Repository navigation
fix(llm): send the Claude Code identity line only to OAuth clients (CLEAN-107) - #15
Merged
Merged
Conversation
…LEAN-107) 2ae9c3b prepended the identity block to every system param, which broke the buildSystemParam specs on main and leaked the line into API-key requests. The block now goes out only through sk-ant-oat clients, ahead of the prompt's single cache breakpoint. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Oct 8, 2026
maksymhryzodub-prog
added a commit
that referenced
this pull request
Oct 26, 2026
…1.0 (CLEAN-158) Phase 9 of the ECC harness principles (specs/001-ecc-agent-principles, T085-T090), plus the third security-review fix set (US5/US6). - CI: a separate `eval` job on main runs `bun run eval`; model-backed sets report "pending" without an LLM_API_KEY secret, a missed threshold fails the job, and the image build does not depend on it. - Docs: guard/instinct/session/skill/task rows in the agent slice README, loop row in the runtime README; IMPROVEMENT_PLAN marks #4, #6, #10, #15 as superseded by the CLEAN-150 phases; quickstart-results.md records what each scenario is covered by and which steps remain manual. - Version 0.31.0. - Security review: workers are bounded by effect, not by a name list — without tools.delegate.allowWrite they get read tools (plus per-call tools such as file/http whose write calls the loop refuses), so a new or MCP write tool is excluded by default; the verifier prompt fences tool output and the draft as data and a rewrite that balloons or adds a link the draft never had is dropped in favour of the draft marked unverified. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
maksymhryzodub-prog
added a commit
that referenced
this pull request
Oct 26, 2026
…1.0 (CLEAN-158) Phase 9 of the ECC harness principles (specs/001-ecc-agent-principles, T085-T090), plus the third security-review fix set (US5/US6). - CI: a separate `eval` job on main runs `bun run eval`; model-backed sets report "pending" without an LLM_API_KEY secret, a missed threshold fails the job, and the image build does not depend on it. - Docs: guard/instinct/session/skill/task rows in the agent slice README, loop row in the runtime README; IMPROVEMENT_PLAN marks #4, #6, #10, #15 as superseded by the CLEAN-150 phases; quickstart-results.md records what each scenario is covered by and which steps remain manual. - Version 0.31.0. - Security review: workers are bounded by effect, not by a name list — without tools.delegate.allowWrite they get read tools (plus per-call tools such as file/http whose write calls the loop refuses), so a new or MCP write tool is excluded by default; the verifier prompt fences tool output and the draft as data and a rewrite that balloons or adds a link the draft never had is dropped in favour of the draft marked unverified. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
maksymhryzodub-prog
added a commit
that referenced
this pull request
Oct 26, 2026
…1.0 (CLEAN-158) (#31) * chore(harness): polish — eval job in CI, docs, plan supersession, 0.31.0 (CLEAN-158) Phase 9 of the ECC harness principles (specs/001-ecc-agent-principles, T085-T090), plus the third security-review fix set (US5/US6). - CI: a separate `eval` job on main runs `bun run eval`; model-backed sets report "pending" without an LLM_API_KEY secret, a missed threshold fails the job, and the image build does not depend on it. - Docs: guard/instinct/session/skill/task rows in the agent slice README, loop row in the runtime README; IMPROVEMENT_PLAN marks #4, #6, #10, #15 as superseded by the CLEAN-150 phases; quickstart-results.md records what each scenario is covered by and which steps remain manual. - Version 0.31.0. - Security review: workers are bounded by effect, not by a name list — without tools.delegate.allowWrite they get read tools (plus per-call tools such as file/http whose write calls the loop refuses), so a new or MCP write tool is excluded by default; the verifier prompt fences tool output and the draft as data and a rewrite that balloons or adds a link the draft never had is dropped in favour of the draft marked unverified. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): refuse executable frontmatter in rule, instinct and skill files (CLEAN-158) gray-matter evaluates `---js` / `---javascript` frontmatter as code. Rule files are operator-authored, instinct files runtime-written and SKILL.md files model-written via skill_write — all live in the agent directory, so none may carry executable frontmatter. A shared safeMatter() refuses any language tag on the opening fence and disables every non-YAML engine; the three gateways use it, and a spec proves `---js` is rejected without running. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(spec): manual acceptance checklist for the harness principles (CLEAN-158) Seven sections mirroring the user stories, run against a live agent over a channel. Marks which scenarios also have automated counterparts and which exist only here (protected-rule override, tool_describe, instinct conflicts, hard-limit compaction, quiet tool failures, verifier injection, worker concurrency and history isolation, audit trail, frontmatter refusal). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(spec): link the manual acceptance checklist from quickstart results (CLEAN-158) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
mainCI is red since 2ae9c3b (run):buildSystemParamstarted prepending the blockYou are Claude Code, Anthropic's official CLI for Claude.for every client, while the spec still expected a single prompt block. The line is only needed for OAuth subscription tokens (sk-ant-oat*), and it was also leaking into API-key requests.What
buildSystemParam(prompt, { oauth })— OAuth gets the identity block first, API key gets the prompt alone (old behaviour).ClaudeRepositoryremembers which clients are OAuth and passes the flag from both call sites (stream + create). Keyed by client object, so it stays correct after the API-key fallback takes over a pool slot.cache_control— it sits before the prompt's breakpoint and is cached with it, instead of burning a second breakpoint on a block far below the cacheable minimum.buildSystemParam, plus a check of what each credential kind actually puts on the wire (SDK stubbed).Testing
bun test— 144 pass. The one local failure (telegramFile > file lands under data/channels/) is a pre-existing Windows path-separator issue, unrelated and green on Linux CI.Jira: https://dreamvention.atlassian.net/browse/CLEAN-107
🤖 Generated with Claude Code