feat(harness-ops): probe the write lanes' Grep, Glob and Read denials per Claude Code version

Problem

The write lanes rely on Read deny rules (Read(//proc/**), and Read(/<workspace>/.git/**) from #8726) to keep Grep and Glob away from /proc/*/environ and the checkout's git config. The permissions docs call Read rules on Grep and Glob "a best-effort attempt", so a Claude Code release could change what they cover without notice. #8726's check was a one-off local sweep.

Proposed

Add a lane-permissions set to the behavior-probes cases (plugins/harness-ops/skills/behavior-probes/cases/), run per Claude Code version under --permission-mode dontAsk with the write lane's allow and deny lists:

denied: Grep /proc/self/environ; Grep /proc/self with glob environ; Glob /proc/*/environ; Grep path .git; Read .git/config
allowed (paired controls): Grep and Read inside the checkout

Two gaps first: scripts/probe.py build_argv takes no --allowedTools/--disallowedTools, and the probe saves raw streams, which would capture /proc content on a failed deny, so it needs a mode that records only the verdict.

Acceptance

The seven cases run under the behavior-probes skill and report pass/fail with the Claude Code version.
No raw tool output is written for these cases.

🤖 Generated with Claude Code

https://claude.ai/code/session_012ws5jqYugGSseBMZ9BuP9h

Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.

Size: Medium
Complexity: Medium
Uncertainty: Known
Flags: none
Blocked by: none

Decision recorded. The owner answered in the Refinement and Issue Triage sessions (2026-10-25), deciding the open items below on the facts:

go with whatever the facts/data/metrics + /discovery:research says and ensure we're aligned with SOLID, DRY/SSOT principles

[quote truncated; the full decision is at the link]

#8737 (comment)

The decision settles the one open question (the verdict-only mode is a per-case field in expect.json), so nothing further is asked.

What I understood: add a lane-permissions probe set (seven cases) to behavior-probes, with --allowedTools/--disallowedTools support and a verdict-only mode that saves no raw output. The recorded criteria are the scope. The live run costs money and runs only on request, so it stays a host-run item. Pull request #10331 merged with Refs:; a maintainer should check which criteria it already covers.

_{Automated triage, applied by the lanes App.}

The triage sweep dispatched intake triage for this issue (attempt 1 of 2).

Not admitted to the issue lane: no trusted-human acceptance criteria: a listed human must put the confirmed - [ ] criteria in the body or post them as their own comment, or, on an issue a listed human filed, intake's newest refinement comment must hold them unedited. Admission takes the issue once each of those is met, when intake triages it again (.github/actions/resolve-config/admission-rules.json).

The latest triage verdict holds nothing: the issue is at status: ready.

Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.

Intended outcome: Add a lane-permissions case area to behavior-probes with seven cases (five denials, two in-checkout controls) run under dontAsk with the write lane's allow and deny lists, plus probe.py support for allow/deny flags and a verdict-only mode that saves no raw output.

Acceptance criteria

Dependencies

#8726 (adds Read(/<workspace>/.git/**) to the write lane deny list); the rule is already at .github/actions/collect-base-activity/action.yml:789, so nothing blocks

Related work

feat(harness-ops): add a live behavior-probe harness for Claude Code platform behavior #6647 (related): merged PR that added the live behavior-probe harness this extends
feat(harness-ops): add review-bot thread and hook updatedInput behavior probes #6679 (related): merged PR that added earlier behavior-probe cases, a model for the case layout

Sources read

plugins/harness-ops/skills/behavior-probes/scripts/probe.py:432: build_argv sets permission-mode, settings, model and budget flags, no allowedTools or disallowedTools
plugins/harness-ops/skills/behavior-probes/scripts/probe.py:490: live_runner always writes the full stdout to raw/
plugins/harness-ops/skills/behavior-probes/scripts/probe.py:148: discover finds cases at cases/<area>/<case>/expect.json
plugins/harness-ops/skills/behavior-probes/scripts/probe.py:173: a negative-outcome case must name a positive control
plugins/harness-ops/skills/behavior-probes/cases/sandbox/write-in-cwd-runs/expect.json:1: example of the expect.json fields for a control case
.github/actions/collect-base-activity/action.yml:789: write skill deny set includes Read(//proc/) and Read(/$WORKSPACE/.git/)
.github/actions/collect-base-activity/action.yml:793: allow and deny lists are passed as --allowedTools and --disallowedTools

_{Automated refinement by the lanes App. Intake triages the issue again with it.}

The work-resolve-issue lane stopped partway through this issue and needs a person.

Why, in the run's own words:

already-done: every in-repo acceptance criterion of ＃8737 is already on main (released in harness-ops 4.9.0, CHANGELOG.md:21-25), so there is nothing left to change. probe.py passes allowed_tools/disallowed_tools (or a shared tool_rules file) as --allowedTools/--disallowedTools (probe.py:84-85); verdict_only blanks a row's tool text (probe.py:508-510, :542), and rejudge keeps a verdict-only row and says why (probe.py:796-808); cases/lane-permissions/ holds the seven cases (five denials, each naming a control, plus grep-in-checkout-runs and read-in-checkout-runs), all verdict_only under dontAsk with cases/lib/lane-write-tools.json; test_probe.py covers the argv, the verdict-only stream and text, rejudge and the lane-permissions dry run (test_probe.py:571-742); SKILL.md:48-61 and :96-100 name the area and the verdict-only mode. What remains is the host-run item, a live run of the seven cases, which spends money and runs only when a person asks (SKILL.md:42). A person should close the issue, or keep it open for that live run.

What the run says it did not do:

Did not run probe.py validate, probe.py run --dry-run or test_probe.py here: this lane allows no interpreter. I confirmed the existing tests by reading them only. Nothing was changed, so nothing new needed them.
The host-run live run of the seven lane-permissions cases was not done: it spends money and runs only when a person asks (SKILL.md:42).
No review, build or lint step ran, because there is no diff to review.

Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40407715497

To retry, remove needs-human and add agent-ready again.

Host run. A live run of the seven behavior-probes lane-permissions cases on Claude Code 2.1.312 passed every case and saved no raw tool output.

What ran, on Linux (WSL2), subscription login, no API key in the environment:

probe.py validate: 41 cases, 0 problems.
probe.py run --dry-run --area lane-permissions: 7 pass, exit 0.
probe.py run --live --area lane-permissions --retries 1, default ceilings (20 runs): 7 runs, exit 0, no retry needed. Each case ran under --permission-mode dontAsk with the write lane's lists from cases/lib/lane-write-tools.json as --allowedTools and --disallowedTools.
claude --version: 2.1.312 (Claude Code).

Case	Expected	Observed	Verdict
`grep-proc-environ-denied`	deny (rule)	deny, rule	pass
`grep-proc-self-glob-environ-denied`	deny (rule)	deny, rule	pass
`glob-proc-environ-denied`	deny (rule)	deny, rule	pass
`grep-git-dir-denied`	deny (rule)	deny, rule	pass
`read-git-config-denied`	deny (rule)	deny; seen only in `result.permission_denials`, so the reason type reads `unknown`	pass
`grep-in-checkout-runs`	ran	ran	pass
`read-in-checkout-runs`	ran	ran	pass

Acceptance:

The seven cases run under the behavior-probes skill and report pass/fail with the Claude Code version: met (2.1.312, all pass).
No raw tool output is written for these cases: met. The run's raw/ directory stayed empty, every result row's tool text was blank, and a grep of the results file for environment- or git-config-shaped strings found 0 matches.

PR recording the result as behavior-probes record 14: #10632

Target labels: add none; remove host-run.

Navigation Menu

Repository navigation

feat(harness-ops): probe the write lanes' Grep, Glob and Read denials per Claude Code version #8737

Problem

Proposed

Acceptance

10 remaining items

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

feat(harness-ops): probe the write lanes' Grep, Glob and Read denials per Claude Code version #8737

Description

Problem

Proposed

Acceptance

Activity

github-actions commented on Oct 20, 2026

github-actions commented on Oct 26, 2026

melodic-automation-lanes commented on Oct 26, 2026

melodic-automation-lanes commented on Oct 26, 2026

melodic-automation-lanes commented on Oct 26, 2026

10 remaining items

melodic-automation-lanes commented on Oct 26, 2026

kyle-sexton commented on Oct 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions