Files
simplex-chat/scripts/ci/ios-sim
spacedandy-agents-simplex b3dd8b7bf8 ci: let Claude's Bash run only the ui helper, and keep the token out of the upload
Claude Code runs read-only commands (echo, cat, env) without asking in every permission mode, and Bash inherits CLAUDE_CODE_OAUTH_TOKEN, so allow rules alone could not stop a session from printing it (found on the desktop lane). claude-guard.py, a PreToolUse hook passed with --settings, lets through only one ui command with plain arguments and logs every decision to <layout>-guard.log, outside the session's directory. After each session, the session's files and the guard log are searched for the token (given to grep through a pipe); if it is there they are deleted before the upload and the step fails. Run 38729704027's session ran only ui commands and its files contain no token.
2026-10-15 13:27:16 +00:00
..
2026-10-15 12:20:32 +00:00