mirror of
https://github.com/simplex-chat/simplex-chat.git
synced 2026-11-05 19:17:32 +00:00
spacedandy-agents-simplex
a4b9639ef9
In run 38737084248 the credential scrub made Claude Code 2.1.292 require its whole Bash sandbox (bubblewrap and socat) and force the default permission mode, so every ui call failed. The scrub and bubblewrap are dropped: the PreToolUse guard, which runs in -p sessions, keeps Bash to single ui commands, and now logs each decision outside Claude's directory as evidence. The model is Claude Sonnet 5.5 for the last Claude run the session allows. Third Claude run: [claude-test]
26 lines
1.2 KiB
Python
Executable File
26 lines
1.2 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
# PreToolUse hook for Claude on the runner: lets through only Bash commands that run the ui helper, with plain
|
|
# arguments, so the session has no general shell. Claude Code runs read-only commands such as cat and echo without
|
|
# asking in every permission mode, so permission rules alone can't exclude them.
|
|
# Exits 2 for anything else; Claude sees the message as the reason. Each decision is appended to CLAUDE_GUARD_LOG
|
|
# when it is set, as evidence that the hook ran.
|
|
|
|
import json
|
|
import os
|
|
import re
|
|
import sys
|
|
|
|
# nothing that chains, pipes, redirects, substitutes, expands or escapes
|
|
UI_COMMAND = re.compile(r"ui( [^;&|<>$`()\\\r\n]*)?")
|
|
|
|
call = json.load(sys.stdin)
|
|
command = (call.get("tool_input") or {}).get("command", "").strip()
|
|
allowed = call.get("tool_name") != "Bash" or UI_COMMAND.fullmatch(command)
|
|
if os.environ.get("CLAUDE_GUARD_LOG"):
|
|
with open(os.environ["CLAUDE_GUARD_LOG"], "a") as log:
|
|
log.write(f"{'allow' if allowed else 'refuse'} {call.get('tool_name')}: {command[:200]!r}\n")
|
|
if not allowed:
|
|
print(f"Only the ui helper runs here, as one command: ui <command> [args]. Refused: {command[:200]}", file=sys.stderr)
|
|
sys.exit(2)
|