Backtalk6858/claude-projects
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

note: next session — fix allowlist.json ownership + no-sync policy

Browse Source 
allowlist.json must be root-owned so POST /allowlist is the only write
path; direct file edit bypasses audit log and danger veto. No cross-
bridge sync — allowlists grow organically per server.
This commit is contained in:
Backtalk6858
2026-06-22 20:58:03 -05:00
parent be89611060
commit 97a06261b6
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-builder/.claude/context.md
+6 -1
View File
@@ -202,7 +202,12 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
- 524 on destructive commands: Cloudflare kills long-poll at ~100s; approval must be tapped quickly; command still runs if approved before timeout, response just lost - 524 on destructive commands: Cloudflare kills long-poll at ~100s; approval must be tapped quickly; command still runs if approved before timeout, response just lost
**NEXT SESSION — in order:** **NEXT SESSION — in order:**
0. sudo-bridge-server01 — sync POST /allowlist endpoint 0. sudo-bridge (both) — fix allowlist.json file ownership
- Problem: allowlist.json is administrator-owned on both servers — Claude can bypass POST /allowlist entirely with a direct file edit, defeating the audit log, NTFY notification, and danger-pattern veto
- Fix: chown root:root + chmod 644 allowlist.json on both primary and server-01 — daemon writes via root (systemd), Claude must use POST /allowlist endpoint
- After fix: verify POST /allowlist still works (daemon writes as root), verify direct Edit tool to allowlist.json is denied
- Sync policy decision: NO cross-bridge sync — allowlists grow organically per server (primary ≠ server-01 purposes); when a command is needed on server-01 it gets added there at that time
0a. sudo-bridge-server01 — sync POST /allowlist endpoint
- POST /allowlist was added to sudo-bridge (primary) this session but server-01 bridge container was NOT redeployed — it's still running the old image without the endpoint - POST /allowlist was added to sudo-bridge (primary) this session but server-01 bridge container was NOT redeployed — it's still running the old image without the endpoint
- Both bridges share gitea.local/backtalk6858/sudo-bridge:latest — code is already in the image, just need to redeploy server-01 bridge (Coolify UUID: o2kz1puml1mmneyiqd96mouj) via pull + restart - Both bridges share gitea.local/backtalk6858/sudo-bridge:latest — code is already in the image, just need to redeploy server-01 bridge (Coolify UUID: o2kz1puml1mmneyiqd96mouj) via pull + restart
- Also: server-01 allowlist.json needs the 4 new entries added today (iptables-save, 99-local-routing.conf, sysctl -p, journalctl -u) — these are primary-only entries so only add if relevant to server-01 use cases - Also: server-01 allowlist.json needs the 4 new entries added today (iptables-save, 99-local-routing.conf, sysctl -p, journalctl -u) — these are primary-only entries so only add if relevant to server-01 use cases