Repository navigation
fix(claude): close read-only writes through nested agents - #444
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Define and apply the read-only deny list src/local-agent-claude.ts, src/local-agent-claude.test.ts, test/agents-replay/transcripts/claude/read-only.jsonl |
The deny list adds Write, MultiEdit, NotebookEdit, EnterWorktree, Agent, Task, Workflow, CronCreate, and RemoteTrigger. Read-only turns use the list; allowed turns keep an empty deny list. The test checks the added tools, and the replay records a denied Write request. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Merge Risk: 
edb06
-
The replay update reflects the expanded read-only restrictions. No merge-blocking issue is identified; merge after normal checks pass.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: preventing read-only Claude turns from performing writes through nested agents. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the read-only gate
New tools find denial at the state
No file is written by the call
The test confirms the list for all
The rabbit hops away, pleased and small
Comment @coderabbitai help to get the list of available commands.
🚀 Deploying Preview to Cloudflare 🚀Preview Deployments by commit
|
A read-only Claude subagent could modify the checkout: its own Edit was denied, but it started a nested agent whose Write succeeded. Read-only turns denied only Bash and Edit, and the sandbox's denyWrite covers Bash, not Claude's built-in file tools. Read-only turns now also deny Write, MultiEdit, NotebookEdit, and EnterWorktree, and every tool that starts another agent now or later (Agent, Task, Workflow, CronCreate, RemoteTrigger), since those agents do not inherit the parent's denies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
db5f53a to
4ee1446
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
QA on 1.1.0-beta.6 found that a read-only Claude subagent could change the checkout. Asked to fix a bug in read-only mode, Claude's own
Editwas denied as expected, so it started a nested agent through itsAgenttool, and that nested agent'sWritemodifiedsrc/csv.js. Read-only turns denied onlyBashandEdit, the sandbox'sdenyWriteapplies to shell commands rather than Claude's built-in file tools, and agents started by the subagent don't inherit the turn's deny rules.Read-only turns now deny every file-writing tool (
Write,MultiEdit,NotebookEdit, andEnterWorktree, which creates a Git worktree) and every tool that starts another agent now or later (Agent,Task,Workflow,CronCreate,RemoteTrigger). The change stays inside the existing per-turn deny rules, so the warm runtime shared across read-only and write turns is unchanged.Verified against Claude Code with
haiku: the original repro (read-only, "fix the bug, edit the file directly") now only proposes the fix, an explicit request to write a file through a nestedAgentfinds no such tool, and the same request throughWorkflowfinds none either. The checkout stayed clean and no file was created in all three runs.Two things this deliberately doesn't settle. A deny list has to keep pace with new Claude Code tools, so the durable fix is a read-only allowlist, which needs the warm-runtime design reconsidered. And a read-only subagent still sees the user's own tools and connectors (
Artifact, MCP servers such as Gmail or Google Drive), which can cause side effects outside the workspace; whether read-only should block those is a product decision.Stacked on #443.
🤖 Generated with Claude Code
Summary by CodeRabbit