mirror of
https://github.com/thedotmack/claude-mem.git
synced 2026-09-20 04:23:02 +08:00
Mamadou Wane
ed2b39b410
Every other entry in OBSERVER_DISALLOWED_TOOLS stops the Observer from acting
on the user's machine. SendMessage and ListAgents let a toolless Observer ask
a session that still can — borrowing that session's authority while "you do
not have access to tools" stays literally true. ListAgents is how a session
finds peers to address, so denying the send without denying discovery is half
a boundary.
Both tools are added to the deny-list, the shipped plugin bundle is synced to
the same 14-tool array, and the docblocks now say plainly that the layered
"no single option is load-bearing" guarantee holds on the SDK path only: on
the CLI spawn path (claude --disallowedTools ...) this list is the sole
enforcement, because tools, allowedTools and canUseTool have no command-line
equivalent.
Author: @mamadou-wane
Refs: #3607 (plan-19 Observer Subprocess Isolation)
Verified against origin/main (1ce59d484), which the branch is already rebased
onto: bun test tests -> 3722 pass, 28 skip, 2 fail (both pre-existing on main:
field-deadline-wire real-network test and plugin-distribution npm-tarball test
that needs a build). tsc --noEmit clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015w89Sfxy7rZK9xDWixDPv7