clean-room-skill 0.1.9 → 0.1.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -263,7 +263,10 @@ def commit_report_paths(report: dict[str, Any], root: Path, blocked_roots: list[
|
|
|
263
263
|
"user.name=Clean Room Agent 4",
|
|
264
264
|
"-c",
|
|
265
265
|
"user.email=clean-room-agent4@example.invalid",
|
|
266
|
+
"-c",
|
|
267
|
+
"core.hooksPath=/dev/null",
|
|
266
268
|
"commit",
|
|
269
|
+
"--no-verify",
|
|
267
270
|
"-m",
|
|
268
271
|
subject,
|
|
269
272
|
"-m",
|
|
@@ -26,6 +26,13 @@ MCP_RESOURCE_TOOLS = {
|
|
|
26
26
|
"read_mcp_resource",
|
|
27
27
|
}
|
|
28
28
|
READ_PATH_KEYS = ("file_path", "filePath", "path", "notebook_path", "notebookPath")
|
|
29
|
+
CONTAMINATED_ONLY_SANITIZER_ARTIFACTS = {
|
|
30
|
+
"coverage-ledger.json": "coverage-ledger artifact",
|
|
31
|
+
"evidence-ledger.json": "evidence-ledger artifact",
|
|
32
|
+
"preflight-goal.json": "preflight-goal artifact",
|
|
33
|
+
"source-index.json": "source-index artifact",
|
|
34
|
+
"task-manifest.json": "task-manifest artifact",
|
|
35
|
+
}
|
|
29
36
|
|
|
30
37
|
|
|
31
38
|
def tool_name_for(payload: dict) -> str:
|
|
@@ -112,6 +119,7 @@ def main() -> int:
|
|
|
112
119
|
)
|
|
113
120
|
return 1
|
|
114
121
|
source_roots = env_roots("CLEAN_ROOM_SOURCE_ROOTS")
|
|
122
|
+
contaminated_roots = env_roots("CLEAN_ROOM_CONTAMINATED_ARTIFACT_ROOTS")
|
|
115
123
|
clean_roots = env_roots("CLEAN_ROOM_CLEAN_ROOTS")
|
|
116
124
|
implementation_roots = env_roots("CLEAN_ROOM_IMPLEMENTATION_ROOTS")
|
|
117
125
|
allowed_roots = allowed_roots_for_role(role)
|
|
@@ -143,6 +151,14 @@ def main() -> int:
|
|
|
143
151
|
file=sys.stderr,
|
|
144
152
|
)
|
|
145
153
|
return 1
|
|
154
|
+
if role == SANITIZER_ROLE and any(is_under(path, root) for root in contaminated_roots):
|
|
155
|
+
artifact_label = CONTAMINATED_ONLY_SANITIZER_ARTIFACTS.get(path.name)
|
|
156
|
+
if artifact_label:
|
|
157
|
+
print(
|
|
158
|
+
f"clean-room policy denied role {role} reading {artifact_label} in {describe_path(path)}",
|
|
159
|
+
file=sys.stderr,
|
|
160
|
+
)
|
|
161
|
+
return 1
|
|
146
162
|
if role in SOURCE_DENIED_ROLES and path.name == "preflight-goal.json":
|
|
147
163
|
print(
|
|
148
164
|
f"clean-room policy denied role {role} reading preflight-goal artifact in {describe_path(path)}",
|
package/package.json
CHANGED