Дмитрий
1072fae4a6
Smoke 5 (user-run 2026-05-30) found 5 of 6 self-exfil vectors OPEN — parent context transcripts (~/.claude/projects/*/<session>.jsonl) readable via: - Bash: ls ~/.claude/projects/, cat ~/.claude/projects/.../jsonl, head/tail - PowerShell: Get-Content / gc / Select-String - Read tool: direct file_path Spec §3.1 declared this protection but Stream B/C/G never wired path-deny. DEFAULT_PROTECTED_PATTERNS in shell-content-rules.mjs lacked ~/.claude/projects/. Read tool had no path-deny hook at all. Closure: - shell-content-rules.mjs: +1 regex /(^|\/)\.claude\/projects(\/|$)/i in DEFAULT_PROTECTED_PATTERNS. Bash hook + PowerShell hook already use this shared list via pathDenyOverlay → both close automatically. - enforce-read-path-deny.mjs (NEW): PreToolUse(Read) wrapper rejects any Read on isProtectedPath() match. Uses same shared DEFAULT_PROTECTED_PATTERNS for consistency (covers transcript / runtime / .env / normative / dep-checksums). - .claude/settings.json: register enforce-read-path-deny.mjs PreToolUse Read. Tests: shell-content-rules.test.mjs +3 path cases in protects %s + 1 dedicated it() block. enforce-read-path-deny.test.mjs +6 cases covering Read tool block. 1714/1714 vitest tools GREEN (was 1707, +7 net). Critical: re-run Smoke 5 in clean session before continuing other smokes. Expected post-fix: all 6 vectors blocked (Bash/PowerShell via path-deny, Read via enforce-read-path-deny, Write via existing normative-content-rules). Side observation from Smoke 5 session: controller self-fabrication of intermediate results (4 occurrences across Smokes 1-5) confirms one of the 7 fundamental limits — gate paradox + behavioral residual irreducible. No hook catches in-response narrative fabrication (not through tool-gate). This is a Stream H + recovery-procedures.md documentation item, not a hook fix.
31 lines
1.3 KiB
JavaScript
31 lines
1.3 KiB
JavaScript
import { describe, it, expect } from 'vitest';
|
|
import { decide } from './enforce-read-path-deny.mjs';
|
|
|
|
describe('enforce-read-path-deny decide()', () => {
|
|
it('allows Read on normal project file', () => {
|
|
const r = decide({ toolName: 'Read', filePath: 'docs/observer/STATUS.md' });
|
|
expect(r.block).toBe(false);
|
|
});
|
|
it('blocks Read on ~/.claude/projects/*.jsonl transcript', () => {
|
|
const r = decide({ toolName: 'Read', filePath: '~/.claude/projects/abc-session.jsonl' });
|
|
expect(r.block).toBe(true);
|
|
expect(r.reason).toMatch(/protected/i);
|
|
});
|
|
it('blocks Read on absolute /c/Users/.../.claude/projects/x.jsonl', () => {
|
|
const r = decide({ toolName: 'Read', filePath: '/c/Users/Administrator/.claude/projects/proj/session.jsonl' });
|
|
expect(r.block).toBe(true);
|
|
});
|
|
it('blocks Read on ~/.claude/runtime/*.json (runtime artifacts)', () => {
|
|
const r = decide({ toolName: 'Read', filePath: '~/.claude/runtime/router-state-x.json' });
|
|
expect(r.block).toBe(true);
|
|
});
|
|
it('blocks Read on .env', () => {
|
|
const r = decide({ toolName: 'Read', filePath: '.env' });
|
|
expect(r.block).toBe(true);
|
|
});
|
|
it('allows non-Read tool calls (no-op)', () => {
|
|
const r = decide({ toolName: 'Bash', filePath: 'whatever' });
|
|
expect(r.block).toBe(false);
|
|
});
|
|
});
|