KeiSei84
155d187699
ARCHITECTURAL FIXES (Constructor Pattern — file >200 LOC):
1. safe_tools.rs (738 LOC god-object) → safe_tools/ module (5 files):
- mod.rs (99 LOC) — descriptors + dispatch
- env_guard.rs (79 LOC) — KillPgGuard RAII + apply_safe_env
- path_guard.rs (166 LOC) — validate_path + canonicalize walk-up
- chain_runner.rs (159 LOC) — hook chain loader/runner
- exec.rs (222 LOC) — handle_bash/edit/write with O_NOFOLLOW
2. CRITICAL Grok bypass closed (Claude critic finding):
- REMOVED env-based chain skip (CLAUDECODE / GROKCODE checks)
- The skip assumed native PreToolUse would catch the call, but
PreToolUse matchers fire on tool_name="Bash"|"Edit"|"Write" while
MCP tools are named kei_bash/kei_edit/kei_write — so native hooks
NEVER fire on MCP tool calls. The skip created an auth-bypass hole.
- Chain now ALWAYS runs for kei_bash/kei_edit/kei_write.
- Wire scripts (kei-mcp-wire-claude.sh + -grok.sh) updated: empty
env block + comment explaining v0.46 rationale.
3. Fail-closed defaults (architecturally correct, not bandaid):
- validate_path: empty allowed_roots() → ERROR (was silent disable)
- load_chain: missing/empty section → ERROR unless KEI_POLICY_CHAIN_OPTIONAL=1
4. RAII guard for process-group cleanup:
- KillPgGuard fires killpg on ANY exit path (success, error, timeout,
panic) until explicitly disarmed. Replaces error-path-only killpg.
5. validate_path moved off tokio worker via spawn_blocking — was blocking
syscalls in async context.
VERIFIED:
- cargo build --release → clean
- cargo test -p kei-mcp --release → 2 passed
- MCP smoke: chain fires under CLAUDECODE=1, GROKCODE=1, and no env
(all three previously skipped; all three now block kei_bash on
forbidden git push patterns).
- Safe commands still pass (kei_bash echo HELLO → HELLO returned).
README: substrate counts refreshed (105→110 Rust crates, v0.45→v0.46).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| _rust | ||
| templates | ||
| cli-backends.toml | ||
| design-scrape.sh | ||
| figma-tokens.sh | ||
| frontend-inspect.sh | ||
| harden-base.sh | ||
| hook-packs.toml | ||
| kei-ci-lint.sh | ||
| kei-docs-scaffold.sh | ||
| kei-doctor.sh | ||
| kei-sleep-queue.sh | ||
| kei-sleep-setup.sh | ||
| kei-sleep-sync.sh | ||
| live-preview.sh | ||
| log-ship.sh | ||
| MANIFEST.toml | ||
| metrics-scrape.sh | ||
| provision-hetzner.sh | ||
| provision-vultr.sh | ||
| README.md | ||
| screenshot-decode.sh | ||
| tomd.sh | ||
_primitives — first-class building blocks
_primitives/ holds standalone utilities that agents, hooks, and skills
(including /compose-solution) depend on. Unlike _blocks/ (behavioral
markdown) or _manifests/ (agent TOML), primitives are executable shell
programs installed at $HOME/.claude/agents/_primitives/ by install.sh.
Current primitives
| Primitive | Purpose | Invocation |
|---|---|---|
tomd.sh |
Universal non-native-format → markdown converter (PDF, DOCX, XLSX, PPTX, CSV, images, code). | ~/.claude/agents/_primitives/tomd.sh <file> |
tomd.sh is a first-class primitive. Universal non-native-format →
markdown converter with configurable cache directory
(KEISEI_TOMD_CACHE) and KeiSeiKit-style error tags ([tomd]).
Hook integration
hooks/tomd-preread.sh is a PreToolUse(Read) hook that auto-redirects
Claude to the converted markdown when a Read targets .docx / .doc / .xlsx / .pptx / .csv. Cached under $KEISEI_TOMD_CACHE (default
/tmp/keisei-tomd-cache).
/compose-solution discovery
Phase 3 prior-art sweep greps _primitives/ alongside _blocks/,
_manifests/, skills/, _bridges/, hooks/. If a user task involves
file-format parsing, the meta-composer surfaces tomd automatically —
reuse over rewrite (RULE "No Patching").