You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(server): Claude task output tail ignores ids that are not a single path segment - #36216
tailClaudeTaskOutput joins the provider-supplied sessionId and taskId from the Claude SDK stream into ///tasks/.output. An id containing ../ could point the tail at a file outside Claude's per-user task directory and stream its contents into the thread. The fix returns early unless both ids match /^[\w-]+$/ (a single plain path segment). One regression test covers a traversing session id and a traversing task id; it fails on the unguarded code (both cases read the planted 'secret' file) and passes with the guard. The author's approach and commits are kept as-is; origin/main was merged in with no conflicts. Pushing to factory/pr-26501-a1794553696 was refused by the remote, so the work went to factory/pr-36058-a1794586396.
Derived from the issue, diff, and main's adapter code; not executed. In an isolated POSIX T3 server connected to a real client, configure a controlled Claude SDK stream fixture. Under the configured Claude task-output root, create a project directory, and beside that root create outside/tasks/bk6xreeye.output containing a harmless marker. Start a Claude thread whose fixture emits a Bash tool call and a matching system/task_started frame with task_type local_bash, tool_use_id matching the call, is_backgrounded false, session_id ../../outside, and task_id bk6xreeye. Inspect the command's live output: main streams the marker, whereas the fix omits it. Repeat with a valid UUID session_id and task_id ../../../../outside/tasks/bk6xreeye. Finally emit the matching normal tool result and confirm it still appears; use valid IDs and a file inside the normal task directory as a control.
Evidence
Being captured: before and after in the real app. This section is filled in before the pull request can merge.
Tests
vp test run src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts (apps/server): 6/6 pass; same with the guard line removed: new test fails (leaks 'secret' for both ids), restored afterwards; vp run check:changed: format, lint, knip, graphql, typecheck (3 packages), tests (2 files, 8 tests) all pass.
…e path segment
The tail joined the SDK's task_started session_id and task_id into a
filesystem path unchecked, so an id containing `..` could stream a file
outside the Claude task directory as command output. Skip tailing unless
both ids match `^[\w-]+$`.
Fixes#26489
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Macroscope's review found this PR approvable — The change rejects unsafe session and task IDs before reading Claude task-output files. Its impact is limited to live-output tailing for rejected IDs; final task results remain available.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
Walkthrough
Claude task output tailing now checks session and task IDs against a safe path-segment pattern before filesystem access. Tests cover traversal IDs and assert that they produce no output chunks.
Changes: Claude task output path validation
Layer / File(s)
Summary
Validate IDs before tailing apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.ts, apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts
The output tail checks session and task IDs against a safe path-segment pattern before filesystem access. Tests assert that traversal IDs produce no output chunks.
The change blocks path-traversal session and task IDs from reading files outside the Claude task output directory. No concrete merge-blocking defect was found. Adding a resolved-path containment check could be a reasonable follow-up.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title names the actual change: tailClaudeTaskOutput now rejects session or task IDs that are not a single path segment. It uses the conventional commit form with a scope. The title is specific and…
Description check
The description follows the template's main sections: Problem, Change, Scope, Verification, and an agent attribution line. The Problem and Change sections explain the path traversal issue and the guar…
Linked Issues check
[#26489] requires that provider-supplied session and task IDs be rejected when they are unsafe path components. At the reviewed head, tailClaudeTaskOutput returns before any filesystem access unless…
Out of Scope Changes check
The whole-PR diff (merge base f313d0a to head 4511883) touches two files only. ClaudeTaskOutputTail.ts adds the SAFE_PATH_SEGMENT constant and one early-return guard in tailClaudeTaskOutput. Cl…
Full details: Title check
Explanation
The title names the actual change: tailClaudeTaskOutput now rejects session or task IDs that are not a single path segment. It uses the conventional commit form with a scope. The title is specific and matches the raw summary and objectives. It is 83 characters, slightly long but acceptable.
Full details: Description check
Explanation
The description follows the template's main sections: Problem, Change, Scope, Verification, and an agent attribution line. The Problem and Change sections explain the path traversal issue and the guard clearly. Scope links issue #26489 and notes the supersession of #36058. Verification lists focused test runs and the regression test result. The Evidence section says proof capture is in progress and must be filled in before merge. The template requires before/after evidence for behavior changes, and the author marks the real-app reproduction as not executed. The description is mostly complete, but the open Evidence section and the unexecuted reproduction are gaps. The description also includes process notes (remote push refusal, branch naming) that do not belong in the template.
Resolution
Before merge, complete the Evidence section with the real-app before and after results, or state clearly what could not be checked. Remove or shorten the branch and push-refusal notes, since they do not describe the change. Confirm that the Scope section explains why no issue is needed beyond the linked issue #26489.
Full details: Linked Issues check
Explanation
[#26489] requires that provider-supplied session and task IDs be rejected when they are unsafe path components. At the reviewed head, tailClaudeTaskOutput returns before any filesystem access unless sessionId and taskId both match SAFE_PATH_SEGMENT = /^[\w-]+$/ (ClaudeTaskOutputTail.ts). Because . and / are not in \w, neither ID can contain .. or a separator, so path.join(root, project, sessionId, "tasks", taskId + ".output") cannot leave the session directory. The project segment comes from readDirectory(root), not from the stream. The issue also asks for an explicit containment check, as in CheckpointRestoreSafety. The PR does not add one. The regex makes that check redundant for these inputs, so the expected outcome (no escape from the session root) is met. The regression test reads nothing when a session or task id leaves the Claude task directory covers a traversing session ID and a traversing task ID, and it reads a planted file outside the task directory in both cases. The PR description reports that this test fails without the guard. This run did not execute the test, so that claim is taken from the PR description.
Full details: Out of Scope Changes check
Explanation
The whole-PR diff (merge base f313d0a to head 4511883) touches two files only. ClaudeTaskOutputTail.ts adds the SAFE_PATH_SEGMENT constant and one early-return guard in tailClaudeTaskOutput. ClaudeTaskOutputTail.test.ts adds one regression test for the same traversal cases. Both changes implement the ID validation required by #26489. No unrelated code, refactoring, or documentation changes appear in the diff. Generic PR-description material about the branch, merge, and push target is process information, not code scope.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.
The automated pipeline stopped on this pull request and will not merge it:
the proof could not be captured: the agent's turn ended as failed twice
It stays open for a person to finish or close.
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
size:XS0-9 changed lines (additions + deletions).vouch:trustedAuthor is trusted by repo permissions or the VOUCHED list.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
vouch:trusted
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
tailClaudeTaskOutput joins the provider-supplied sessionId and taskId from the Claude SDK stream into ///tasks/.output. An id containing
../could point the tail at a file outside Claude's per-user task directory and stream its contents into the thread. The fix returns early unless both ids match /^[\w-]+$/ (a single plain path segment). One regression test covers a traversing session id and a traversing task id; it fails on the unguarded code (both cases read the planted 'secret' file) and passes with the guard. The author's approach and commits are kept as-is; origin/main was merged in with no conflicts. Pushing to factory/pr-26501-a1794553696 was refused by the remote, so the work went to factory/pr-36058-a1794586396.Fixes #26489
Supersedes #36058. The change is @juliusmarminge's; their commits are kept.
Reproduction on main
Derived from the issue, diff, and main's adapter code; not executed. In an isolated POSIX T3 server connected to a real client, configure a controlled Claude SDK stream fixture. Under the configured Claude task-output root, create a project directory, and beside that root create outside/tasks/bk6xreeye.output containing a harmless marker. Start a Claude thread whose fixture emits a Bash tool call and a matching system/task_started frame with task_type local_bash, tool_use_id matching the call, is_backgrounded false, session_id ../../outside, and task_id bk6xreeye. Inspect the command's live output: main streams the marker, whereas the fix omits it. Repeat with a valid UUID session_id and task_id ../../../../outside/tasks/bk6xreeye. Finally emit the matching normal tool result and confirm it still appears; use valid IDs and a file inside the normal task directory as a control.
Evidence
Being captured: before and after in the real app. This section is filled in before the pull request can merge.
Tests
vp test run src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts (apps/server): 6/6 pass; same with the guard line removed: new test fails (leaks 'secret' for both ids), restored afterwards; vp run check:changed: format, lint, knip, graphql, typecheck (3 packages), tests (2 files, 8 tests) all pass.
Not in this change
Who did the work
Run by the t3code factory in T3 Code.