Repository navigation
run: --deny-path resolves in the world the tools act on - #449
Merged
Merged
Conversation
run built its ToolPolicy without in_world, so with a remote exec backend a ~ target in a write or edit expanded to this host's home while the tool wrote under the target's, and a deny-path for the target's home silently never fired. Built the way serve does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JimHGjsfk2Ktm5GxyZJKKk
jaredLunde
enabled auto-merge
October 20, 2026 00:01
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
runbuilt itsToolPolicywithoutin_world, unlikeserve. With a remote exec backend, awrite/editto~/.ssh/id_rsawas checked against this host's home while the tool wrote under the target's home, so--deny-path '/home/agent/.ssh/*'silently never fired.runnow takes the world from its fs backend (Localwhen there is none) and builds the policy throughrun_policy, which appliesin_world. Its tools are rooted at the process cwd, which is the policy's default root, sowith_rootis not needed.Test:
commands::run::tests::a_tilde_target_is_checked_against_the_remote_targets_homefailed with the old construction.🤖 Generated with Claude Code
https://claude.ai/code/session_01JimHGjsfk2Ktm5GxyZJKKk