docs(guard): clarify CCC_ALLOW_GATED only works in harness env, not agent command prefix#318
Merged
Merged
Conversation
…gent command prefix The deny message told the caller to "re-run with CCC_ALLOW_GATED=1", which misleads agents into prefixing the flag on the Bash command. The PreToolUse hook runs BEFORE the command in its own environment, so such a prefix never reaches the guard (verified live on gwakga/vps7, 2026-07-07: prefixed re-run still denied). Reword the deny hint and the header comment to state that the flag is operator-set harness-process-env only, and point agents to non-gated alternatives or operator execution. No behavior change — message/comment only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
seoseo-ai
approved these changes
Jul 7, 2026
seoseo-ai
left a comment
seoseo-ai
left a comment
Collaborator
There was a problem hiding this comment.
Message/comment-only change; live-verified behavior description matches guard.sh escape-hatch logic (env read pre-execution). CI 7/7 green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Reword the guard deny hint + header comment:
CCC_ALLOW_GATED=1is only honored when set in the harness process environment by the operator. A prefix inside an agent Bash command never reaches the PreToolUse hook (it runs first, in its own env).Why
Live-verified on gwakga/vps7 (2026-07-07): after operator approval, re-running the approved read-only broker query with a
CCC_ALLOW_GATED=1prefix was still denied bysecret-exfil. The old message ("re-run with CCC_ALLOW_GATED=1") misleads agents into a no-op self-approval attempt. The deny-by-default design is correct — only the guidance text was wrong.Evidence
BLOCKED by ccc-node guard [secret-exfil]${CCC_ALLOW_GATED:-0}from its own env (line ~50), before the Bash command executesbash -ncleanWiki cross-ref: gwakga A2A test session, LOG entry to follow.
🤖 Generated with Claude Code