[PR] fix(vetted-ops): name a fixed path in permission rules, not a versioned glob [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1406:
URL: https://github.com/apache/magpie/pull/1406

   ## Problem
   
   The `vetted-op-read` allow rules and sandbox exclusions matched the dispatcher as
   
   ```
   ~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/*/tools/vetted-ops vetted-op-read *
   ```
   
   The `*` stood for the plugin version, but it also matches spaces.
   So a command with extra `uv` options spliced in at that position (`--with <any package>`, a second `--from`) was approved without a prompt, and, because the same pattern is in `sandbox.excludedCommands`, it ran outside the sandbox.
   Claude Code now warns about exactly this rule shape.
   
   Pinning the version instead is not workable: the dev version bumps several times a day, and each bump would silently stop the rule from matching.
   
   ## Fix
   
   - The `magpie-vetted-ops` plugin ships a `SessionStart` hook (`tools/vetted-ops/hooks/link-stable-path.sh`) that points `~/.claude/magpie/vetted-ops` at the installed version every session.
     It only ever replaces a symlink; a real file or directory at that path is left alone and reported.
   - Every rule names that fixed path, with `*` only at the end:
     `Bash(uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *)`, the same for `uv run --project`, and the matching `excludedCommands` entries.
   - `Edit(~/.claude/magpie/**)` joins the deny list next to the plugin-cache deny.
     The path is also outside every `sandbox.filesystem.allowWrite` root.
   - The install, update and verify skills, `secure-agent-setup.md`, the vetted-ops README, the spec and the dogfooded `.claude/settings.json` use the new form.
     Update and verify report a leftover versioned glob as must-fix, including in user-scope settings and agent `tools:` lists.
   - sandbox-lint rejects any Bash `allow` rule with a `*` before its end, so the shape cannot come back.
   
   ## Migration for existing setups
   
   Until a release with the hook is installed, create the link once by hand:
   
   ```
   d=$(ls -d ~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/*/ | sort -V | tail -1); mkdir -p ~/.claude/magpie && ln -sfn "${d}tools/vetted-ops" ~/.claude/magpie/vetted-ops
   ```
   
   then replace the versioned path with `~/.claude/magpie/vetted-ops` in `~/.claude/settings.json`, the project settings and any agent `tools:` list, and add the `Edit(~/.claude/magpie/**)` deny.
   
   ## Not in this PR
   
   - The adversarial-review exclusion has the same mid-rule `*`.
     It has no `allow` (every run still prompts) and its command is generated for Codex, Gemini and Copilot too, so it is a separate change.
   - The osv / cve-org recipes and `issue-sync/gather.md` spell the dispatcher `<framework>/tools/vetted-ops`, which does not match the plugin rules today either.
   
   ## Testing
   
   - `prek run --all-files`: all hooks pass.
   - sandbox-lint tests pass, including the new invariant and baseline tests.
   - The hook was exercised in a scratch `HOME`: it creates the link, re-points it to a new version, refuses to replace a real directory, and exits cleanly without a plugin root.
   - `setup-isolated-setup-verify` evals: 14/16.
     The two failures (`step-2-recommend/case-3-update-needed`, `case-5-multiple`) fail identically on unchanged `main`; this change does not touch the section that step extracts.
   
   ## Generative AI disclosure
   
   This change was prepared with Claude Code (Claude Opus 5) and reviewed by the author.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(vetted-ops): name a fixed path in permission rules, not a versioned glob [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1406:
URL: https://github.com/apache/magpie/pull/1406


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org