cbd2df66fb
deny always wins over allow in Claude Code — the Read(../**) deny rule was silently blocking the explicitly allowed host paths. When mappings exist, drop the ../** traversal guard and use explicit Read(./**) allow instead of blanket Read. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.8 KiB
TypeScript
46 lines
1.8 KiB
TypeScript
import { describe, it, expect, beforeEach, afterEach } from "vitest";
|
|
import * as fs from "fs";
|
|
import * as path from "path";
|
|
import * as os from "os";
|
|
import { setupAgentWorkspace } from "../../src/agent/identity";
|
|
|
|
describe("identity-templates", () => {
|
|
let tmpDir: string;
|
|
|
|
beforeEach(() => {
|
|
tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "disclaw-test-"));
|
|
});
|
|
|
|
afterEach(() => {
|
|
fs.rmSync(tmpDir, { recursive: true, force: true });
|
|
});
|
|
|
|
it("settings.json is valid JSON", () => {
|
|
setupAgentWorkspace(tmpDir, "test-agent", "A test agent", "chan-123");
|
|
const settingsPath = path.join(tmpDir, ".claude", "settings.json");
|
|
const raw = fs.readFileSync(settingsPath, "utf-8");
|
|
expect(() => JSON.parse(raw)).not.toThrow();
|
|
});
|
|
|
|
it("settings.json permissions.deny contains Read(../**) and Read(./.env)", () => {
|
|
setupAgentWorkspace(tmpDir, "test-agent", "A test agent", "chan-123");
|
|
const settingsPath = path.join(tmpDir, ".claude", "settings.json");
|
|
const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
|
|
expect(settings.permissions.deny).toContain("Read(../**)");
|
|
expect(settings.permissions.deny).toContain("Read(./.env)");
|
|
});
|
|
|
|
it("settings.json permissions.allow contains Read(./**)", () => {
|
|
setupAgentWorkspace(tmpDir, "test-agent", "A test agent", "chan-123");
|
|
const settingsPath = path.join(tmpDir, ".claude", "settings.json");
|
|
const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
|
|
expect(settings.permissions.allow).toContain("Read(./**)");
|
|
});
|
|
|
|
it("CLAUDE.md contains Prompt-Injection section", () => {
|
|
setupAgentWorkspace(tmpDir, "test-agent", "A test agent", "chan-123");
|
|
const claudeMdPath = path.join(tmpDir, "CLAUDE.md");
|
|
const content = fs.readFileSync(claudeMdPath, "utf-8");
|
|
expect(content).toContain("Prompt-Injection");
|
|
});
|
|
});
|