Repository navigation
Tighten research agent permissions and a few label server paths - #723
Merged
Merged
Conversation
wagoodman
force-pushed
the
research-and-claims-hardening
branch
from
October 29, 2026 16:15
581fbd8 to
7707177
Compare
- the default research command and the research-vuln skill's allowed-tools granted bare `Read`, `Grep` and `Glob`, so the agent could read files anywhere rather than just the workspace it's working in - the command's read rules now name the workspace by absolute path, like its `Edit` rule (`Read(/$YARDSTICK_ROOT/**)` and so on); the skill's frontmatter can't name the workspace, so it scopes them to `./**` - a person's own settings may allow `Read` more broadly, so the command also passes `--settings` with `blockReadsOutsideWorkingDirectories`, which keeps `Read`, `Grep`, `Glob` and shell reads inside the working directories regardless of allow rules (needs Claude Code v2.1.257+) Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
- `union` scanned the slice for every id it added and callers fed it one related id at a time, sorting after each, so a match with many aliases was quadratic - it now takes every id at once, dedupes with a set and sorts once; the result is the same Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
- the label server re-stamps a gate's view on every request by walking each local claims source, `.git` included, which a corpus never reads and which can hold far more files than the labels - dot directories are skipped, as corpus validation already does Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
- `GET /api/research/{id}/log?raw=1` read the whole log into memory on every call; it's copied from the file now, with the same plain text and nosniff headers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
- `YARDSTICK_CACHE_DIR` and `YARDSTICK_CLAIMS_URL` are the two `YARDSTICK_*` settings read with `os.Getenv` rather than bound by clio - moving them onto clio isn't modest: clio has no app-wide option besides logging, so each would have to be added to every command that reaches the cache or a remote claims source, and re-exported to the research agent and the plugin's scripts, which read them from the environment today - so the cache's variable gets a `DirVar` constant beside `claims.URLVar`, with that reasoning, and nothing else changes Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
force-pushed
the
research-and-claims-hardening
branch
from
October 29, 2026 20:42
7707177 to
713229a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope reads for the researcher to the workspace (by absolute path in the default command, like its
Editrule), and the command denies reads of home dot files/dirs and~/Library, which wins over any allow and coversGrepandGlobtoo. It's a denylist, not a full fence: other paths outside the workspace are still readable if a person's settings allow itsmaller things:
.git) in local claims sourcesGET /api/research/{id}/log?raw=1streams the file instead of reading it wholeYARDSTICK_CACHE_DIRgets a named constant next toYARDSTICK_CLAIMS_URL, with a note on why both stay env vars rather than clio options