Repository navigation
Conversation
release: promote dev to main (0.3.0)
release: 0.3.0
release: 0.4.0 — CLI-key onboarding, usage tracking, and browser OAuth login
release: 0.5.0 — express install, notice banner, Claude Code Desktop
release: 0.5.1 — pipeline and update-notice test
release: 0.6.0 — usage-block lifecycle, test harness, onboarding entry points
Promote dev → main: verified user-facing commands, plugin 0.5.1
The SessionStart prewarm hook resolved the MCP endpoint from the opened repository's .claude/settings.local.json and .claude/settings.json before the user's own settings, then POSTed the OpenTrace API key to it as a bearer token. Any cloned repository could commit a settings file pointing mcp_url at its own host and collect the key of everyone who opened it with the plugin installed. Resolve the endpoint only from OPENTRACE_MCP_URL and the user's ~/.claude settings. Nothing legitimate writes it at project scope: otx writes mcp_url to ~/.claude/settings.json, and Claude Code reads pluginConfigs from user settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
publish.yml granted contents: write and id-token: write at workflow level, so the reusable ci job received them too. Grant nothing by default and give each job its own permissions: ci reads contents, publish keeps contents: write for the tag push and GitHub release and id-token: write for trusted publishing. actions/checkout persisted the job token in git config by default. Turn that off for every ci.yml job, none of which push, and keep it explicitly for the publish checkout, whose tag step runs an authenticated git push. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![opentrace[bot]](https://avatars.githubusercontent.com/u/160156268?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Approved
Looks good. The security improvements to the prewarm.cjs hook correctly prevent a malicious repository from exfiltrating the user's API key via a committed .claude/settings.json. The tests verify the precedence rules perfectly.
The GitHub Actions changes also correctly apply the principle of least privilege by scoping permissions to individual jobs.
Note that no ticket was referenced for this change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Secure prewarm hook and harden CI/CD permissions
🔒 Security · 🐛 Bug Fix · 🧪 Tests
This PR fixes a security vulnerability in the Claude Code prewarm hook by ignoring repository-local settings when resolving the MCP URL. It also hardens GitHub Actions workflows by restricting job permissions and disabling credential persistence during checkouts.
Complexity
🟢 Low ·
4 files changed, 165 insertions(+), 8 deletions(-)The changes are narrow in scope, focusing on a single security fix in the prewarm hook and standard CI/CD permission hardening, backed by a new unit test suite.
Tests
🧪 Includes a new, robust unit test suite that spins up local HTTP servers to verify the prewarm hook's security behavior.
Note
Review focus
Pay particular attention to the following areas:
<cwd>/.claude/settings*.jsonis completely ignored and only trusted user-level settings or environment variables are used.publish.ymlandci.ymldo not break any existing automated workflows.