|
| 1 | +# Claude Code managed-policy preflight — candidate #122 |
| 2 | + |
| 3 | +This candidate adds the `claude-code-2.1.296-stdio-files` projection before |
| 4 | +Claude Code user-global stdio configuration writes. It addresses a measured |
| 5 | +failure in the published 0.50.0 baseline: replacing a denied server command with |
| 6 | +a relay command can bypass native exact-command denial, while replacing an |
| 7 | +allowed command can make a usable server fail the native allowlist. |
| 8 | + |
| 9 | +## Consumer behavior |
| 10 | + |
| 11 | +Run `mcpm guard enable --client claude-code --server <name> --dry-run` first. |
| 12 | +The same preflight runs for the actual wrap and at the adapter write boundary, |
| 13 | +including `install`, `update`, `up`, setup through those commands, guard disable, |
| 14 | +and toggles. `up --dry-run` preflights before snapshots and secret persistence. |
| 15 | +Recognized wrappers are preflighted during enable and preview even when no rewrap |
| 16 | +is needed, so a legacy underlying-policy violation is not hidden by an |
| 17 | +"already guarded" skip. It compares the current launcher, its recognized underlying command, the proposed |
| 18 | +launcher including **every wrapper argument**, and its underlying command. |
| 19 | +A denied or unknown proposed launch refuses the transformation; no policy bypass |
| 20 | +flag is provided. Exact teardown of a recognized legacy wrapper can restore a |
| 21 | +natively denied original command without granting permission. Replacing a denied |
| 22 | +old command with a different allowed command is also permitted; the original |
| 23 | +decision remains visible. Ordinary direct HTTP writes remain outside this stdio |
| 24 | +projection and keep their native URL policy checks. Guard policy refusals exit 1, including dry-run, and count as |
| 25 | +errors. They do not create config backups or confinement profiles. Unrelated |
| 26 | +servers can still succeed; partial application must be inspected. |
| 27 | + |
| 28 | +Reports contain decisions, rule-list indices and fixed source labels, never raw |
| 29 | +commands, argument values, URLs or environment values. An ordinary unmanaged |
| 30 | +stdio installation remains usable. A passing projection prints a warning that |
| 31 | +overall host policy is **unknown**, including server-managed/MDM/registry/session |
| 32 | +and other-project coverage. No managed policy is edited to accommodate a wrapper. |
| 33 | + |
| 34 | +## Supported projection |
| 35 | + |
| 36 | +The fixed source set is user `~/.claude/settings.json`, current-directory |
| 37 | +`.claude/settings.json` and `.claude/settings.local.json`, and |
| 38 | +`managed-settings.json` plus detection of `managed-mcp.json` under |
| 39 | +`/etc/claude-code` on Linux or `/Library/Application Support/ClaudeCode` on macOS. |
| 40 | +Reads reject symlink components (selected home/root directory aliases are |
| 41 | +canonicalized), non-regular files, invalid UTF-8, duplicate decoded JSON keys, |
| 42 | +malformed JSON and files larger than 1 MiB. Descriptor/path metadata changes |
| 43 | +during a read produce unknown. Missing files are distinct from unreadable files; |
| 44 | +an empty settings file is conservatively unknown rather than an empty allowlist. |
| 45 | + |
| 46 | +Rules contain exactly one `serverName`, `serverCommand` or `serverUrl` key. |
| 47 | +For stdio, command matching is an exact command-and-arguments array comparison; |
| 48 | +environment blocks do not participate. Deny wins. An unset allowlist is |
| 49 | +unrestricted within this file projection; an empty allowlist allows none. |
| 50 | +Lists merge across the supported settings scopes, except a managed |
| 51 | +`allowManagedMcpServersOnly` lock selects the managed allowlist. A command entry |
| 52 | +in the allowlist prevents name-only entries from rescuing stdio commands. |
| 53 | + |
| 54 | +`${VAR}` and `${VAR:-default}` expand without executing anything. Server command |
| 55 | +values use the projected live settings environment; policy command values use |
| 56 | +the launching environment plus managed settings environment. Deny fallback can |
| 57 | +use user settings environment only when a variable is absent from the pinned |
| 58 | +environment and has no `:-default`. An explicitly empty startup value stays empty. |
| 59 | +Known native-filtered environment references, including color/runtime/credential |
| 60 | +controls, are unsupported and produce unknown; this projection does not reproduce |
| 61 | +the client's host-dependent environment filter. Missing or unsupported expansion |
| 62 | +produces unknown. Names remain literal. |
| 63 | + |
| 64 | +`managed-mcp.json` exclusive control and a matching managed `managedMcpServers` |
| 65 | +name prevent rewriting a user-global definition: managed definitions' allowlist |
| 66 | +exceptions are not transferred to a user-controlled wrapper. Other managed |
| 67 | +provided names do not disable ordinary user-global installations. |
| 68 | + |
| 69 | +## Explicit limits |
| 70 | + |
| 71 | +This is a versioned **file-policy projection**, not a full native policy engine, |
| 72 | +host version detection, proof of effective selection, or a runtime enforcement |
| 73 | +claim. Native candidate receipts must identify their source/archive/harness and |
| 74 | +pinned runtime separately. The Linux native target is Claude Code 2.1.296; no |
| 75 | +macOS native result or all-client protection is implied. |
| 76 | + |
| 77 | +A present managed drop-in directory, detected macOS MDM preference file, |
| 78 | +Windows/WSL, alternate config directory, ancestor project settings, worktree |
| 79 | +root selection, or unsupported local policy/source selector refuses the |
| 80 | +transformation as unknown. A top-level `env` in legacy `~/.claude.json` is an |
| 81 | +unsupported additional source and refuses stdio transformations. Supported settings |
| 82 | +JSON must not contain `policyHelper`, `policyHelpers`, `parentSettings`, `managedSourcesBehavior`, `strictPluginOnlyCustomization` or |
| 83 | +`wslInheritsWindowsSettings`; helpers never execute. The plan does not resolve |
| 84 | +remote/registry-managed policy, embedding hosts, session flags, other projects, |
| 85 | +future host environments or future policy changes. Those planes remain unknown |
| 86 | +and are surfaced on successful writes and previews. File reads are snapshots, |
| 87 | +not a transaction with a running client or concurrently changing policy tree. |
| 88 | +Remote HTTP/SSE matching and managed-policy writes are outside this MVP. |
| 89 | + |
| 90 | +Upgrading does not automatically rewrite existing wrappers, reevaluate their |
| 91 | +already-running servers, or add a runtime native-policy enforcement layer. Inspect |
| 92 | +existing wrappers with the supported dry-run. Where authorized, exact unwrapping |
| 93 | +can restore the original command and its native denial; it does not grant that |
| 94 | +command permission to run. Client restart/reload behavior remains separate. |
| 95 | + |
| 96 | +## Evidence |
| 97 | + |
| 98 | +Unit fixtures exercise real shared `replaceServer` and `addServer` write gates, |
| 99 | +allow/deny/unset/empty rules, exact wrapper argv, scope merges, managed-only locks, |
| 100 | +expansion and pinned environments, managed shadowing/exclusive control, malformed |
| 101 | +and duplicate-key sources, unknown source selection, dry-run and confinement |
| 102 | +refusal before backup/profile files. Existing scope-reader fixtures remain green. |
| 103 | + |
| 104 | +Astra independently reproduced additional pre-review candidate bypasses through |
| 105 | +plural policy-helper settings, native default/fallback precedence, a native-filtered |
| 106 | +environment variable, legacy global environment settings and inherited JavaScript |
| 107 | +object keys in variable lookup. The fixes refuse |
| 108 | +unsupported sources/references, implement the pinned fallback order and require |
| 109 | +own-property environment lookup. An attempted |
| 110 | +credential-variable probe did not reproduce and is not counted as a finding. |
| 111 | +Fresh artifact checks must use the final reviewed bytes, not those vulnerable |
| 112 | +pre-review candidate archives. |
| 113 | + |
| 114 | +### Reviewed candidate checkpoint — 2026-11-06 |
| 115 | + |
| 116 | +Sol built the slice; Astra independently reviewed and fixed confirmed regressions. |
| 117 | +The frozen candidate archive SHA-256 is |
| 118 | +`cca729bd4c97881f1a70c2bea458e91377b6de87e8639da156a117255244939d`. |
| 119 | +Its package version is the repository placeholder `0.15.0`, not a published release. |
| 120 | +The final policy-source SHA-256 is |
| 121 | +`2306f09c1f74b9a464d740166444f37814c9677dc96f511857702d49b5561a3d`. |
| 122 | +An independent read-back matched all 66 installed JavaScript files and the archive |
| 123 | +in each native test image to the reviewed build. Receipts bind all changed source |
| 124 | +and test files, root lock, native harness and public usage skill. |
| 125 | + |
| 126 | +- Node 24.20.0: typecheck including tooling, build, 161 test files / 3,789 tests |
| 127 | + passed, three skipped. Coverage passed: 91.55% lines, 86.72% branches, |
| 128 | + 90.28% statements, 86.75% functions; the negative-threshold probe passed. |
| 129 | +- Linux arm64 / Node 26.11.1 / Claude Code 2.1.296: **19 native cases passed**. |
| 130 | + Seven enable cases cover unmanaged, denied, allowed, name-allowed, empty allow, |
| 131 | + expanded deny and allowing both original/wrapper. Five repair/preview cases |
| 132 | + cover three legacy teardown states and denied/unmanaged dry-runs. Five review |
| 133 | + regressions cover helpers, fallback precedence, filtered variables, legacy env |
| 134 | + and inherited keys. Two existing-wrapper audits refuse the unsafe state without |
| 135 | + changing it, including dry-run. Native connection claims include actual |
| 136 | + `initialize` and `tools/list` traffic from the synthetic peer. |
| 137 | +- The same archive passed the modern/legacy direct/guarded protocol matrix: |
| 138 | + **87 passed, zero failed, two expected unsupported, four exclusions**. Archive |
| 139 | + SRI, all runtime files, raw dependency lock, harness/skill hashes and actual |
| 140 | + container boundaries were independently checked. |
| 141 | +- Clean-install smoke of this exact local archive passed using the release |
| 142 | + dogfood script in supplied-spec mode; this is candidate evidence, not npm |
| 143 | + publication. |
| 144 | +- Real macOS Seatbelt dogfood passed: positive control, denied synthetic-secret |
| 145 | + read, intact stdio, tampered profile refusal and recorded confinement event. |
| 146 | + |
| 147 | +Native containers were offline, read-only, UID 1000, capability-free with |
| 148 | +no-new-privileges, disposable state and no host binds or credentials. Native |
| 149 | +`mcp get` deliberately executes only the synthetic peer; product configuration |
| 150 | +operations did not execute it or expose the synthetic secret in their output. |
| 151 | + |
| 152 | +One concurrent coverage attempt hit an existing five-second smoke-test timeout; |
| 153 | +the idle rerun passed without changing tests. One existing-wrapper dry-run probe |
| 154 | +incorrectly assumed no guard state existed after deliberately launching that |
| 155 | +wrapper; its corrected fresh run compared the pre-operation state and passed. |
| 156 | +Both failed attempts are retained and excluded from passing evidence. |
| 157 | + |
| 158 | +Local evidence roots (temporary maintainer receipts, not public distribution): |
| 159 | +`/private/tmp/mcpm-policy-122-final-native-20261106` (`identity.json`, |
| 160 | +`verified-final.json`), `/private/tmp/mcpm-policy-122-final-audit-dry-v2-20261106` |
| 161 | +and `/private/tmp/mcpm-policy-122-final-protocol-20261106/verified-binding.json`. |
| 162 | +These are candidate observations, separate from the vulnerable published 0.50.0 |
| 163 | +baseline and any later actual-published artifact verification. No model/provider |
| 164 | +turn, full host-policy coverage or macOS native-client result is claimed. |
| 165 | + |
| 166 | +Semantics checked against official |
| 167 | +[managed MCP documentation](https://code.claude.com/docs/en/managed-mcp) and |
| 168 | +[settings source documentation](https://code.claude.com/docs/en/settings) on |
| 169 | +2026-11-06. These pages describe later versions too; unsupported planes are |
| 170 | +reported rather than guessed from the latest documentation. |
0 commit comments