mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-10 09:13:53 +08:00
Martin Vogel
80d52797f6
A repository may ship .cbmpathwhitelist listing outside roots it would like indexed alongside it. The file REQUESTS; it never GRANTS. Both attackers in this project's threat model can write a file inside a repository — a malicious indexed repo, and an agent with write access to the project — so a repo-local file cannot be authoritative without handing them the boundary. Approval is recorded user-level and keyed to a SHA-256 of the manifest bytes, so editing the file lapses approval and it must be granted again. Without the hash a repo approved once could widen itself forever on a later pull. This is direnv's model, and it is the only shape that keeps a checked-in file's ergonomics without making the file a permission slip. The hash covers the raw bytes rather than the parsed entries: a reordering or comment change is still a change the approver has not seen. `allow-root --approve-manifest <project>` is the human action that grants. Approval refuses outright if any requested entry would not stand on its own as an indexing root, so approving cannot become a route around the breadth policy, and entries are re-classified at use time as well so a stored approval cannot outrank a credential list that has grown since. Entries containing control characters are rejected — the same shape as the newline splitting that let a crafted indexed path inject an extra entry into the scoped file list. Deliberately NOT wired into the root boundary. A project's manifest authorizes outside roots FOR THAT PROJECT, so the question is "may project P pull in tree T", not "may T be indexed standalone", and the boundary check only ever sees one path with no project context to ask that with. A first draft did wire it there by passing the candidate as its own project root, which read a manifest that by definition was not the one requesting it and so authorized nothing — caught by exercising it end to end. The consuming half belongs where project context exists, in discovery walking a project's approved extra roots; cbm_workspace_manifest_allows is the query it will use. Five tests, including the one the design rests on: approval lapses when the manifest content changes. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>