feat(claude): agent-layer tool-use audit hook (SANDY_TOOL_AUDIT, HF Issue 6) - #92
Merged
Conversation
…ssue 6)
The post-mortem's loudest defender recommendation is 'instrument the agent harness
itself, not just external observability.' Sandy is otherwise entirely the NDR
side (constrains the box, sees no tool calls). This adds the EDR side.
- Bake /usr/local/bin/sandy-tool-audit into the base image (next to
sandy-claude-statusline): reads Claude Code's PreToolUse JSON on stdin, appends
one {ts,tool,args} JSONL line to ~/.claude/tool-audit.jsonl. ALWAYS exits 0 (a
non-zero PreToolUse hook would block the tool call); args truncated to 200 chars.
- settings.json seeder: when SANDY_TOOL_AUDIT=1 (passive-safe), add a PreToolUse
hook pointing at the helper — ONLY if the user has no PreToolUse hook of their
own (same only-if-absent guard as the statusLine default). Verified: off->none,
on->seeded, host-hook->preserved.
- SANDY_TOOL_AUDIT passive key + metadata + regen; session-end pointer in cleanup;
SPEC Appendix A (baked helper); CLAUDE.md doc with the two honest limits
(Claude-only; not tamper-proof vs a determined agent — telemetry for the
primary adversary). run-tests.sh §82.
Additive; schema_version stays 1.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
# Conflicts: # CLAUDE.md # SPECIFICATION.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HF-incident analysis Issue 6 (Medium — the post-mortem's single loudest defender recommendation; NONE disclosure — purely additive capability).
'Instrument the agent harness itself, not just external observability … external controls have no visibility into the agent itself' (EDR-vs-NDR). Sandy is otherwise entirely the NDR side.
SANDY_TOOL_AUDIT=1(passive-safe, default0) turns on the EDR side./usr/local/bin/sandy-tool-audit(next tosandy-claude-statusline): reads Claude Code's PreToolUse JSON on stdin, appends one{ts,tool,args}JSONL line to~/.claude/tool-audit.jsonl. Always exits 0 (a non-zero PreToolUse hook would block the tool call);tool_inputtruncated to 200 chars.PreToolUsehook only if the user has none (same only-if-absent guard as thestatusLinedefault). Verified: off→none, on→seeded, host-configured-hook→preserved.run-tests.sh §82.Pairs with Issue 4 (#91) to answer 'what did this session do' from both the network and harness sides. Additive;
schema_versionstays 1.