From fc58a280d695919a3cbf3a3e8cfbe1e495eaadf1 Mon Sep 17 00:00:00 2001
From: Yuichi TSUNEMATSU <tsunematsu.yuichi@moneyforwardprivatebank.com>
Date: Sat, 8 Aug 2026 18:40:17 +0900
Subject: [PATCH 1/2] =?UTF-8?q?fix(claude):=20git=E8=A8=B1=E5=8F=AF?=
 =?UTF-8?q?=E3=81=AE=E5=BA=83=E7=AF=84=E3=81=AA=E3=83=AF=E3=82=A4=E3=83=AB?=
 =?UTF-8?q?=E3=83=89=E3=82=AB=E3=83=BC=E3=83=89=E3=81=A8=E3=83=95=E3=83=83?=
 =?UTF-8?q?=E3=82=AF=E3=81=AEfail-open=E3=82=92=E4=BF=AE=E6=AD=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- permissions.allow の Bash(git *) を廃止し、安全なサブコマンド単位の許可に限定
  (git -c/-C 等のグローバルオプションによる任意コマンド実行を無確認で許可していたため)
- PreToolUse フックを dangerouslyDisableSandbox 検知のみから、
  git -c/-C/--exec-path 等の危険なグローバルオプション使用も検知するよう拡張
  (grep失敗時に無条件で素通りするfail-open設計だった点も、jqでの構造化抽出に変更して解消)
- sandbox.filesystem.denyRead に .env/secrets/credentials/*.pem/*.key 等の
  汎用パターンを追加し、Bash経由でも permissions.deny の Read(...) 相当の
  機密ファイル保護が効くようにした
---
 dot_claude/settings.json | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/dot_claude/settings.json b/dot_claude/settings.json
index b50a9b9..ce0f978 100644
--- a/dot_claude/settings.json
+++ b/dot_claude/settings.json
@@ -18,7 +18,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "grep -q '\"dangerouslyDisableSandbox\"[[:space:]]*:[[:space:]]*true' && echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"サンドボックス外での実行には承認が必要です\"}}'; exit 0",
+            "command": "input=$(cat); cmd=$(printf '%s' \"$input\" | jq -r '.tool_input.command // \"\"'); flag=$(printf '%s' \"$input\" | jq -r '.tool_input.dangerouslyDisableSandbox // false'); if [ \"$flag\" = \"true\" ] || printf '%s' \"$cmd\" | grep -Eq '(^|[;&|]|\\$\\()\\s*git\\s+(-c|-C|--exec-path|--upload-pack|--receive-pack)(\\s|=|$)'; then printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"サンドボックス外実行またはgitの危険なグローバルオプション使用には承認が必要です\"}}'; fi; exit 0",
             "timeout": 10,
             "statusMessage": "sandbox-escape-gate"
           }
@@ -28,7 +28,29 @@
   },
   "permissions": {
     "allow": [
-      "Bash(git *)",
+      "Bash(git status)",
+      "Bash(git status *)",
+      "Bash(git log)",
+      "Bash(git log *)",
+      "Bash(git diff)",
+      "Bash(git diff *)",
+      "Bash(git show *)",
+      "Bash(git branch)",
+      "Bash(git branch *)",
+      "Bash(git remote -v)",
+      "Bash(git fetch)",
+      "Bash(git fetch *)",
+      "Bash(git pull)",
+      "Bash(git pull *)",
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(git push)",
+      "Bash(git checkout *)",
+      "Bash(git switch *)",
+      "Bash(git stash*)",
+      "Bash(git tag*)",
+      "Bash(git rev-parse *)",
+      "Bash(git blame *)",
       "WebFetch(domain:github.com)",
       "WebFetch(domain:api.github.com)",
       "WebFetch(domain:raw.githubusercontent.com)",
@@ -96,7 +118,14 @@
         "~/.netrc",
         "~/.config/gcloud/",
         "~/.config/gh/",
-        "~/.kube/"
+        "~/.kube/",
+        "**/.env",
+        "**/.env.*",
+        "**/.envrc",
+        "**/secrets/**",
+        "**/credentials",
+        "**/*.pem",
+        "**/*.key"
       ],
       "allowWrite": [
         "~/.npm",

From 9a4acf2ba20a55e3be40693a31152fa9a1e90bec Mon Sep 17 00:00:00 2001
From: Yuichi TSUNEMATSU <tsunematsu.yuichi@moneyforwardprivatebank.com>
Date: Sun, 9 Aug 2026 17:38:36 +0900
Subject: [PATCH 2/2] =?UTF-8?q?fix(claude):=20git=E3=81=AE=E5=8D=B1?=
 =?UTF-8?q?=E9=99=BA=E3=81=AA=E3=82=AA=E3=83=97=E3=82=B7=E3=83=A7=E3=83=B3?=
 =?UTF-8?q?=E6=A4=9C=E7=9F=A5=E3=81=8Cgit=E7=9B=B4=E5=BE=8C=E3=81=AE?=
 =?UTF-8?q?=E4=BD=8D=E7=BD=AE=E3=81=AB=E9=99=90=E5=AE=9A=E3=81=95=E3=82=8C?=
 =?UTF-8?q?=E3=81=A6=E3=81=84=E3=81=9F=E6=BC=8F=E3=82=8C=E3=82=92=E4=BF=AE?=
 =?UTF-8?q?=E6=AD=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

--upload-pack/--receive-pack は git fetch/pull/push/clone のサブコマンドの
後に置かれるフラグであり、「gitの直後」しか見ていなかった前回の修正では
実際の攻撃パターン（例: git fetch origin --upload-pack=evil）を検知できて
いなかった。

- フックの正規表現を「gitの直後」限定から、--upload-pack/--receive-pack/
  --exec-path はコマンド文字列中のどこにあっても検知する方式に変更
- -c/-C は誤検知(tar -C, curl -c等)を避けるため、"git"という単語が
  コマンド中に存在する場合のみ検知する方式に変更
- GIT_SSH_COMMAND=/GIT_CONFIG_*= の環境変数プレフィックスも新たに検知
- permissions.deny にも Bash(git * --upload-pack*) 等を追加し、
  フックだけでなく許可ルール側でも git fetch */git pull * のワイルドカード
  経由の抜けを二重に塞いだ
---
 dot_claude/settings.json | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/dot_claude/settings.json b/dot_claude/settings.json
index ce0f978..3d31004 100644
--- a/dot_claude/settings.json
+++ b/dot_claude/settings.json
@@ -18,7 +18,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat); cmd=$(printf '%s' \"$input\" | jq -r '.tool_input.command // \"\"'); flag=$(printf '%s' \"$input\" | jq -r '.tool_input.dangerouslyDisableSandbox // false'); if [ \"$flag\" = \"true\" ] || printf '%s' \"$cmd\" | grep -Eq '(^|[;&|]|\\$\\()\\s*git\\s+(-c|-C|--exec-path|--upload-pack|--receive-pack)(\\s|=|$)'; then printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"サンドボックス外実行またはgitの危険なグローバルオプション使用には承認が必要です\"}}'; fi; exit 0",
+            "command": "input=$(cat); cmd=$(printf '%s' \"$input\" | jq -r '.tool_input.command // \"\"'); flag=$(printf '%s' \"$input\" | jq -r '.tool_input.dangerouslyDisableSandbox // false'); danger=false; [ \"$flag\" = \"true\" ] && danger=true; printf '%s' \"$cmd\" | grep -Eq '(^|[[:space:]])(--upload-pack|--receive-pack|--exec-path)(=|[[:space:]]|$)' && danger=true; printf '%s' \"$cmd\" | grep -Eq '(^|[[:space:]])(GIT_SSH_COMMAND=|GIT_CONFIG_[A-Za-z_]*=)' && danger=true; if printf '%s' \"$cmd\" | grep -Eq '(^|[[:space:]])git([[:space:]]|$)' && printf '%s' \"$cmd\" | grep -Eq '(^|[[:space:]])(-c|-C)([[:space:]]|=|$)'; then danger=true; fi; if [ \"$danger\" = \"true\" ]; then printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"サンドボックス外実行またはgitの危険なグローバルオプション使用には承認が必要です\"}}'; fi; exit 0",
             "timeout": 10,
             "statusMessage": "sandbox-escape-gate"
           }
@@ -91,7 +91,12 @@
       "Bash(git push --force *)",
       "Bash(git push -f *)",
       "Bash(git reset --hard *)",
-      "Bash(git clean -f *)"
+      "Bash(git clean -f *)",
+      "Bash(git * --upload-pack*)",
+      "Bash(git * --receive-pack*)",
+      "Bash(git * --exec-path*)",
+      "Bash(git -c *)",
+      "Bash(git -C *)"
     ]
   },
   "sandbox": {