coily lockdown does not enforce its routes when a session runs from the coilysiren repo-parent directory #7

New issue

Open

opened 2026-05-23 20:53:17 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-23 20:53:17 +00:00

Owner

Originally filed by @coilysiren on 2026-05-21T05:00:08Z - https://github.com/coilysiren/agent-guard/issues/25

Problem - coily's lockdown routes (including the mcporter deny) are not enforced when a Claude Code session runs from the coilysiren repo-parent directory ~/projects/coilysiren.

Mechanism - The PreToolUse hook calls detectGuard(cwd) (cmd/agent-guard/hook.go), which walks up from cwd looking for a .coily/coily.yaml or .agent-guard/agent-guard.yaml marker. ~/projects/coilysiren has no marker, nor does any parent (~/projects, ~). So detectGuard reaches its parent == dir fallthrough and returns "agent-guard".

routeHint then consults agentGuardRoutes, the smaller table. mcporter lives only in coilyRoutes. Result: bare mcporter runs un-denied from the repo-parent cwd. Verified twice this session - once at /luca-inspect start, once right after upgrading agent-guard to v0.1.0. Inside an actual coily repo (e.g. ~/projects/coilysiren/luca, which has .coily/coily.yaml) the guard correctly resolves to coily and mcporter is denied.

Why it matters - Sessions are deliberately launched from ~/projects/coilysiren to widen the harness auto-allow scope for cross-repo work (the "elevated cwd" / Workspace Shape pattern). That is the intended workflow, so the repo-parent is a first-class working directory. Today every coily-only lockdown route silently no-ops there.

Candidate fixes (pick one, design call):

Add host-level binaries like mcporter to agentGuardRoutes as well. Cleanest for mcporter specifically - it is a host-level tool that should be denied regardless of which repo the cwd sits in. Does not fix coily-only routes that are genuinely repo-scoped.
Make detectGuard resolve the coilysiren repo-parent to coily - e.g. if every immediate child dir is a coily repo, or via an explicit marker dropped at ~/projects/coilysiren. Fixes the whole class, but needs a non-repo marker convention.
Drop a .coily/coily.yaml (or a lighter marker file) at ~/projects/coilysiren so the existing walk-up finds it. Smallest change, but puts a coily marker in a non-repo directory.

Found via /luca-inspect on 2026-05-20.

_Originally filed by @coilysiren on 2026-05-21T05:00:08Z - [https://github.com/coilysiren/agent-guard/issues/25](https://github.com/coilysiren/agent-guard/issues/25)_ **Problem** - coily's lockdown routes (including the `mcporter` deny) are not enforced when a Claude Code session runs from the coilysiren repo-parent directory `~/projects/coilysiren`. **Mechanism** - The PreToolUse hook calls `detectGuard(cwd)` (`cmd/agent-guard/hook.go`), which walks up from cwd looking for a `.coily/coily.yaml` or `.agent-guard/agent-guard.yaml` marker. `~/projects/coilysiren` has no marker, nor does any parent (`~/projects`, `~`). So `detectGuard` reaches its `parent == dir` fallthrough and returns `"agent-guard"`. `routeHint` then consults `agentGuardRoutes`, the smaller table. `mcporter` lives only in `coilyRoutes`. Result: bare `mcporter` runs un-denied from the repo-parent cwd. Verified twice this session - once at `/luca-inspect` start, once right after upgrading agent-guard to v0.1.0. Inside an actual coily repo (e.g. `~/projects/coilysiren/luca`, which has `.coily/coily.yaml`) the guard correctly resolves to `coily` and `mcporter` is denied. **Why it matters** - Sessions are deliberately launched from `~/projects/coilysiren` to widen the harness auto-allow scope for cross-repo work (the "elevated cwd" / Workspace Shape pattern). That is the intended workflow, so the repo-parent is a first-class working directory. Today every coily-only lockdown route silently no-ops there. **Candidate fixes** (pick one, design call): 1. Add host-level binaries like `mcporter` to `agentGuardRoutes` as well. Cleanest for `mcporter` specifically - it is a host-level tool that should be denied regardless of which repo the cwd sits in. Does not fix coily-only routes that are genuinely repo-scoped. 2. Make `detectGuard` resolve the coilysiren repo-parent to `coily` - e.g. if every immediate child dir is a coily repo, or via an explicit marker dropped at `~/projects/coilysiren`. Fixes the whole class, but needs a non-repo marker convention. 3. Drop a `.coily/coily.yaml` (or a lighter marker file) at `~/projects/coilysiren` so the existing walk-up finds it. Smallest change, but puts a coily marker in a non-repo directory. Found via `/luca-inspect` on 2026-05-20.

coilysiren added the

label

2026-05-31 01:54:04 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-flight-deck/ward#7

No description provided.

Rows
Columns