Repository navigation
fix(security): keep each crew apart from the others and from Botloft's data - #193
Merged
Merged
Conversation
…s data - A crew's work folder can no longer be inside, or hold, another crew's folder or chosen work folder; inside the bots' folders, only in its own. - Each bot's settings.json now denies Read and Edit on Botloft's data folder and on every other crew's folders. Checked with the real Claude Code: the rules hold in bypass mode, even for an --add-dir folder. - A file the bot wrote behind those fences no longer counts as its own for share_file and the files panel. - No page may open the DevTools port of a bot's browser, in any mode. Spec 5, 7.5, 8.4, 13, 19 and 21.5.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Crew isolation audit follow-up. The MCP tools were already scoped to the caller's crew; these were the gaps around them:
settings.jsonnow deniesReadandEditon Botloft's data folder (database with every crew's chats, browser profiles, logs) and on every other crew's folders. A folder that holds one of the crew's own is left out, since a deny would win. Rewritten on every start.DevToolsActivePort), in any mode; other localhost addresses work as before.Known limit, written in spec 13: a script run in the terminal can still read outside the fences; real isolation needs an OS sandbox.
Real Claude Code check (2.1.287, bypass mode, Haiku):
ReadandWritein a denied folder, also passed with--add-dir, both failed with "denied by your permission settings" and showed inpermission_denials. Recorded in spec 19.Tests:
tests/crew_isolation.rs(folders refused, settings deny the other crew and Botloft's data), unit tests forfences,choose,loopback_portand the port files.