clean-room-skill 0.1.9 → 0.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -9,7 +9,7 @@
9
9
  "name": "clean-room",
10
10
  "source": "./",
11
11
  "description": "Spec-first clean-room workflow for authorized source analysis without replacement code.",
12
- "version": "0.1.9",
12
+ "version": "0.1.10",
13
13
  "author": {
14
14
  "name": "whit3rabbit"
15
15
  },
@@ -2,7 +2,7 @@
2
2
  "name": "clean-room",
3
3
  "displayName": "Clean Room",
4
4
  "description": "Spec-first clean-room workflow for authorized source analysis without replacement code.",
5
- "version": "0.1.9",
5
+ "version": "0.1.10",
6
6
  "author": {
7
7
  "name": "whit3rabbit"
8
8
  },
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "clean-room",
3
- "version": "0.1.9",
3
+ "version": "0.1.10",
4
4
  "description": "Spec-first clean-room workflow for authorized source analysis without replacement code.",
5
5
  "author": {
6
6
  "name": "whit3rabbit"
@@ -263,7 +263,10 @@ def commit_report_paths(report: dict[str, Any], root: Path, blocked_roots: list[
263
263
  "user.name=Clean Room Agent 4",
264
264
  "-c",
265
265
  "user.email=clean-room-agent4@example.invalid",
266
+ "-c",
267
+ "core.hooksPath=/dev/null",
266
268
  "commit",
269
+ "--no-verify",
267
270
  "-m",
268
271
  subject,
269
272
  "-m",
@@ -26,6 +26,13 @@ MCP_RESOURCE_TOOLS = {
26
26
  "read_mcp_resource",
27
27
  }
28
28
  READ_PATH_KEYS = ("file_path", "filePath", "path", "notebook_path", "notebookPath")
29
+ CONTAMINATED_ONLY_SANITIZER_ARTIFACTS = {
30
+ "coverage-ledger.json": "coverage-ledger artifact",
31
+ "evidence-ledger.json": "evidence-ledger artifact",
32
+ "preflight-goal.json": "preflight-goal artifact",
33
+ "source-index.json": "source-index artifact",
34
+ "task-manifest.json": "task-manifest artifact",
35
+ }
29
36
 
30
37
 
31
38
  def tool_name_for(payload: dict) -> str:
@@ -112,6 +119,7 @@ def main() -> int:
112
119
  )
113
120
  return 1
114
121
  source_roots = env_roots("CLEAN_ROOM_SOURCE_ROOTS")
122
+ contaminated_roots = env_roots("CLEAN_ROOM_CONTAMINATED_ARTIFACT_ROOTS")
115
123
  clean_roots = env_roots("CLEAN_ROOM_CLEAN_ROOTS")
116
124
  implementation_roots = env_roots("CLEAN_ROOM_IMPLEMENTATION_ROOTS")
117
125
  allowed_roots = allowed_roots_for_role(role)
@@ -143,6 +151,14 @@ def main() -> int:
143
151
  file=sys.stderr,
144
152
  )
145
153
  return 1
154
+ if role == SANITIZER_ROLE and any(is_under(path, root) for root in contaminated_roots):
155
+ artifact_label = CONTAMINATED_ONLY_SANITIZER_ARTIFACTS.get(path.name)
156
+ if artifact_label:
157
+ print(
158
+ f"clean-room policy denied role {role} reading {artifact_label} in {describe_path(path)}",
159
+ file=sys.stderr,
160
+ )
161
+ return 1
146
162
  if role in SOURCE_DENIED_ROLES and path.name == "preflight-goal.json":
147
163
  print(
148
164
  f"clean-room policy denied role {role} reading preflight-goal artifact in {describe_path(path)}",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "clean-room-skill",
3
- "version": "0.1.9",
3
+ "version": "0.1.10",
4
4
  "description": "Spec-first clean-room workflow for authorized source analysis without replacement code.",
5
5
  "bin": {
6
6
  "clean-room-skill": "bin/install.js"
package/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "clean-room",
3
- "version": "0.1.9",
3
+ "version": "0.1.10",
4
4
  "description": "Spec-first clean-room workflow for authorized source analysis without replacement code.",
5
5
  "author": {
6
6
  "name": "whit3rabbit"