fix(hooks): match dry-run MCP writes by action, not by namespace prefix - #219
Open
VxxxlBxxxxv wants to merge 2 commits into
Open
fix(hooks): match dry-run MCP writes by action, not by namespace prefix#219VxxxlBxxxxv wants to merge 2 commits into
VxxxlBxxxxv wants to merge 2 commits into
Conversation
The dry-run gate whitelisted IWE Gateway write tools only under the legacy connector prefix `mcp__claude_ai_IWE__*`. The same Gateway (server `iwe-knowledge`, mcp.aisystant.com/mcp) is now exposed under several other prefixes depending on how it is connected, so every current write tool slipped through the gate while a dry-run sentinel was active: mcp__claude_ai_IWE__<action> legacy connector "IWE" mcp__iwe_knowledge_<action> OMP runtime (single-underscore sep) mcp__iwe-knowledge__<action> project .mcp.json (server id) mcp__claude_ai_https_..._mcp__<action> URL-derived connector name Repro (sentinel active): mcp__iwe-knowledge__personal_write, dt_write_digital_twin, send_telegram_message, create_repository, run_strategist, capture_trace, ... all returned exit 0 (allowed) instead of exit 2 (blocked). Fix: match IWE writes by ACTION (suffix after the last separator) instead of the full tool name. Pattern `*_<action>` catches both `__<action>` and the OMP single-underscore `_<action>`, so it survives future namespace migrations. Vendor MCP tools keep exact-name matching (vendor prefixes are stable). Contract doc (memory/dry-run-contract.md) updated with the drift table. Verified: all 4 namespaces block; read-only tools (search, dt_read_*, *_stats, *_status, agent_status_list) still allowed with no false positives. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
VxxxlBxxxxv
added a commit
to VxxxlBxxxxv/FMT-exocortex-template
that referenced
this pull request
Jul 6, 2026
…ov#226 fix), CHANGELOG Доставлено обновлением v2.3.0: repair-pass реставрировал 6 stale runtime-файлов (последствие частичного обрыва 04.07). dry-run-gate.sh + dry-run-contract.md восстановлены из PR TserenTserenov#219 (action-match фикс, upstream ещё не влит). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Проблема — namespace drift обходит dry-run gate
dry-run-gate.shзаносил write-инструменты IWE Gateway в whitelist только под legacy-префиксом коннектораmcp__claude_ai_IWE__*. Но один и тот же Gateway (серверiwe-knowledge,mcp.aisystant.com/mcp) сейчас выдаётся под несколькими префиксами — в зависимости от способа подключения. В результате при активном dry-run sentinel все актуальные write-инструменты проходят сквозь gate.Четыре namespace одного Gateway:
mcp__claude_ai_IWE__<action>mcp__claude_ai_IWE__personal_writemcp__iwe_knowledge_<action>_)mcp__iwe_knowledge_personal_writemcp__iwe-knowledge__<action>.mcp.json(server id)mcp__iwe-knowledge__personal_writemcp__claude_ai_https_..._mcp__<action>mcp__claude_ai_https_mcp_aisystant_com_mcp__personal_writeВоспроизведение
Sentinel активен → прямой smoke хука с
{"tool_name":"mcp__iwe-knowledge__personal_write"}:Так же протекали
dt_write_digital_twin,send_telegram_message,create_repository,run_strategist,run_extractor,capture_trace,personal_delete,personal_purge_source,grant_consentи др. Блокировался только устаревшийmcp__claude_ai_IWE__*, которого в текущем рантайме уже нет.Impact: критично для
/audit-installationи ritual smoke-test — агент считает dry-run включённым, но MCP-write действия в текущем namespace выполняются реально (запись personal knowledge, Digital Twin, создание repo, Telegram delivery, strategist run с commit).Фикс
Сверять IWE-инструменты по действию (суффикс после последнего разделителя), а не по полному имени. Паттерн
*_<action>ловит и__<action>(двойной разделитель), и OMP-вариант_<action>— переживает будущие миграции namespace. Вендорские MCP (Gmail/Calendar/Drive/Linear/Railway) остаются на exact-match — их префиксы стабильны.memory/dry-run-contract.mdобновлён таблицей дрейфа.Проверка
Прямой smoke правленого хука (23 проверки, все прошли):
personal_write,dt_write_digital_twin,send_telegram_message,run_strategist,create_repository,capture_trace,grant_consent,personal_purge_source.search,knowledge_search,dt_read_digital_twin,personal_search,personal_reindex_status,knowledge_feedback_stats,agent_status_list,github_status.Gmail__create_draft,ext-railway__set-variables) → BLOCK.Write→ BLOCK; без sentinel → ALLOW.bash -n— синтаксис чист.Ортогонально открытому #194 (тот же файл, но правит git/cleanup handling, whitelist не трогает).
🤖 Generated with Claude Code