devflow-kit 3.0.0 → 3.0.1

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to Devflow will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.1] - 2026-10-02
+
+### Fixed
+
+- **The three whole-disk docker mount rules now match, and Claude Code no longer warns about them at startup**. 3.0.0 shipped `Bash(docker run*-v /:*)`, `Bash(docker run*--volume /:*)` and `Bash(docker run*--volume=/:*)`. A trailing `:*` is Claude Code's legacy prefix syntax, which turns the rest of the rule into a literal prefix: the `*` after `docker run` was never expanded, so none of the three blocked anything, and each produced a "mixes * with the trailing :* prefix syntax" warning on every start. They are now `Bash(docker run*-v /:/*)`, `Bash(docker run*--volume /:/*)` and `Bash(docker run*--volume=/:/*)`, which deny any mount of the host root (`-v /:/host`, `-v /:/host:ro`) wherever the flag sits, while ordinary mounts such as `-v /home/me/proj:/app` or `-v $(pwd):/app` stay allowed. The list stays at 170 entries. Re-run `devflow init` to apply: it replaces the old entries, and `devflow security --disable` and `devflow uninstall` still recognise both forms as devflow's.
+
+---
+
 ## [3.0.0] - 2026-09-30
 
 ### Added
@@ -1462,6 +1470,7 @@ devflow init
 ---
 
 [Unreleased]: https://github.com/dean0x/devflow/compare/v2.0.0...HEAD
+[3.0.1]: https://github.com/dean0x/devflow/compare/v3.0.0...v3.0.1
 [3.0.0]: https://github.com/dean0x/devflow/compare/v2.5.0...v3.0.0
 [2.5.0]: https://github.com/dean0x/devflow/compare/v2.4.0...v2.5.0
 [2.4.0]: https://github.com/dean0x/devflow/compare/v2.3.0...v2.4.0

package/dist/targets/claude-code/post-install.js

@@ -292,6 +292,13 @@ export function mergeDenyList(existingJson, newDenyEntries, retired = new Set())
 // subcommand alone, so a rule holding ` | ` can never match anything. The exact
 // shell-on-stdin denies in the v2 batch (`Bash(bash)`, `Bash(sh -s *)`, ...) match the
 // shell subcommand of such a pipeline instead.
+// D-SECURITY-03: the three 3.0.0 root-mount rules (`Bash(docker run*-v /:*)` and the
+// two `--volume` spellings) are RETIRED too. A trailing `:*` is Claude Code's legacy
+// prefix syntax, which makes the rest of the rule a literal prefix — the `*` after
+// `docker run` is never expanded — so they matched nothing and drew a startup warning.
+// Their replacements end `/:/*` instead: a container path is always absolute, so `/:/`
+// follows every mount of the host root, while an ordinary `-v /home/me/proj:/app` never
+// holds it. (Claude Code's own suggestion, `-v /*`, would deny every absolute mount.)
 // Only entries a release actually shipped belong here: removal and install convergence
 // strip every entry this set names that the template does not, so a rule Devflow never
 // shipped would be taken from a user who wrote it (ADR-024, prove-you-wrote-it).
@@ -451,9 +458,10 @@ export const DEVFLOW_HISTORICAL_DENY = Object.freeze(new Set([
     'Read(/etc/shadow)',
     'Read(/etc/sudoers)',
     'Read(/etc/passwd)',
-    // v2 batch (#399) — 25 template entries: a shell reading its script from stdin,
-    // `zsh -c` beside the v1 `sh -c`/`bash -c`, OrbStack VM control, docker
-    // pull/delete/prune and whole-disk or privileged runs.
+    // v2 batch (#399) — 25 entries shipped in 3.0.0: a shell reading its script from
+    // stdin, `zsh -c` beside the v1 `sh -c`/`bash -c`, OrbStack VM control, docker
+    // pull/delete/prune and whole-disk or privileged runs. Its three `:*` root-mount
+    // rules are retired (D-SECURITY-03); the other 22 are still template entries.
     'Bash(bash)',
     'Bash(sh)',
     'Bash(zsh)',
@@ -479,6 +487,11 @@ export const DEVFLOW_HISTORICAL_DENY = Object.freeze(new Set([
     'Bash(orb *)',
     'Bash(orbctl *)',
     'Bash(open *OrbStack*)',
+    // Root-mount rules in wildcard form — 3 template entries replacing the v2 batch's
+    // three `:*` root-mount rules 1:1 (D-SECURITY-03), so the template stays at 170.
+    'Bash(docker run*-v /:/*)',
+    'Bash(docker run*--volume /:/*)',
+    'Bash(docker run*--volume=/:/*)',
 ]));
 /**
  * The Devflow deny entries an older install may carry that the current template no
@@ -491,7 +504,8 @@ export const DEVFLOW_HISTORICAL_DENY = Object.freeze(new Set([
  * retired entry themselves is indistinguishable from Devflow's copy and loses it on the
  * next install, exactly as `security --disable` and uninstall already strip every
  * historical entry. Retire an entry only when losing a user's identical copy is
- * harmless; the #399 piped rules qualify because none could ever match (D-SECURITY-02).
+ * harmless; the #399 piped rules and the 3.0.0 `:*` root-mount rules qualify because
+ * none could ever match (D-SECURITY-02, D-SECURITY-03).
  */
 export function retiredDenyEntries(templateEntries) {
     if (templateEntries.length === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devflow-kit",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "A meta-harness for Claude Code — turns a single coding agent into an engineering team: orchestration, parallel review, persistent memory, self-learning, and graph workflows",
   "type": "module",
   "bin": {

package/src/targets/claude-code/templates/managed-settings.json

@@ -92,9 +92,9 @@
       "Bash(docker run --pid=host*)",
       "Bash(docker run --net=host*)",
       "Bash(docker run*--privileged*)",
-      "Bash(docker run*-v /:*)",
-      "Bash(docker run*--volume /:*)",
-      "Bash(docker run*--volume=/:*)",
+      "Bash(docker run*-v /:/*)",
+      "Bash(docker run*--volume /:/*)",
+      "Bash(docker run*--volume=/:/*)",
       "Bash(docker pull *)",
       "Bash(docker image pull *)",
       "Bash(docker rm *)",