fix(claude-code): redact home paths and raw content in episodic logging - #67
Open
diazMelgarejo wants to merge 1 commit into
Open
Conversation
claude_code_post_tool.py persisted raw absolute paths and raw edit/write content into AGENT_LEARNINGS.jsonl -- a log meant to be shared, diffed, and exported via the data flywheel: - file_path values went into action/reflection unnormalized, baking the operator's home directory into every entry that touched a file. - Edit/MultiEdit reflection used repr(old[:30])/repr(new[:30]) -- literal content excerpts, not just that an edit happened. - The generic _reflection() fallback (for tool types not explicitly handled -- Read, Grep, Glob, WebFetch, etc.) embedded raw json.dumps(tool_input) whenever it was under 80 chars, which is backwards: a short absolute path is exactly the case most likely to leak in full. Adds _normalize_path(), reusing the hook's own existing AGENT_ROOT resolution (no new dependency, no new config) to normalize to project-relative or ~-relative form. Replaces content/diff previews with char counts. Fixes the _reflection() fallback to normalize paths before its length check instead of dumping raw JSON. tests/test_claude_code_hook.py: new TestNoRawContentOrPathsPersisted-style coverage (8 new checks, section 10b) asserting no raw home path or file content survives into a persisted entry, for both Edit and Write -- 62/62 passing, up from 54/54. Fixes codejunkie99#66
Contributor
Author
|
Cross-ref: sibling fix in everything-claude-code for the same-shaped bug (raw tool-call payload into a durable, shareable artifact): affaan-m/ECC#2731 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #66.
What
claude_code_post_tool.pypersisted raw absolute paths and raw filecontent/edit diffs into
AGENT_LEARNINGS.jsonl— a durable, cross-sessionlog meant to be shared, diffed, and eventually exported via the data
flywheel. Two leak sites:
file_pathvalues went intoaction/reflectionunnormalized —/Users/<name>/...baked into every entry touching a file.Edit/MultiEditreflection usedrepr(old[:30])/repr(new[:30])(literal content), and the generic
_reflection()fallback forunhandled tool types (Read, Grep, Glob, WebFetch, ...) embedded raw
json.dumps(tool_input)whenever the result was under 80 chars — whichis backwards, since a short absolute path is exactly the case most
likely to leak in full.
Fix
_normalize_path()helper, pure stdlib, reuses the hook's ownexisting
AGENT_ROOTresolution (no new dependency, no new config) —normalizes to project-relative or
~-relative form."Edited {path}: N chars -> M chars"instead of literal excerpts)._reflection()'s fallback branch now normalizesfile_path/path/new_pathbefore the length check, instead of dumping raw JSON._detail()'s rawjson.dumps(tool_input)[:300]fallback replaced witha small normalized-metadata dict (tool name, normalized path, content
size / edit char counts) — same shape as the existing Bash-specific
branch already used.
Testing
Extended
tests/test_claude_code_hook.pywith a new section (10b) — 8checks across an
Editand aWritecase, asserting no raw home path orfile content survives into a persisted entry. Full suite: 62/62 passing
(up from 54/54, all pre-existing checks still green).
Note
Redact home-directory paths and raw content from episodic log entries in claude-code hook
_normalize_pathin claude_code_post_tool.py to convert absolute paths to project-relative or~-prefixed forms before persisting them._action_label,_reflection, and_detailto use normalized paths and character counts instead of raw file content or absolute paths.Macroscope summarized 81e0f1e.