[AUTOMATION] fix(clawpatch): address daily finding#290
Conversation
Greptile SummaryThis PR updates Claude hook settings rewrites to preserve file permissions. The main changes are:
Confidence Score: 3/5This should be fixed before merging.
|
| Filename | Overview |
|---|---|
| internal/guard/cli/cli.go | Adds permission-preserving writes for Claude settings and backups, but relies on os.WriteFile in existing-file cases. |
| internal/guard/cli/cli_test.go | Adds coverage for preserving 0600, but does not cover already-widened files or backup filename collisions. |
Reviews (1): Last reviewed commit: "fix(clawpatch): address daily finding" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| } | ||
| bytes = append(bytes, '\n') | ||
| return os.WriteFile(path, bytes, 0o644) | ||
| return os.WriteFile(path, bytes, mode) |
There was a problem hiding this comment.
os.WriteFile only applies the mode argument when it creates a new file. When settings.json already exists, this call truncates and rewrites it without changing its permissions. A user whose Claude settings were already widened to 0644 by an earlier install/uninstall will still have a world-readable settings file after running this fixed path, so the affected local privacy issue remains in place.
| return err | ||
| } | ||
| return os.WriteFile(backupPath, input, 0o644) | ||
| return os.WriteFile(backupPath, input, mode) |
There was a problem hiding this comment.
The backup filename has only second-level precision, and this write overwrites an existing backup if two hook operations run in the same second. Since os.WriteFile does not chmod an existing file, a colliding backup that was first created with broader permissions can stay broad even when this call computes 0600; it can also replace the earlier backup contents.
1 participant
Where We Are
Claude hook install and uninstall rewrote
~/.claude/settings.jsonand the backup file with0644. That makes a private Claude settings file readable by other local users after a guard hook change.Where We Want To Go
Keep the existing Claude settings permissions when we rewrite the file. If the file is created fresh, default it to
0600.How do we get there
Read the current file mode before writing
settings.jsonor its backup, then reuse that mode instead of hard-coding0644. Added regression coverage for both install and uninstall to assert the rewritten settings file and the backup stay0600. Verified withgo test ./...,go vet ./...,npm exec --yes --package pnpm@10.0.0 -- pnpm install --frozen-lockfile,npm exec --yes --package pnpm@10.0.0 -- pnpm --dir web/guard-dashboard typecheck, andgit diff --check.