Merged
Conversation
proper-lockfileが~/.claude.lockを$HOME直下に作成するが、seatbelt/systemdの 書き込み許可にこのパスが含まれていなかった。これによりトークンリフレッシュ後の ファイル保存が失敗し、セッション再起動時に不要な/loginが発生していた。
Seatbeltエスケープ関数追加、Keychainセキュリティコメント強化、Linux非対称性文書化 Unit-Number: 001
DEBUGモード時にlog streamでSeatbelt denyイベントを収集、EXIT trapでcleanup、全platformにno-op hook定義 Unit-Number: 002
Unit-Number: 003 Co-Authored-By: Claude <noreply@anthropic.com>
Unit-Number: 003 Co-Authored-By: Claude <noreply@anthropic.com>
Unit-Number: 003 Co-Authored-By: Claude <noreply@anthropic.com>
Unit-Number: 003 Co-Authored-By: Claude <noreply@anthropic.com>
4 tasks
proper-lockfile の mkdir ベースロック取得との競合を回避するため、 存在しないロックディレクトリの事前作成をスキップする。 Unit-Number: 001 Co-Authored-By: Claude <noreply@anthropic.com>
proxy/deny log パスで credentials.sh の rm -rf $_tmpdir trap が 上書きされ、一時クレデンシャルディレクトリが残る問題を修正。 Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
サンドボックスプロファイル修正の正式化とdenyログ機能追加。
WIPで実装済みのKeychain許可・lockfile・atomic write対応を正式化し、Seatbelt denyログの自動記録機能を追加。
受け入れ基準
log stream起動失敗時もjailrun本体は正常に起動するAGENT_SANDBOX_DEBUG=1設定時にdenyログをstderrにも出力する変更概要
_start_deny_log()/_stop_deny_log()によるdenyイベント収集log streamバックグラウンド起動、PID付きログファイルTest plan
Review Summary