Issue 340: an agent can plant a hook in every agent session on the mesh #240

Merged

mesh-admin merged 6 commits from issues/340-an-agent-can-plant-a-hook-in-every-session into main 2026-10-09 08:00:26 +00:00

Conversation 1 Commits 6 Files Changed 3

+402

mesh-admin commented 2026-10-09 00:30:31 +00:00

Contributor

Copy Link

Copy Source

Report and diagnosis for the hole the 2026-10-09 review traced: the claude-code module's tools registered hooks, managed settings, permission rules and tool servers at the mesh and node scopes, the controller's settings verb took the module's managed_settings and mcp_servers, and skills, commands and subagents could carry text that runs by itself. The tool runner is not told who called, so an agent confined on the control node could run a command as the operator on every other node.

Must land before ADR 0266's agent account is switched on (hq #225).

Fixes, not merged:

• mesh-controller: a mergeable file's own keys are the terminal's
• mesh-catalog: claude-code refuses registering what a session runs; claude_code_registrations lists what exists

The diagnosis also records that the fix departs from ADR 0213 option 3 and ADR 0216 §2/§7; a decision record and the to-be 36 amendment follow through playbook 02.

hq's four checks pass (records, index, cycle, words).

Report and diagnosis for the hole the 2026-10-09 review traced: the `claude-code` module's tools registered hooks, managed settings, permission rules and tool servers at the mesh and node scopes, the controller's settings verb took the module's `managed_settings` and `mcp_servers`, and skills, commands and subagents could carry text that runs by itself. The tool runner is not told who called, so an agent confined on the control node could run a command as the operator on every other node. **Must land before ADR 0266's agent account is switched on (hq #225).** Fixes, not merged: - mesh-controller: a mergeable file's own keys are the terminal's - mesh-catalog: claude-code refuses registering what a session runs; `claude_code_registrations` lists what exists The diagnosis also records that the fix departs from ADR 0213 option 3 and ADR 0216 §2/§7; a decision record and the to-be 36 amendment follow through playbook 02. hq's four checks pass (records, index, cycle, words).

mesh-admin added 1 commit 2026-10-09 00:30:31 +00:00

Issue 340: an agent can plant a hook in every agent session on the mesh ... 2953b8a8f4

Record the hole the review traced, why the module cannot tell who called,
which kinds run or are obeyed in a session and which stay registrable,
the fix in the controller and the module, what is registered today, and
that it must land before ADR 0266's agent account is switched on.

mesh-admin commented 2026-10-09 00:30:48 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/hq@cdf0e71d8716 — delivered since 2026-10-09T08:00:51Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

• 2026-10-09 07:52 (new) → proposed (announced): novox/hq#240's head announced
• 2026-10-09 07:52 proposed → checked (checked): the verdict names this commit
• 2026-10-09 07:52 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-09 08:00 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-09 08:00 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/hq@cdf0e71d8716` — **delivered** since 2026-10-09T08:00:51Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-09 07:52 (new) → proposed (announced): novox/hq#240's head announced - 2026-10-09 07:52 proposed → checked (checked): the verdict names this commit - 2026-10-09 07:52 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 08:00 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 08:00 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-09 00:55:26 +00:00

Issue 340: the whole layer of a module with a mergeable file is the terminal's, and the text still registrable is a risk said ... 1dbfb2d85a

The review found that a mergeable file takes any key, not only those it
names, and that the text a session reads stays registrable through a verb;
say both, and the follow-ups the module took.

jschoubben added 1 commit 2026-10-09 07:29:41 +00:00

Issue 340: record the operator's decisions, and open 342 for passwords taken as settings ... 8a6f19e457

Shared agent text is the terminal's until a surface of the operator's own
updates it, the wider controller rule stands, and a password is not a
setting: 342 names every module that takes one through a setting.

jschoubben added 1 commit 2026-10-09 07:43:06 +00:00

Issue 340: the home scope reached the operator's own home, and bus text still renders ... 523bb9c55a

The confirmation review found the home scope wrote the operator's own
~/.claude on nodes where the agent is the operator, and that text put
straight on the bus at the mesh or node scope still renders; record both,
the fix for the first, and what closes the second.

jschoubben added 1 commit 2026-10-09 07:43:14 +00:00

Issue 340: say plainly which test refuses the new url 0badde3a56

jschoubben added 1 commit 2026-10-09 07:51:58 +00:00

Issue 340: removing from or restoring to the operator's own home is refused too cdf0e71d87

mesh-admin merged commit d81ae38970 into main 2026-10-09 08:00:26 +00:00

mesh-admin deleted branch issues/340-an-agent-can-plant-a-hook-in-every-session 2026-10-09 08:00:26 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#240