Repository navigation
[AAASM-6352] 🐛 (native): Deny redact verdicts under enforce instead of running the tool - #522
Conversation
… tool The SDK cannot apply a redaction client-side (no redacted payload crosses the native ABI, AAASM-1920), so mapping redact to allow ran the tool with the original secret-bearing args. Under enforce redact now denies with an explicit reason; observe/disabled stay advisory. Corrects the stale Go-parity comment. Tests: the native-client test that pinned redact -> allow under failClosed is inverted to expect deny; adds an observe-mode control and an end-to-end wrapToolWithAssembly test asserting the tool fn is not invoked on redact under enforce (paired with an allow control that sees the original args). Refs AAASM-6352 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
Docs claimed redact strips secrets / is treated as allow. This SDK cannot apply redaction, so under enforce a redact verdict denies; observe/disabled proceed. Refs AAASM-6352 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…pi addon
The redact unit tests inject a fake binding that already returns "redact". Add
three AA_NATIVE_TEST cases that drive the real built addon against a mock
runtime answering CheckActionResponse{REDACT}: denied under failClosed, advisory
without it, and an ALLOW control on the same socket. Mutating the SDK to allow on
redact fails the failClosed case.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
|
|
Owner self-review record (owner-only admin-merge exception, condition 9: same-identity REVIEW_REQUIRED). Verified identity: Chisanan232, org role |
Summary
Under enforce, a gateway
redactverdict no longer lets the tool run with the original (secret-bearing) arguments.Jira: https://lightning-dust-mite.atlassian.net/browse/AAASM-6352 (found via AAASM-6351)
What this means
No redacted payload crosses the native ABI (AAASM-1920), so the SDK cannot apply redaction client-side. Previously
redactwas folded into allow, so the tool received the raw secret while the audit trail said Redact. It now denies under enforce (as the Go SDK does by erroring); observe/disabled keep their advisory behaviour. False claims that redact "strips secrets" are corrected.This turns Redact into a hard deny until redacted payloads cross the ABI; it does not make redact_only work.
Evidence
Tests assert the tool is NOT invoked on Redact under enforce, with an Allow control and an observe-mode test; a mutation restoring the old mapping fails the new tests. Counts are in the commit messages and the Jira comment.
🤖 Generated with Claude Code
https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd