release: 2.3.1 - #26
Merged
Merged
Conversation
The Bash(git * main) finding claimed a measured `git push --force origin main`. The machine that ran the measurement carries `Bash(git push *)` in its own user settings, which approves every push by itself, so the run proved nothing about the rule under test. An empty-allow-list control executed the same push, which is what exposed it. Re-measured with Bash(git * main) as the only rule, in a throwaway repository, using effects on disk rather than transcript text as the evidence: `git branch -D main` deleted the branch, and `git -c core.fsmonitor=<script> diff main` ran the named script. With no rule present neither ran, and `git branch -D dev` did not run. No ambient rule covers `git branch`, so the grant is this rule. The replacement is also sharper than the claim it replaces: arbitrary program execution from a rule that reads as a git allowance, which is what the permission documentation warns about when it notes the wildcard covers -c, "which makes git run a program you name". Both wildcard findings now quote the documentation that describes them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A correction release. 2.2.0 shipped a sentence that said "measured" about something the harness could not separate, and 2.3.0 carried it forward.
What was wrong
The
Bash(git * main)finding read: "Measured on Claude Code 2.1.238:Bash(git * main)auto-approvesgit push --force origin mainandgit push --delete origin main."The machine those measurements ran on carries
Bash(git push *)in its own~/.claude/settings.json, which approves every push on its own. A--settingsfile merges with user settings, so the probe could not tell the rule under test from the ambient one. An empty-allow-list control executed the same force push, which is what exposed it.Re-measured, ambient-proof
git branchis covered by no ambient rule on that machine, so it can carry the test. Claude Code 2.1.238,Bash(git * main)as the only rule, throwaway repository, evidence taken from disk rather than transcript text:git branch -D maingit branch -D mainBash(git * main)git branch -D devBash(git * main)git -c core.fsmonitor=<script> diff mainBash(git * main)The last row is arbitrary program execution from a rule that reads as a git allowance, which is sharper than the claim it replaces. It is also documented: the permission page notes the wildcard covers "every git subcommand and every option before it", including
-c, "which makes git run a program you name".Documentation, quoted where it applies
Both wildcard findings now cite the vendor text that describes them. For the leading star that is "In
Bash(* --version), the*stands in for the program, so any program matches", withbash -c 'echo hi' --versionlisted as a match in the documentation's own table. That table also settles the tail behaviour the 2.3.0 check relies on:Bash(* --help *)"matchesnpm --help xbut notnpm --help".Method note
The probe command matters. An earlier version of the leading-star harness used
echo, and Claude Code's read-only classifier can approve such a command by itself, which produced one contradictory row. Every probe here creates a file or deletes a branch, and the check is the effect on disk.1042 tests pass, lint and typecheck clean.