Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug]: Project-boundary gate hard-codes /root/.local/ and /root/.claude/, so a non-root account cannot read its own tools, and there is no setting to allow a path

Abierto
  • ¿Algo no está bien?
#104 4 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
54/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
bash, linux, shell
Área
cli, security

Línea de trabajo

Read agents/context/check-project-boundary.sh, especially READ_ALLOWED_PREFIXES around line 753, and trace how ~ paths are expanded and checked. Reproduce the non-root case from the issue using ls ~/.local/bin/fw or grep -n x ~/some-tool; done means the account’s own configured read paths are handled as expected without weakening the boundary gate. The issue describes broader configuration and executable-tool requests that may need scope decisions.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

area:governance bug severity:medium status:in-progress triaged
Bug Description

agents/context/check-project-boundary.sh, READ_ALLOWED_PREFIXES (around line 753) contains '/root/.local/' # user shim install dir and '/root/.claude/' # Claude Code state. On a non-root account, $HOME/.local/ and $HOME/.claude/ are refused, although the comments describe exactly those directories.

Since 1.8.11 the gate expands ~ as bash does (T-3768), so every ~/... argument outside the project is now refused. Under the 1.8.6 hooks, ls -la ~/.local/bin/fw and cmp ~/.local/bin/fw <file> passed in the same session.

Cases met on this host after the upgrade, all read-only or the operator's own cross-project tool:

  • ~/passer --help (the operator's script for leaving a message to another project);
  • grep -n FW_ROUTED_FROM ~/.local/bin/fw;
  • reading a shared conventions file and another project's message file under $HOME.

The gate gives no way to allow a path: READ_ALLOWED_PREFIXES and READ_ALLOWED_EXACT are literals, and no environment variable or fw config key is read. Meanwhile Claude Code's own Read tool still reads the same files, so the gate does not protect them; it only blocks shell use.

Steps to Reproduce
  1. Non-root account, project under $HOME/<project>.
  2. Ask the agent to run ls ~/.local/bin/fw or grep -n x ~/some-tool.
  3. PROJECT BOUNDARY BLOCK — Command Targets Another Project, Reason: Outside-path argument /home/<account>/.local/bin/fw (not in read-side allowlist).
Expected Behavior
  1. $HOME/.local/ and $HOME/.claude/ (expanded) instead of /root/....
  2. A project or host setting for extra read-only paths (for example fw config set BOUNDARY_READ_ALLOW "<path>:<path>"), and ideally one for named operator tools that may be executed.
Actual Behavior

The account's own tools and shared read-only files are unreadable from Bash on any non-root install, with no supported way to allow them.

fw doctor output
AI Agent

Claude Code

Operating System

Linux

Additional Context

1.8.11 (e42aa41bf), vendored consumer, Linux (Ubuntu 20.04), non-root account, Claude Code. Also found independently by another consumer project on the same host; its reproduction was re-run here on 1.8.11.

Lenguaje dominante
Shell
Estrellas
16
Forks
6
Merge medio
6 h 24 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de DimitriGeelen/agentic-engineering-framework

Todos los issues de DimitriGeelen/agentic-engineering-framework

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.