Phase 3 commit #1 per docs/PHASE3.md §12. Static-pattern destructive-op
heuristic; no LLM second-opinion yet (lands in commit #2).
Implementation:
- 34 patterns in DESTRUCTIVE_PATTERNS table, grouped:
9 shell-wrapper patterns (R-B1 — bash -c / sh -c / zsh -c / eval /
python -c / perl -e / pipe-to-sh both forms / pipe-to-bash both
forms / xargs ... rm). HALT on the wrapper itself; user reads
the inner before proceeding.
10 filesystem destructive (rm -rf, find -delete, dd to device, mkfs,
shred, wipefs, truncate -s 0, ...).
5 version-control destructive (git push --force/-f, git reset
--hard, git clean -fd, git branch -D).
5 database/process (DROP TABLE/DATABASE, TRUNCATE TABLE,
kill/pkill -9).
2 permission (chmod 777, chown on root path).
- ci=true flag for case-insensitive SQL patterns; rule patterns must
be lowercase when ci is set (matcher lowercases input).
- pkill -9 ordered BEFORE kill -9; kill rule uses %f[%w] frontier so
"pkill -9 nginx" reports "pkill -9" not "kill -9" substring match.
- M._patterns exposes the rule table for :safety patterns meta (Phase
3 commit #5) and for the test corpus.
- M.norris_step stub stays — lands in commit #4.
Test corpus (test_safety.lua, 87 cases):
- 49 destructive cases across all categories (incl. all 11 wrapper
forms, the canonical curl|sh end-of-string bypass, sudo-prefixed
rm -rf, etc.).
- 38 safe cases (read-only commands, non-destructive variants
of risky verbs like "git push" without --force, "find" without
-delete, "chmod 644", "kill 1234" without -9, etc.).
- Documented one accepted false positive: echo "rm -rf /" matches
the rm pattern by substring — Norris user can proceed after
reading; tradeoff between false positives and false negatives,
biased toward false positives per §5.
- Run from repo root: `luajit test_safety.lua`. Exit 0 on pass.
- Verified all 87 pass at commit time.
R-C4 / readline rebind, broker opts.max_tokens, LLM second-opinion,
norris_step planner, repl driver, and the wider Norris UX land in
subsequent commits per §12.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phase 7 verify finding from TC #26 against :model cloud:
HTTP 400 from openrouter→Amazon Bedrock:
"tools.0.custom.name: String should match pattern
'^[a-zA-Z0-9_-]{1,128}$'"
Anthropic via Bedrock validates tool names against that regex and
rejects dots. PHASE2 originally chose "." as the namespace separator
("boltzmann.list_dir"); OpenAI tolerated it, Bedrock does not.
Separator switched to "__" (two underscores) everywhere — internal
API matches on-wire shape, no transformation layer:
- repl.lua:
- tools_schema builds "alias__name"
- dispatch_tool_call splits via "^(.-)__(.+)$" (non-greedy → leftmost __)
- :mcp tool parser uses same split
- :mcp tools formatter prints "alias__name"
- HELP block shows <alias__name>
- safety.lua confirm_tool_call: alias.* glob → alias__* glob
- config.lua example block: keys rewritten
- docs/PHASE2.md: amendment header added; §1, §2 row, §3 config.lua
row, §5 wire-shape JSON examples, §6 auto_approve schema, §7
meta-cmd table, §12 plan all updated. Original "." references
preserved in commit history.
Constraint: aliases must not themselves contain "__" so the parse
stays unambiguous. Tool names from MCP servers may have underscores
freely.
Second fix bundled — uninformative broker error:
Previously "broker error: transport: HTTP response code said error"
Now "broker error: transport: HTTP 400: {full body snippet}"
ffi/curl.lua M.post_sse changes:
- FAILONERROR no longer set (was hiding the response body).
- raw_body accumulator added alongside the SSE buffer; captures
every byte regardless of SSE shape.
- After perform, check status_code via curl_easy_getinfo. On >=400,
return (nil, "HTTP <code>: <body[:400]>"). 2xx unchanged.
- End-of-stream SSE flush only runs on 2xx (no false event on
error bodies that aren't SSE-shaped).
- Phase 1 callers reading just first return slot stay correct.
End-to-end verified:
- :model cloud + tools=[boltzmann__read_file ...] +
"Use boltzmann__read_file with path=/etc/hostname" →
Claude emits tool_call with name="boltzmann__read_file",
args='{"path": "/etc/hostname"}'. ok=true, transport clean.
- Force-bad tool name "bad.name.with.dots" → err string carries
the full bedrock 400 with the regex-pattern message visible.
TC #26 (sub-loop end-to-end) is now testable against cloud — the
error that blocked it is resolved.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phase 2 commit #2 per docs/PHASE2.md §12. Implements just the per-call
confirm-gate surface; Phase 3 stubs (is_destructive, norris_step) stay
unimplemented with their error() bodies.
M.confirm_tool_call(name, args, cfg) checks cfg.mcp.auto_approve for:
- exact match on "<alias>.<tool>"
- "<alias>.*" glob covering a whole server
Miss falls back to a [y/N] readline prompt. Empty or non-"y" answer
rejects (matches the existing confirm_cmd UX from PHASE0 §10).
Pretty-printing renders args as compact JSON, truncated at 80 chars
with "..." suffix so one-line prompts stay readable.
Smoke-test passes all eight cases per §12 verify-row #2:
exact match / alias glob → auto-approve, no prompt
miss + y / n / empty / nil-cfg → prompt shown, expected verdict
empty args / long args → clean rendering, truncation works
Note: PHASE0 §4 module-layout had a "lands in Phase 2" hint on the
norris_step stub; the actual landing is Phase 3 per PHASE0 §11 row 3.
Comment in safety.lua updated to clarify.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- README, .gitignore, CLAUDE.md (project conventions)
- docs/PHASE0.md — full Phase 0 manifest (locked substrate)
- 10 root .lua modules + 4 ffi/ bindings, all stubs raising NotImplemented
with module-scoped responsibilities matching the manifest
- config.lua wired to current dirac/hossenfelder endpoints (qwen-coder-7b
snappy/32k + cloud via OpenRouter through hossenfelder)
File names match docs/PHASE0.md §4 exactly. Module bodies fill in across
later phases; the tree shape is locked.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
marfrit
claude-noether