fix(hooks): the write guards follow a backslash-named link, and the out-of-project allowance is this project's memory and this session's scratchpad only (6.31.1)

[PrzemekGalarowicz]

Summary

This is the write-guard-narrowing increment, released as 6.31.1 (a patch). It makes two changes to the write guards.

• M4, the backslash-named link. On a / system, a backslash is part of a file name. protect-trusted-paths.cjs now carries a byte-equal copy of the physical-target resolution that enforce-writes-scope.cjs already uses; a ✧ test pins that the two copies stay equal. The hook judges that target after its own check, and only then. As a result, a symlink named like s\x that points at the root can no longer carry a write to a trusted doc, or to canon under a plan-origin scope. The canon escape never authorizes a target whose path contains a backslash. Every verdict this changes moves toward deny, and every old denial keeps its message.

• M7, the install-posture out-of-project allowance. In an installed project, outside an open run, writes outside the project are now allowed in three places only:

  • this project's auto-memory folder, for either of two keys: the key of the folder holding the transcript, or the canonical main-checkout key;
  • this session's own scratchpad, only in the shape Claude Code writes it: <temp root>/claude-<uid>/<key>/<session_id>/scratchpad;
  • an ordinary temp path. Such a path never contains a claude-<uid> folder, never lies inside the Claude config directory, and is not inside HOME when HOME is itself inside a temp root.

  Before this change, every project's memory folder and both whole temp roots were writable. A payload field that is absent, malformed, or not in normal form grants nothing. A new Claude-state deny variant names the memory keys and the scratchpad rule, and it offers no Bash route.

The human-only bytes changed only through proposed/human-only.patch: .claude/hooks/enforce-writes-scope.cjs, .claude/hooks/protect-trusted-paths.cjs and LIMITS.md §7. The maintainer checked the patch's sha256 (6cceeebc…6d82b5aff) and applied it with proposed/apply.sh, which produced commit 2bf04a8. After the apply, shasum -a 256 -c proposed/human-only.sha256 reads OK for all three files. The agent-writable side of the change covers the hook tests, the CHANGELOG, CLAUDE.md, the README and pharn/floor/README.md, and SKILLS_VERSION.

Review rounds

• GATE 1: approved by the orchestrator under the maintainer's delegation, with five rulings. This was a model decision, not a human approval (PLAN.md).
• Grill: 7 advisory concerns, none blocking; each was amended in place.
• GATE-2 review: GREEN, with F1 important and F2–F5 minor. GATE 2 → FIX: F1–F4 were fixed and F5 was accepted. F1 dropped an unmeasured clause. F2 made the scratch remedy reachable. F3 bounded the claims to keys. F4 corrected a count. The lesson candidate was skipped, and is kept in SHIP.md.
• Case-sensitivity audit: the new tests were audited because CI runs on ext4. The audit is recorded in BUILD.md.
• Independent patch review: I1 and m4 were fixed in apply.sh. It now checks the file list, applies with one --include per path, compares the working tree before and after, prints the patch's own sha256, and restores from HEAD on every failure, including a failed commit. m1 and m3 were fixed in the patch; both only add denials. m2 is named in LIMITS.md §7.
• Merges: origin/main was merged twice, at c1bf663 and 17dda60, and the version renumbered to 6.31.1. The patch carries no version string.

Verification

/pharn-dev-verify over the applied tree: PASS. Every gate exits 0: format:check, lint, lint:md, validate, the trust-fence structural pair, and test (4250 of 4250). reconcile reads CLEAN under the epoch the apply anchored. check:changelog-entry is GREEN against 17dda60.

Before the apply, verify read FAIL with failing_gates: ["test"]. That was the designed stop, covering exactly the 32 expected-fail titles, all of which passed against the patch in a throwaway worktree.

Named follow-ups (not built, P7)

• windows-claude-temp-layout
• custom-auto-memory-dir
• protect-fifo-git-hang, protect-firmlink-spelling and deep-path-segment-slowness. The patch review found these three and they predate this increment.

Closed by this increment: protect-backslash-separator.

Records: .dev/features/write-guard-narrowing/ (PLAN.md, GRILL.md, BUILD.md, REGRESSION.md, VERIFY.md, REVIEW.md, SHIP.md, proposed/).

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 8ceef1b0-86e8-48e0-ab0c-8f0db2a7e86c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}