follow redirects. - sourcehut: comment bodies go through --body-file only; graphql mutations need --allow-mutation; the service must be a bare subdomain. - jira-patch docs: the reviewed attachment is pinned by id and sha256 before it is applied. Generated-by: Claude Opus 5 * Stop on an unverifiable rollup author; end GraphQL comments at CR Generated-by: Claude Opus 5 * Security workflow: stricter relay detection and advisory URL checks (#1863) * Security workflow: stricter relay detection and advisory URL checks - Forwarder relay detection needs both the adapter's sender pattern and its preamble to match; a single match is surfaced to the user as "not a relay". Relay-derived reporter credit stays a proposal until a human confirms it. - New `security-management issue-sync advisory-archive` check: a Public advisory URL is accepted only for a thread on the advisory list whose root subject is `<CVE-ID>: <description>`, under the configured archive URL, and always with confirmation. - PonyMail: an empty result for a private list reads as "unknown" unless the list is visible to the session. - Docs: egress-gateway, cve-org, forgejo and mailman3 curl notes, and macOS egress in secure-agent-internals. Generated-by: Claude Opus 5 * advisory-archive: require an authorized sender and a configured archive Generated-by: Claude Opus 5 * advisory-archive: parse the sender as a mail header Generated-by: Claude Opus 5 * issue-sync: say the advisory sender is unverified when asking to confirm Generated-by: Claude Opus 5 * agent-guard: a continued heredoc line is not stripped (#1864) Generated-by: Claude Opus 5 * setup: import the pre-flight checker only from outside the working tree (#1866) * setup: import the pre-flight checker only from outside the working tree Pre-flight now runs `python3 -P -m setup_preflight` with PYTHONPATH set to the git directory's apache-magpie/ (or .svn/apache-magpie/) only. `-P` keeps the working tree off the import path, and no in-tree directory is on it, so a repository cannot ship the module pre-flight imports. `config` installs the checker into that checker_dir (new `checker_home()` in layers.py); the regenerated block is in every skill. The checker refuses a Python older than 3.11 before importing anything (exit 3, which the block reads as "did not run"), and the test session refuses to start on one. For a git-tag install, `upgrade`, `verify` and `install` also compare the committed lock's commit anchor with the fetched commit and with the tag resolved upstream. A tag that moved stops the upgrade; re-pinning to it needs `bump-committed` and an explicit confirmation. Generated-by: Claude Opus 5 * setup: trust .svn only in a real working copy; check an existing snapshot's commit Generated-by: Claude Opus 5 * agent-guard: strip heredoc bodies only where bash treats them as data (#1867) * agent-guard: open a heredoc only on an unquoted, uncommented << When a command line cannot be tokenised, the guard strips heredoc bodies before parsing again. It found the `<<WORD` operators with a regex over the raw line, so a `<<EOF` inside quotes or a `#` comment counted as a heredoc, and the lines after it were dropped as its body -- while bash runs them as commands: cat /dev/null # <<EOF it's git push --force EOF The operators are now found by a scan that tracks quotes (including `$'...'` and quotes left open on an earlier line) and stops at a comment. A body naming git / gh under an unquoted delimiter is also no longer stripped when it holds a `$(...)` or backtick substitution, which bash expands even in a heredoc fed to cat or tee. Generated-by: Claude Opus 5 * agent-guard: read heredoc delimiters and shifts as bash does Two more places where the heredoc stripper and bash disagreed: - `<<` inside arithmetic or a parameter expansion (`$[1<<x]`, `${a[1<<x]}`) is a shift, not a heredoc, yet its "body" was stripped. Such a line now leaves the command unstripped. - The delimiter was matched as `[A-Za-z_][\w.-]*` with optional surrounding quotes, so `E-O:F`, `'E'OF` or `E"O"F` closed the body on a different line than bash does. The delimiter is now the whole word up to the next metacharacter, after quote removal, and quoted when any quote or backslash appears in it; a word with `$` or a backtick is not stripped. A body naming git / gh is also stripped only when the introducing line is a bare `cat` / `tee` with plain file arguments and `>` / `>>` redirections. Generated-by: Claude Opus 5 * agent-guard: strip a heredoc body naming git / gh only from a bare cat Rather than chasing each shape in which a heredoc fed to cat / tee is not really data, strip a body naming git or gh only in the narrowest safe shape, and keep the command whole otherwise: - the introducing line starts a command (the line before does not end in `\`, `|`, `&&` or `||`); - its first word is exactly `cat`, `tee`, `/bin/cat` or `/usr/bin/cat`; - the command has no `alias`, no `cat` / `tee` function, and no `$((`, `((`, `$[` or `${` anywhere. Generated-by: Claude Opus 5 * agent-guard: keep a heredoc whole when its output may be run, and see into eval A body naming git / gh fed to a bare cat was still stripped when the cat output itself was run: `(cat <<EOF ... ) | bash`, `{ ...; } | bash`. Instead of matching each wrapper, a body naming git or gh is now stripped only when the command, with its heredoc bodies removed, holds no `$`, backtick, parenthesis or brace, no `alias`, and no `eval`, `source` or `.` in command position. This subsumes the earlier function and arithmetic checks. `eval` hid what it ran from every guard, heredoc or not. Its arguments, joined as bash joins them, are now split and checked like a shell -c string, one level deep. Generated-by: Claude Opus 5 * agent-guard: every heredoc a sink before stripping; harden eval unwrapping A heredoc fed to something other than cat / tee had its body stripped too, so `bash <<A` with `cat(){ bash; }` in its body redefined cat out of sight before a later stripped `cat <<EOF` body naming git ran. When any stripped body names git or gh, every heredoc in the command must now be a qualifying sink, or the command is kept whole. The eval / source / . check also matches them behind `builtin`, `command` or inline assignments (`X=1 eval`). eval unwrapping drops one leading `--` (`eval -- 'git push'`) and treats `builtin eval` like `eval`; an eval whose first argument is any other option is marked unparsed and refused. Generated-by: Claude Opus 5 * agent-guard: see eval through prefix chains; keep heredocs next to eval-like words eval unwrapping now strips any chain of `builtin`, `command`, `--` and `-p` in front of eval (`builtin command -- eval ...`). Any other option in that chain, or after eval, marks the segment unparsed so it is refused. A stripped heredoc body naming git or gh is now kept whenever `eval`, `source`, `.`, `hash` or `enable` appears as a word anywhere in the rest of the command after quote and backslash removal (`xargs e'v'al < s`, `env . s`, `hash -p /bin/bash cat`), not only in command position. The README notes the limit of a command-string guard: a cat heredoc that writes a script a later command runs is out of its reach, since the agent could write the same file with its file tools. Generated-by: Claude Opus 5 * skill-evals(setup): bring seven drifted steps in line with the skill (#1868) Twelve setup cases failed on main because the fixtures or output specs no longer matched what the skill says, not because the skill was wrong: - step-delegate-propose: name skills by their `name`, not their path. - config-local-custom-parser: the parser is confirmed on the user's terminal via trust-parser, with the upstream offer in the same reply; cases 1 and 4 now follow that flow, and "this run" is defined. - step-m3-baseline-pick: security brings magpie-security-tools. - step-m4-install-gates: the hand-off is /magpie-setup:setup adopt; a bare marketplace add has no scope. - step-override-bypass: the reason names the overrides as skipped or applied; "framework defaults" counts as skipped. - uninstall-default-set: enabledPlugins is edited, never preserved. - upgrade-adoption-split: updates_plugins means a version changed. Generated-by: Claude Opus 5 * agent-guard: fail closed on untokenisable lines that can spell git or gh (#1865) * agent-guard: see git / gh through quoting on an untokenisable line A command line shlex cannot tokenise is refused when it names git or gh as a word, and allowed otherwise. The check ran a plain word regex over the raw text, so quoting inside the word hid it, although bash removes the quotes and runs the command: g'i't push --force # it's Quotes and backslashes are now removed before the check, at all three places it runs: the untokenisable line, a stripped heredoc body, and a nested shell -c string. Generated-by: Claude Opus 5 * agent-guard: fail closed on an untokenisable line with an expansion Removing quotes and backslashes still missed words bash builds from an expansion that may be empty or a line continuation: `g$()it`, `g${x:-}it`, `g``it`, `g$@it`, `$CMD`, `g\<newline>it`. An untokenisable line holding `$`, a backtick or a backslash-newline is now refused outright, and the quote removal also drops `$` before a quote (`$'g'h`) and backslash-newline. Generated-by: Claude Opus 5 * agent-guard: fail closed on globs and braces in an untokenisable line `/usr/bin/gi?`, `/usr/bin/g*t`, `/usr/bin/g[i]t` and `/usr/bin/g{i,}t` all resolve to git. An untokenisable line holding `*`, `?`, `[` or `{` is now refused alongside the expansions and line continuations. Generated-by: Claude Opus 5 * setup-preflight: restamp the isolated-setup fingerprint after rebase Generated-by: Claude Opus 5 * adversarial-review: keep agy from handing the review to a subagent (#1871) Asked to list or search a tree, headless agy starts a research subagent and its turn ends at once, SUCCESS, with "waiting for the subagent" as the answer or none at all. Every Antigravity review on a real diff came back empty this way. Told only "file reads", it instead reads directories file by file and runs out of budget. The prompt note now names the tools that work (list_dir, find_by_name, grep_search, view_file / read_file) and forbids subagents, and the output check reports a subagent handoff by name instead of "no response text". Generated-by: Claude Opus 5 * skill-evals(security-issue-sync): follow the dashboard steps as they now read (#1872) step-d0: a proceeding mode asks for a session only after the bridge reports one missing. step-d4: since one reply, one thread, each case with an asf-security finding gets its own note. Generated-by: Claude Opus 5 * setup: import the pre-flight checker from a per-user directory, never from the project (#1870) #1866 moved the checker out of the working tree into the project's VCS directory (<git-common-dir>/apache-magpie/ or .svn/apache-magpie/), on the reasoning that no commit can carry it. That holds for a git commit, but not for a Subversion checkout, which versions a .git/ like any other directory, nor for a tarball, which can carry a .git/ or a .svn/ with its wc.db. `git rev-parse` and layers.py accept such a directory as real, so opening that tree put its planted setup_preflight/ on the import path of every skill's pre-flight. The checker now lives in one per-user directory, ~/.cache/apache-magpie/preflight/, and the block runs PYTHONPATH="$HOME/.cache/apache-magpie/preflight" python3 -P -m setup_preflight. Nothing inside the opened project is ever on the import path, and a project without version control now gets the checker too. The personal configuration layer is unchanged. `upgrade` moves a copy an earlier version left in the project's .git/ or .svn/ as well. Generated-by: Claude Opus 5 * agent-guard: keep a command whole when any line is continued (#1869) Heredoc stripping refused a continued line only when that line opened a heredoc (#1864). Any other line ending in a backslash was read on its own, but bash joins it with the next line: a `#` at the start of that line then sits mid-word instead of opening a comment. That let a guarded command through. In echo x\ #' cat <<EOF ' git push --force EOF bash reads the word `x#'`, whose quote swallows `cat <<EOF` and closes on the `'` line, and then runs `git push --force`. The guard took `#'` for a comment and stripped the `git` line as the body of a `cat` heredoc. Heredoc stripping now keeps the command whole whenever any line outside a heredoc body ends in a backslash, so such a line is refused as unparsable when it names git or gh. A backslash inside a body is still data. Generated-by: Claude Opus 5 * agent-guard: split a command line into commands the way bash does (#1873) * agent-guard: split a command line into commands the way bash does split_segments tokenised with shlex.split, which reads a newline as plain whitespace and only splits on an operator surrounded by spaces. So `echo hi` + newline + `git push`, or `echo hi;git push`, came out as one `echo` segment and no guard saw the git command. Subshells, groups, reserved words and command substitutions hid commands the same way. A small lexer now reads the line with bash's rules: a newline or any control operator ends a command, spaced or not; redirections (2>&1, &>, >|) stay words; `#` comments and quoted text are not commands; a leading reserved word is skipped; subshells, command and process substitutions (also inside double quotes, arithmetic and ${...}) are read as commands of their own. A heredoc body stays data on its command (and in its raw text for the trailer scan), except that its substitutions are read when the delimiter is unquoted, and a body naming git / gh that is fed to anything but a bare cat / tee is read as commands. Generated-by: Claude Opus 5 * agent-guard: close four gaps in the command-line lexer - A `case` word starting a command inside `$( … )` or a subshell makes the line untokenisable: its pattern's `)` would close the construct early, and inside double quotes that hid the rest of the line. - A redirection keeps `&` / `|` only after an unquoted, unescaped `>` / `<`; `echo '>'&git …` splits as bash splits it. - A standalone `{` or `}` ends the command before it, so `function f { git …; }` reaches the guards. - `$'…'` strings decode bash's escapes (`\xHH`, octal, `\uHHHH`, …); `\c` makes the line untokenisable. Generated-by: Claude Opus 5 * agent-guard: keep braces, NULs and `case` from moving command boundaries - `{` opens a group only in command position (or after `function name`) and `}` closes one only right after a control operator or newline; anywhere else a brace is an ordinary word, so `git commit -m x } -m …` keeps its second message on the commit. - A `$'…'` escape that decodes to NUL makes the line untokenisable: bash truncates the word there. - Any unquoted `case` word inside a substitution or subshell makes the line untokenisable, whatever precedes it (`time`, `time -p`, …). - #1865's untokenisable-spelling tests end in an unbalanced quote instead of a `# it's` comment, which the lexer now reads as a comment. Generated-by: Claude Opus 5 * agent-guard: a group behind time or coproc is a group `time { git push; }`, `time -p { … }` and `coproc [NAME] { … }` open a brace group, since `time` (with `-p` / `--`) and `coproc` keep command position. The lexer read the `{` there as a plain word, so the commands inside the group were never checked. Generated-by: Claude Opus 5 * agent-guard: check the command a literal name and leading redirections leave (#1874) * agent-guard: refuse a command whose name is an expansion or a glob A command line that tokenises but spells its command name through an expansion or a glob (`$CMD push`, `"$GIT" push`, `$(echo git) push`, `/usr/bin/gi? push`, `/usr/bin/g{i,}t push`) ran unchecked: the guards cannot see which command it resolves to. #1865 refused such spellings only on a line that could not be tokenised. Now a command whose name, after wrappers are unwrapped, holds `$`, a backtick or a glob or brace character is refused (`agent-guard[expansion]`); `[` and `[[` are exempt, and the vetted-ops and excluded-script spelling guards keep their more specific message. Generated-by: Claude Opus 5 * agent-guard: accept only a literal command name; skip leading redirections The command-name check refused a denylist of expansion and glob characters, which missed zsh's `=git` (expands to git's path) and `g(i)t` glob group. A command name must now be literal: letters, digits, `_ . / + : @ % , -` and an optional leading `~/` (`[` and `[[` aside). A `(` glued to a word other than `name()` or `arr=(…)` makes the line untokenisable, since bash rejects it and zsh reads it as a glob. Redirections written before the command name (`>/dev/null git …`, `2>&1 git …`, `nohup >log env git …`) were read as the command name, so the git command after them was never checked. They are now skipped like leading `NAME=value` assignments, also between wrappers, so the command after them is the one checked; `exec 3>&1` stays allowed. Generated-by: Claude Opus 5 * fix(security-issue-deduplicate): keep the CVE both trackers share (#1857) When the kept and the dropped tracker carry the same CVE ID, classify returned that ID as `retract`, so the proposal offered item 7 as "retract CVE-X, merged into CVE-X": a retraction of the record the kept tracker still needs. classify now proposes a retraction only when the two IDs differ, and apply-plan refuses item 7 when the ID to retract is the kept CVE. The skill and the lifecycle spec say the same: a retraction needs two distinct IDs. Generated-by: Claude Code (Opus 5.5) Signed-off-by: Davide Polato <[email protected]> * setup: trust a VCS directory as the personal layer only when it is unambiguous and ours (#1875) An unadopted project keeps personal configuration in its VCS directory, `<git-common-dir>/apache-magpie/` or `<.svn>/apache-magpie/`. That directory is chosen from what the opened tree carries, and Subversion versions a `.git/` like any other directory while git versions a `.svn/`, so a crafted tree could hide configuration where nobody looks. Every copy of `unadopted_home` now uses the VCS directory only when the current user owns it (git's own `safe.directory` rule) and it is the only one at the root. With both a `.git` and a Subversion working copy there, or a VCS directory another user owns, the home is the in-tree `.apache-magpie-local/`, in plain sight. This replaces the old rule that git wins when both are present. agent-guard runs its own git commands with `core.fsmonitor=false` and an empty `core.hooksPath`, so a crafted `.git/config` names no program the hook runs. The commands it runs today (`rev-parse`, `merge-base`, `rev-list`) do not refresh the index, so this is defence in depth; the pre-flight already reads `.git` in pure Python and never spawns git in the project. Generated-by: Claude Opus 5 * security-cve-allocate: one CVE-allocated draft per reporter, each on its own thread (#1876) A tracker that merged several independent reporters (security-issue- deduplicate keeps each one's thread line) only drafted the "CVE allocated" email to the primary thread, so the other reporters were never told. Under the one-reply-one-thread rule each of them is owed a draft of their own, never one email to all. - draft-plan lists the further reporters' threads in `reporter_threads` when it plans the primary; each is planned by its own run with `thread_id` set and that reporter's data. A relay line is no further reporter; a thread the field does not record is blocked. - proposal, the rollup entry and the recap take one plan per reporter (`drafts`, `notifications`): item 5 creates one draft per reporter thread, and the rollup carries one notification line per reporter, named by its thread. - tracker-updates.md, reporter-draft.md and SKILL.md say so; a new eval case covers the second reporter's draft, which names no other reporter. Generated-by: Claude Opus 5 * test(security): use claude-code/testing tool noun in public-surface-scrub tests (#1855) (#1856) * test(security): use claude-code/testing tool noun in public-surface-scrub tests (#1855) * fix(code-review): give inline comments the finding's text, not just its rule (#1853) render built each inline comment from `comment`, `explanation` or `rule_id`. Findings in the shape review-flow.md documents carry `quoted_rule` and `suggestion` instead, so every inline comment was posted as the bare rule label and told the contributor nothing. An inline comment now carries the finding as the review body does, minus the excerpt it sits on, and a folded finding falls back to its suggestion before its rule. Generated-by: Claude Opus 5 * Restructure the threat model project-wide and add SECURITY.md (#1859) Rebuild docs/security/threat-model.md on the Alpha-Omega threat-model rubric (sections 1.1-1.19) and widen it from the security skill family to the whole project: enforcement layer, ingest adapters, distribution and configuration. The previous model is carried over unchanged as Appendix B, with a back-map from its sections to the new claims. Add SECURITY.md (report privately to [email protected], link the threat model) and point AGENTS.md and the project manifest at it. Generated-by: Claude Opus 5 * security: one reply, one thread -- never combine replies across threads (#1858) Make it a golden rule that every drafted email answers exactly one inbound thread. Combining the responses to several threads into one message -- the consolidated receipt in security-issue-import, or one foundation-security note listing several dashboard cases -- confuses reporters, who cannot tell which report the reply answers, and the security team, who track each case by its thread and Message-ID. - AGENTS.md and tools/gmail/threading.md carry the rule; issue-import and issue-sync add it as a golden rule; bulk sync, bulk invalidate, deduplicate and cve-allocate point at it. - issue-import drops the cross-thread consolidated receipt; one thread split into several trackers still gets one reply on that thread. - issue-sync's dashboard drafts one asf-security note per case. - security-management wording follows; evals flip the same-reporter case to separate receipts and add a one-thread-split case. Generated-by: Claude Opus 5 * agent-guard: see through more wrappers; read MAGPIE_GUARD_OFF from the hook env (#1860) The guards now unwrap exec, nohup and time as well as env and command, and check a shell's -c string (bash/sh/zsh) as a command line of its own, one level deep. A command line whose quoting cannot be parsed is refused when it names git or gh, instead of being allowed unchecked. MAGPIE_GUARD_OFF is read from the hook's own environment only, so the switch is set by whoever launches the agent rather than written into a command. Per-guard MAGPIE_ALLOW_* overrides work as before, inline or from the hook environment. Generated-by: Claude Opus 5 * container-gateway: refuse writable binds over agent and git config (#1861) * container-gateway: refuse writable binds over agent and git config A container may no longer get a writable bind whose source is, contains or sits under the paths the agent harness and git read their configuration from: .claude/settings*.json, .claude/hooks, .claude/skills, .claude/commands, .claude/agents, .mcp.json, .git, the common git directory's hooks and config, a linked worktree's git directory, the run directory and the personal config layer. The same binds read-only are still allowed, as is a writable bind of a subdirectory that covers none of them. Only an exact `ro` makes a bind read-only, and podman's `U` beside it counts as writable. Generated-by: Claude Opus 5 * container-gateway: refuse overlay mount options Generated-by: Claude Opus 5 * container-gateway: protect agent config inside nested worktrees Generated-by: Claude Opus 5 * Tighten adapter defaults: TLS, collaborator rollups, HTTPS-only bridge (#1862) * Tighten adapter defaults: TLS, collaborator rollups, HTTPS-only bridge - imap: connect with a verified TLS context (ssl.create_default_context()). - github-rollup and vetted-ops: a status-rollup comment is read only when its author is the authenticated gh user or a repository collaborator. - jira bridge.groovy: refuse non-HTTPS base URLs and do not follow redirects. - sourcehut: comment bodies go through --body-file only; graphql mutations need --allow-mutation; the service must be a bare subdomain. - jira-patch docs: the reviewed attachment is pinned by id and sha256 before it is applied. Generated-by: Claude Opus 5 * Stop on an unverifiable rollup author; end GraphQL comments at CR Generated-by: Claude Opus 5 * Security workflow: stricter relay detection and advisory URL checks (#1863) * Security workflow: stricter relay detection and advisory URL checks - Forwarder relay detection needs both the adapter's sender pattern and its preamble to match; a single match is surfaced to the user as "not a relay". Relay-derived reporter credit stays a proposal until a human confirms it. - New `security-management issue-sync advisory-archive` check: a Public advisory URL is accepted only for a thread on the advisory list whose root subject is `<CVE-ID>: <description>`, under the configured archive URL, and always with confirmation. - PonyMail: an empty result for a private list reads as "unknown" unless the list is visible to the session. - Docs: egress-gateway, cve-org, forgejo and mailman3 curl notes, and macOS egress in secure-agent-internals. Generated-by: Claude Opus 5 * advisory-archive: require an authorized sender and a configured archive Generated-by: Claude Opus 5 * advisory-archive: parse the sender as a mail header Generated-by: Claude Opus 5 * issue-sync: say the advisory sender is unverified when asking to confirm Generated-by: Claude Opus 5 * agent-guard: a continued heredoc line is not stripped (#1864) Generated-by: Claude Opus 5 * setup: import the pre-flight checker only from outside the working tree (#1866) * setup: import the pre-flight checker only from outside the working tree Pre-flight now runs `python3 -P -m setup_preflight` with PYTHONPATH set to the git directory's apache-magpie/ (or .svn/apache-magpie/) only. `-P` keeps the working tree off the import path, and no in-tree directory is on it, so a repository cannot ship the module pre-flight imports. `config` installs the checker into that checker_dir (new `checker_home()` in layers.py); the regenerated block is in every skill. The checker refuses a Python older than 3.11 before importing anything (exit 3, which the block reads as "did not run"), and the test session refuses to start on one. For a git-tag install, `upgrade`, `verify` and `install` also compare the committed lock's commit anchor with the fetched commit and with the tag resolved upstream. A tag that moved stops the upgrade; re-pinning to it needs `bump-committed` and an explicit confirmation. Generated-by: Claude Opus 5 * setup: trust .svn only in a real working copy; check an existing snapshot's commit Generated-by: Claude Opus 5 * agent-guard: strip heredoc bodies only where bash treats them as data (#1867) * agent-guard: open a heredoc only on an unquoted, uncommented << When a command line cannot be tokenised, the guard strips heredoc bodies before parsing again. It found the `<<WORD` operators with a regex over the raw line, so a `<<EOF` inside quotes or a `#` comment counted as a heredoc, and the lines after it were dropped as its body -- while bash runs them as commands: cat /dev/null # <<EOF it's git push --force EOF The operators are now found by a scan that tracks quotes (including `$'...'` and quotes left open on an earlier line) and stops at a comment. A body naming git / gh under an unquoted delimiter is also no longer stripped when it holds a `$(...)` or backtick substitution, which bash expands even in a heredoc fed to cat or tee. Generated-by: Claude Opus 5 * agent-guard: read heredoc delimiters and shifts as bash does Two more places where the heredoc stripper and bash disagreed: - `<<` inside arithmetic or a parameter expansion (`$[1<<x]`, `${a[1<<x]}`) is a shift, not a heredoc, yet its "body" was stripped. Such a line now leaves the command unstripped. - The delimiter was matched as `[A-Za-z_][\w.-]*` with optional surrounding quotes, so `E-O:F`, `'E'OF` or `E"O"F` closed the body on a different line than bash does. The delimiter is now the whole word up to the next metacharacter, after quote removal, and quoted when any quote or backslash appears in it; a word with `$` or a backtick is not stripped. A body naming git / gh is also stripped only when the introducing line is a bare `cat` / `tee` with plain file arguments and `>` / `>>` redirections. Generated-by: Claude Opus 5 * agent-guard: strip a heredoc body naming git / gh only from a bare cat Rather than chasing each shape in which a heredoc fed to cat / tee is not really data, strip a body naming git or gh only in the narrowest safe shape, and keep the command whole otherwise: - the introducing line starts a command (the line before does not end in `\`, `|`, `&&` or `||`); - its first word is exactly `cat`, `tee`, `/bin/cat` or `/usr/bin/cat`; - the command has no `alias`, no `cat` / `tee` function, and no `$((`, `((`, `$[` or `${` anywhere. Generated-by: Claude Opus 5 * agent-guard: keep a heredoc whole when its output may be run, and see into eval A body naming git / gh fed to a bare cat was still stripped when the cat output itself was run: `(cat <<EOF ... ) | bash`, `{ ...; } | bash`. Instead of matching each wrapper, a body naming git or gh is now stripped only when the command, with its heredoc bodies removed, holds no `$`, backtick, parenthesis or brace, no `alias`, and no `eval`, `source` or `.` in command position. This subsumes the earlier function and arithmetic checks. `eval` hid what it ran from every guard, heredoc or not. Its arguments, joined as bash joins them, are now split and checked like a shell -c string, one level deep. Gen…
potiuk
added a commit
that referenced
this pull request
Oct 28, 2026
* docs(spec-loop): sync specs with contributed functionality Back-fill the specs for the 46 commits since the last sync that changed behaviour without touching a spec: the public-surface scrub mod (#1676), adapter hardening (#1862), the hook managers with install strategy `none` (#1838), Linux `allowAllUnixSockets` and its socket cover (#1809), the touch-overlay dismissal and matcher (#1832, #1833), the per-family Codex manifests (#1836), Vulnogram reviewer comments (#1840), the verify false-pass fixes (#1808), gateway refusal hints (#1810), adversarial-review output and agy fixes (#1852, #1854, #1871), and code-review inline comment text (#1853). Also correct drift found on the way: the threat-model pointer now names Appendix B after the #1859 restructure, the troubleshooting catalogue has fourteen entries, and the overview's Mentoring and Pairing skill counts match docs/modes.md. Generated-by: Claude Opus 5 * docs(marketplace): magpie-security ships its own Codex manifest too #1676 gave magpie-security a .codex-plugin/plugin.json and an empty hooks/codex-hooks.json, because its hooks.json now carries a Claude Code mod, but the "Which manifest Codex reads" table and the Hooks paragraph still named only magpie-setup and magpie-utilities. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A
setup-isolated-setup-verifyrun on a Linux host (Claude Code started from the VS Code extension, adopter settings only in.claude/settings.local.json) reported several checks as passing that proved nothing. This PR closes those false passes:sandbox.filesystem.denyReadto cover~/. Without that entry, bubblewrap reads are deny-only and credential files stay readable from the sandbox.test -r/stat(nevercat). WhendenyReadcovers~/, a sentinel file known to exist on the host proves the denial. It reports inconclusive only when no sentinel is available. Before, a missing~/.aws/credentialsproduced the same output as a working denial.CLAUDE_CODE_ENTRYPOINTand gives ⚠ for IDE-launched sessions, which never pass throughclaude-iso. The old probe (echo $AWS_ACCESS_KEY_ID) passed regardless, becausesandbox.credentialsalready unsets that variable. The clean-env wrapper doc gains a paragraph on IDE launches..apache-magpie/snapshot, or the directory the shell rc sourcesagent-iso.shfrom), and report unchecked rather than ✗ or ⚠ when there is none. A marketplace-only install has notools/directory, and the running claude-code version is still reported.sk-public key, or a card thatgpg --card-statusfinds). 10c still applies to every ssh-format key.1,3, sogit statuslists them as untracked.docs/setup/secure-agent-setup.md(including "Keeping the setup updated") are kept in sync, and never print a credential.Type of change
.claude/skills/<name>/) — eval fixtures updated belowdocs/,README.md,CONTRIBUTING.md)Test plan
prek run --all-files --skip workspace-pytestpassesprek run workspace-pytest --from-ref upstream/main --to-ref HEADpassesskill-eval --cli "claude -p" tools/skill-evals/evals/setup-isolated-setup-verify/: 29/34 pass. All 7 new cases pass. Of the 5 failures, 4 also fail on unmodifiedupstream/main(step-1 case-7; step-2 case-3, case-5, case-6; the baseline run was 20/27). The fifth, step-1 case-14, passed on two re-runs and is not touched by this PR.case-17-deny-read-missing,case-18-local-settings-only,case-19-ide-entrypoint-env,case-20-plain-ssh-signing-key,case-21-7a-inconclusive,case-22-no-framework-checkout; step-2case-7-unchecked-no-checkout. The step-1 status enum gainsinconclusiveandunchecked.RFC-AI-0004 compliance
denyReadand stop printing credential contentscheck-placeholderspasses)Notes for reviewers (optional)
allowAllUnixSocketsexposure (verify check 12) and the sandbox-lint rules. Both PRs add step-1 eval cases and touch the same README case counts, so whichever merges second needs a trivial rebase.claudeCode.claudeProcessWrapper.agent-iso.sh'senv -iallowlist would drop theCLAUDE_CODE_*variables the extension needs, so that needs its own design and will be raised as a separate issue.Generative AI: drafted with Claude Code (Claude Opus 5.5) and checked by an independent Claude Opus review agent; opened as a draft for the author's line-by-line review before it is marked ready.
🤖 Generated with Claude Code