Repository navigation
fix(skills-intake): isolate the claude reviewer/reviser session (#2491) - #2493
Merged
Merged
Conversation
The skills-intake review and revise handlers ran `claude -p` from the A2A worker root with no isolation, so the worker account's CLAUDE.md, SessionStart/Stop hooks (node memory + Wiki prefetch) and user MCP servers loaded into a session whose main content is an untrusted candidate skill (a2a-nexus#2422 FAIL on nosuk and gongyung). When the agent basename is `claude` (including the unset default), append `--setting-sources "" --strict-mcp-config` as separate argv elements after the operator args and run the agent from an empty private directory inside the handler's temp dir. Operator --setting-sources/--strict-mcp-config tokens win; SKILLS_INTAKE_CLAUDE_SETTING_SOURCES=user is an opt-in that mirrors a2a-nexus A2A_CLAUDE_SETTING_SOURCES (project/local never load). Other agents keep their exact argv and cwd. Tests: a2a-review-handler.test.sh 137/137 (+22 checks for both handlers); reverting only the handlers fails 16 of the new checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ctive (#2491) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jinon86
approved these changes
Oct 23, 2026
jinon86
left a comment
jinon86
left a comment
Contributor
There was a problem hiding this comment.
Approved after exact-head validation and fresh operator authorization using the relay-held jinon86 credential.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2491
문제
skills-intake review/revise 핸들러가 A2A 워커 루트 cwd에서
claude -p를 격리 없이 실행해, 워커 계정의~/.claude/CLAUDE.md·SessionStart/Stop hooks(노드 메모리 + Wiki prefetch)·user MCP가 신뢰할 수 없는 후보 스킬이 본문인 세션에 로드됐습니다. a2a-nexus#2422 관측창 FAIL(nosuk 4세션, gongyung 2세션, 마커 2/3/2)의 원인입니다.변경
scripts/skills-intake-review-handler.sh,scripts/skills-intake-revise-handler.shclaude이면(미설정 기본값 포함) operator args 뒤에--setting-sources "" --strict-mcp-config를 별도 배열 원소로 추가(빈 값 보존).agent-cwd(0700)에서 실행 — 워커 루트 cwd를 상속하지 않음. 상대 경로 bin은 먼저 절대화. 서브셸이exec timeout이라$!는 여전히 timeout pid(시그널 전달 유지).REVIEW_AGENT_ARGS에--setting-sources/--strict-mcp-config가 있으면 operator 값 그대로, 중복 추가 없음.SKILLS_INTAKE_CLAUDE_SETTING_SOURCES: a2a-nexusA2A_CLAUDE_SETTING_SOURCES의 untrusted-cwd 규칙과 동일 —user만 유지 가능,project/local은 항상 제외, 알 수 없는 값이면 무시(로그).--list4파일 계약) 공용 lib 대신 같은 헬퍼를 두 파일에 두고 "keep in step" 주석.scripts/a2a-review-handler.test.sh: +22 checks(review·revise 양쪽) — fake claude가 argv(한 줄 1원소)·pwd -P기록.changelog.d/2491-intake-handler-claude-isolation.md검증 (yukson 로컬, origin/main
fffef2fb)bash scripts/a2a-review-handler.test.sh→ PASS=137 FAIL=0 (기존 115)bash -n3파일 clean ·python3 scripts/changelog_fragments.py checkok ·CCC_HARNESS_PHASE=static bash scripts/validate-harness.sh→ PASS리스크 / 롤아웃
--setting-sources ""는 Claude Code 2.1.305에서 OAuth 정상(a2a-nexusclaude-session-isolation.mjs실측). nosuk·gongyung CLI 2.1.305 확인. 구버전 CLI 노드는 이 플래그 미지원 시 리뷰 실패 가능.apiKeyHelper/env)로 인증하는 노드는SKILLS_INTAKE_CLAUDE_SETTING_SOURCES=user필요.install-a2a-review-handler.sh(별도 승인). 수용 기준: 다음 intake transcript에서 CLAUDE.md / session memory / load-memory 마커 0/0/0, verdict 정상.🤖 Generated with Claude Code