disk-hygiene: kill switch trusts /etc/claude-code managed settings on WSL, where that directory is user-writable #7287

Activity

1. kyle-sexton

   added the

   Bug

   issue type on Oct 12, 2026
2. kyle-sexton

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 12, 2026
3. github-actions commented on Oct 12, 2026

   

   github-actionsBot

   on Oct 12, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for the report. Automated triage handed this issue to a maintainer.

   _{Automated triage. A maintainer reviews it.}
4. github-actions

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 12, 2026
5. kyle-sexton

   removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 12, 2026
6. kyle-sexton commented on Oct 13, 2026

   

   kyle-sexton

   on Oct 13, 2026

   MemberAuthor

   More actions

   Decision recorded. The owner approved applying independently verified recommendations (high-risk set, reviewed) on 2026-10-13.

   • How does the kill switch treat a managed file that the current user can write? → Asymmetric: a managed value that restricts (audit-only) is honored from any source; a managed value that enables execution is honored only when the file is root-owned and not writable by the current user
     Basis: https://code.claude.com/docs/en/managed-settings#present-admin-documents (fetched 2026-10-12, line 167: 'On WSL, /etc/claude-code is user-writable as well'); plugins/disk-hygiene/lib/killswitch_config.py:51-94 (Linux/WSL path), :291-317 resolve_effective per issue

   disk-hygiene's kill switch returns a managed-settings value before user settings, and reads /etc/claude-code on WSL, which the docs say is user-writable, so a user process can force-enable the execution tiers. The docstring on main already notes the path is not admin-only everywhere, but the code still trusts it.

   Verification notes:

   • resolve_effective is at killswitch_config.py:313-337 on main, not :291-317 (record took the issue's range); behavior as described.
   • Implementation note: apply the ownership check per file, including each managed-settings.d drop-in, since _managed_effective lets the last configured file win.

   Verified by an independent fresh-context check (confirmed, risk high): gh issue view 7287 (open, no owner decision); origin/main plugins/disk-hygiene/lib/killswitch_config.py:51-96 (docstring already says not admin-only everywhere; linux* returns /etc/claude-code path); origin/main killswitch_config.py:265-337 (_managed_settings_files, _managed_effective, resolve_effective returns managed verdict before user settings; default closed to enabled); WebFetch https://code.claude.com/docs/en/managed-settings line 167: 'On WSL, /etc/claude-code is user-writable as well'; git log killswitch_config.py: latest #7252 docs only

   Admission to an agent lane stays with the work-class rules and owner ratification.
7. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   Decision recorded.

   Question: How should the disk-hygiene kill switch treat a managed settings file the current user can write, such as /etc/claude-code on WSL?

   Owner's answer: Asymmetric trust: a managed value that restricts is honored from any file, but a managed value that enables execution is honored only from a file that is root-owned and not writable by the current user, checked per file including each drop-in.

   The owner confirmed this decision, first recorded at #7287 (comment), in an attended backlog-shaping session on 2026-10-18. The question was "Confirm the 10 decisions, #7287's kill-switch hardening included, and admit them to the paced queue?" and the owner answered "Yes, all 10 (Recommended)".

   Posted by AI from the owner's answer in that session.
8. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   Agent Brief

   Type: Bug
   Summary: The disk-hygiene kill switch honors an enabling managed-settings value only from a file that is root-owned and not writable by the current user.

   Current behavior:
   The kill switch treats /etc/claude-code/managed-settings.json (and its managed-settings.d drop-ins) as an organization-controlled source on every linux platform, WSL included, and returns a configured managed value before reading user settings. On WSL that directory is user-writable, so any user process can force-enable the clean skill's execution tiers.

   Desired behavior:

   • A managed value that restricts (audit-only, disk_hygiene_enabled false) is honored from any managed file, whoever owns it.
   • A managed value that enables execution is honored only when that specific file is root-owned and not writable by the current user. The check runs per file, including each drop-in, because the last configured file wins.
   • A managed file that fails the check is skipped for enabling purposes and resolution continues to user settings.
   • The managed_settings_path docstring no longer claims the path cannot be forged.

   Key interfaces:

   • resolve_effective(): same signature; an enabling managed value from an untrusted file no longer wins.
   • Managed-file trust check: per file, owner uid 0 and not writable by the current uid.

   Acceptance criteria:

   • scripts/run-test-file.sh on the disk-hygiene pytest file covering the kill switch passes, with new cases: a user-owned managed file setting enabled=true does not enable when user settings say false; a user-owned managed file setting enabled=false still restricts; a root-owned non-writable file setting enabled=true still enables (ownership stubbed).
   • A drop-in case shows the check applies to each managed-settings.d file.
   • scripts/check-changelog-fragments.sh passes.

   Out of scope:

   • The fail-open hook rows tracked in feat(guardrails): adopt onFailure block for blocking guard hooks across plugins #6755.
   • Windows and macOS managed paths.
   • Merging: a human merges this PR.

   ---

   This was generated by AI during backlog shaping. The owner approved its admission in an attended backlog-shaping session on 2026-10-18.
9. kyle-sexton

   added

   merge: human

   agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

   work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

   and removed

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 18, 2026
10. melodic-software-github-iac

    removed

    merge: human

    on Oct 18, 2026
11. kyle-sexton

    closed this as completedin #8115on Oct 19, 2026