Repository navigation
Conversation
…al ~ The sandbox exclusions and permission rules name only the ~/.claude/magpie/<tool> spelling of the vetted dispatchers. An agent that expanded ~ to its home directory ran the read inside the sandbox, where gh cannot verify TLS, and then reached for a sandbox bypass or a checkout copy of the dispatcher, which runs code the agent can edit. - A new bundled agent-guard guard, vetted-ops-spelling, refuses a uv run --project / uvx --from launch of vetted-op, vetted-op-read, vetted-op-tracker or adversarial-review from an expanded home path, $HOME/..., or a relative checkout path, and names the ~ command. Another harness's own plugin directory is left alone, and under Codex the absolute stable path its rewrite hook substitutes is let through. Override: MAGPIE_ALLOW_VETTED_PATH=1. - AGENTS.md states it as a golden rule. - The setup skills, secure-agent-setup and the vetted-ops README drop the per-machine absolute-$HOME allow rules and exclusions: the ~ form is the only spelling documented, and verify/update now report a leftover absolute rule for removal. The adversarial-review usage shows the ~ path instead of <plugin>/. Generated-by: Claude Opus 5
github-actions
Bot
added
family:setup
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+652
to
+653
| "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/0.9.0/tools/adversarial-review" | ||
| " adversarial-review detect", |
- uv options on either side of `run` are read, so `uv --project tools/vetted-ops run vetted-op-read` is refused like `uv run --project tools/vetted-ops vetted-op-read`. - An absolute path inside the working tree is refused as a checkout the agent can edit, like a relative one; an absolute path elsewhere is still a harness's own plugin directory. - Under Codex, a vetted-op-read is let through from the exact root the rewrite hook is registered with (`--stable-path` in the Codex configuration, else the account's home), so a trusted `--tool-root` install keeps its rewritten reads. Any other root is one the agent could have built and stays refused, and so do writes, which the hook never rewrites. Generated-by: Claude Opus 5
|
|
||
| def _register_codex_hook(codex_home, root): | ||
| """Write the hook registration `vetted-ops-codex-rules --hook --tool-root <root>` renders.""" | ||
| import json |
…config as TOML - An absolute dispatcher path is checked for membership in a git working tree from the path itself as well as from the cwd, so launching from outside the repository (`uv --directory /repo run --project /repo/tools/vetted-ops ...`) is refused too. An installed plugin cache stays exempt even inside a version-controlled tree. - The Codex hook registration is parsed with tomllib, so valid TOML such as an inline comment after the command no longer hides a registered `--stable-path` root. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why. The sandbox exclusions and permission rules name only the literal
~/.claude/magpie/<tool>spelling of the vetted dispatchers. An agent that expanded~to its home directory ran the read inside the sandbox, whereghfails TLS (OSStatus -26276), and the natural next steps were a sandbox bypass or the checkout copyuv run --project tools/vetted-ops …, which runs code the agent can edit.Guard. A new bundled agent-guard guard,
vetted-ops-spelling, refuses auv run --project/uvx --fromlaunch ofvetted-op,vetted-op-read,vetted-op-trackeroradversarial-reviewwhen the base is:/Users/<you>/…,/home/<you>/…,$HOME/…, or the wrong dispatcher's link);tools/vetted-ops,./…,plugins/…).The refusal names the exact
~command to run. Override:MAGPIE_ALLOW_VETTED_PATH=1(developing the dispatcher itself).~/…/plugins/cache/…) is left to that harness's rules.~on the fly: its existingcodex-expand-stable-pathhook rewrites a lonevetted-op-readto the absolute stable path, and the guard lets exactly that path through when the Codex adapter calls it.dispatch()gains a narrowharnessargument for this; only the Codex adapter sets it. Writes are still not rewritten, so they keep prompting.uv/uvxare checked before thegh/gitfast path; contributed guards still run ongh/gitonly.Golden rule. AGENTS.md → Local setup states it.
Docs use only the
~form.secure-agent-setup, the vetted-ops README (both copies), thevetted-command-surfacespec andsetup-isolated-setup-install/-update/-verifydrop the per-machine absolute-$HOMEallow rules and exclusions. They are no longer needed once the guard redirects that spelling.verify/updatereport a leftover absolute rule for removal; a copy in committed settings stays ✗.~/.claude/magpie/adversarial-reviewinstead of<plugin>/….sandbox-lintkeeps matching ask rules against both bases (an agent without the guard may still produce the absolute form); only its comments change.Type of change
setup-isolated-setup-install,-update,-verify)tools/agent-guardguard set)tools/agent-guardengine + plugin copy,tools/sandbox-lintcomments)Test plan
prek run --all-filespassestools/agent-guardtests: allowed spellings, denied spellings, the named fix, the override, the Codex absolute-path exception (and that any other absolute path is still denied under Codex), plus the Codex adapter test now assertingharness="codex"Notes for reviewers
docs/designs/2026-09-23-adversarial-review.mdkeeps its<plugin>/…wording as history.Gen-AI disclosure: prepared with the assistance of Claude Code (Claude Opus 5); reviewed by the author.
🤖 Generated with Claude Code