[saucam]

Summary

Ordinary commands that use a nested glob were refused in every mode as reading a process's environment. Examples: cat src/*/*.ts, and searching session transcripts with grep x ~/.claude/projects/*/*.jsonl. They now run. Real reads of a process's environment are still refused.

What was wrong

The shell reader refuses any command that could read /proc/<pid>/environ. A process's environment holds its credentials. The check treated any path component that could spell "proc" as /proc, wherever it appeared in the path. A bare * can spell anything, so the second * in src/*/*.ts counted as a possible /proc, and the command was refused with "/proc//environ holds credentials".

Why it matters

• A user's agent couldn't search other sessions' transcripts. The message also misled it into blaming a policy against reading other sessions, and on macOS it named a /proc that doesn't exist there.
• It hit any nested glob in any mode, including the most common shapes (src/*/*.ts).
• It came in with feat: opencode is a codeoid backend, with every tool call approved by codeoid #450 (an opencode audit round hardened the rule against spellings like /pr?c). Every test then covered /proc-shaped paths, and none covered an ordinary nested glob.

What changed

• /proc is a top-level directory. A component that only matches "proc" as a pattern (*, pr?c) counts as /proc only:
  • at the root;
  • after something that can lead anywhere ($d, ..).
• A component that is literally proc still counts at any depth, since it could be reached through a link to /.
• $HOME/… is read as the home directory, as ~/… is, on a line that doesn't name HOME as a bare word (HOME=, export HOME, unset HOME).

Also: other sessions' transcripts are readable inside the sandbox

#454 hid the whole home from sandboxed commands, ~/.claude/projects included, so an agent couldn't look up another session's transcript even with the glob fixed. The owner decided they should be readable by default, so ~/.claude/projects joins the read-only home allowlist (sandbox.homeReadable). Agents can read every session's transcript and memory but never write them, and the current project's own memory stays writable, as before. To hide them, remove the entry: a secret once pasted into a session is in its transcript.

Verification

• New regression test: seven ordinary globs that must not be refused, and eight /proc reads that still must be. Among them: /proc/*/environ, /*/1/environ, /pr?c/1/environ, /proc/$PPID/environ, "$d"/proc/1/*, ../../../../proc/1/*, a literal proc under the home, and HOME=/; cat $HOME/proc/1/*.
• Suites: the risk suite passes (279), and the full suite passes (5,728, 0 fail). Lint and typecheck are clean.
• The reported commands: the transcript searches from the report now rate medium (no refusal), cat src/*/*.ts rates low, and /proc reads are still refused.

---

🤖 Implementation context (for agents / maintainers)

• src/daemon/risk/shell-risk.ts
  • procSecretWord: the at search requires c === "proc", or reachesRoot(i), meaning i === 0 or an earlier component containing SHAPE_ANY or ...
  • shapeComponents: a leading SHAPE_ANY from $HOME/${HOME} is replaced by ctx.home when ctx.homeFixed.
  • assessShellCommandSync computes homeFixed = !/(^|[^$\w{])HOME\b/.test(command), and Ctx gains an optional homeFixed.
• src/daemon/risk/shell-risk.test.ts: "a nested glob isn't taken for /proc …".

🤖 Generated with Claude Code