3 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 5	4edf42ce9f	fix(test): run the secret guard via its own shebang, not through sh ... The suite piped hook input into `sh "$GUARD"`, which overrides the hook's `#!/usr/bin/env bash` and tests an interpreter production never uses. Claude Code executes the hook as a program. On Debian /bin/sh is dash, which has no `set -o pipefail`, so the guard died on line 23 before reading a byte of input: secret-guard.sh: 23: set: Illegal option -o pipefail secret_guard: 0 passed, 20 failed while passing 20/20 on a host where /bin/sh happens to be bash. A security gate that tests green and cannot start is the worst of both, and the test was the only thing standing between those two states. Found because baked-v16 added jq to the runner: this suite needs jq to build its hook JSON, so it had been silently doing nothing in CI and started running for the first time. Same shape as installing zip and immediately learning the gitea backup check had never run -- a missing tool does not announce that it is suppressing a whole suite. Also asserts the hook is executable, since direct invocation depends on the exec bit, and that assertion is what stops this regressing to `sh "$GUARD"`. Checked the rest of the suite: every other `sh "$SUT"` targets a POSIX script, which is correct. hooks/pre-task-ritual.sh is the other bash-shebang hook and has no test at all -- filed separately rather than fixed here. Bump-Type: patch Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-07 22:23:06 +02:00
mathias	a42ec18f40	fix(secret-guard): treat env as a dump only when no command follows ... `env -u VAR cmd` and `env FOO=bar cmd` exec a command with a modified environment and print nothing themselves. The old rule matched any `env` token followed anywhere later by a pipe into a filter, so it blocked the documented 1Password write path and forced a `(unset VAR; cmd)` workaround. False positives only — never a leak — but a guard people route around is a guard on its way out. The rule now denies only when everything after `env` is exhausted by options and VAR=value assignments. That is strictly the dumping shape, and it also closes a hole the two previous rules left open: `env FOO=bar` with no command word prints the whole environment and was allowed. Three new deny/allow pairs pin it, including the 1Password write shape that motivated the report. 20 cases now, up from 14, all passing. Closes #25 Bump-Type: patch	2026-08-29 09:50:08 +02:00
mathiasandClaude Opus 5	747c6c7f4c	feat(plugin): ship the secret-guard and pre-task-ritual hooks + MCP servers ... The plugin now carries the two hooks Mathias owns and the brain/gitea/infra MCP server definitions, not just skills. Why this matters more than tidiness: both hooks existed ONLY in koala's ~/.claude/, which is host-local and unsynced. flamingo and iguana have been running with no secret-guard at all — that is the control which blocks the decrypt-and-print shape behind the 2026-08-05 ntfy-token leak, the op-item-get shape behind 2026-07-30, and the base64-bypass shape behind 2026-06-11. Its absence on two of three machines is a security gap, not a config gap. Shipping it in the plugin means installing the plugin installs the guard. .mcp.json references tokens as ${BRAIN_MCP_TOKEN} / ${GITEA_MCP_TOKEN} only — env indirection, never literal values, so the manifest is safe to commit. tests/secret_guard_test.sh pins 14 cases. It asserts on hookSpecificOutput.permissionDecision, NOT exit status: the guard always exits 0 by contract, so an exit-status assertion would pass vacuously while the guard silently allowed everything. Each deny case names the incident that produced it. gsd-* hooks are deliberately NOT migrated — GSD owns and updates those in place. Bump-Type: minor Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m	2026-08-23 14:31:04 +02:00