dev/disclaw

Fork 0

DIS-006: settings.json-Template haerten + CLAUDE.md Injection-Klausel #24

Merged

dev merged 1 commit from phase-0/harden-settings-and-claudemd into main

2026-04-09 09:44:34 +00:00

dev commented

2026-04-09 09:19:58 +00:00

Owner

Summary

src/agent/identity.ts: gehärtetes settings.json-Template mit vollständiger deny-Liste (Read(../), Write(../), Read(./.env), WebFetch, gefährliche Bash-Pattern, defaultMode: acceptEdits)
CLAUDE.md-Template: neuer Abschnitt "Sicherheit & Prompt-Injection" verhindert Permissions-Bypass durch Nachrichten
tests/unit/identity-templates.test.ts (neu): 4 Tests — deny-Einträge, allow-Einträge, Injection-String, JSON-Parseability

Closes

Closes #7

Test Plan

npm run build grün
npm test — 23/23 Tests grün (4 Dateien)

Breaking Changes

Nein. Nur neue Workspaces erhalten das gehärtete Template.

Reviewer-Checkliste

Deny-Liste enthält Read(../**) und Read(./.env)
CLAUDE.md-Template enthält Injection-Resistenz-Klausel
Tests grün

## Summary - `src/agent/identity.ts`: gehärtetes settings.json-Template mit vollständiger deny-Liste (Read(../**), Write(../**), Read(./.env), WebFetch, gefährliche Bash-Pattern, defaultMode: acceptEdits) - CLAUDE.md-Template: neuer Abschnitt "Sicherheit & Prompt-Injection" verhindert Permissions-Bypass durch Nachrichten - `tests/unit/identity-templates.test.ts` (neu): 4 Tests — deny-Einträge, allow-Einträge, Injection-String, JSON-Parseability ## Closes Closes #7 ## Test Plan - [x] `npm run build` grün - [x] `npm test` — 23/23 Tests grün (4 Dateien) ## Breaking Changes Nein. Nur neue Workspaces erhalten das gehärtete Template. ## Reviewer-Checkliste - [x] Deny-Liste enthält Read(../**) und Read(./.env) - [x] CLAUDE.md-Template enthält Injection-Resistenz-Klausel - [x] Tests grün

dev added the

labels 2026-04-09 09:19:58 +00:00

dev added 1 commit 2026-04-09 09:19:58 +00:00

feat(identity): harden settings.json template, add injection-resistance clause 028ea0bf28

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dev merged commit 90e7cf37ab into main

2026-04-09 09:44:34 +00:00

dev referenced this pull request from a commit

2026-04-09 09:44:36 +00:00

Merge pull request 'DIS-006: settings.json-Template haerten + CLAUDE.md Injection-Klausel' (#24) from phase-0/harden-settings-and-claudemd into main

dev deleted branch phase-0/harden-settings-and-claudemd

2026-04-09 09:44:43 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: dev/disclaw#24

No description provided.