Repository navigation
fix(security) + feat(ccc): Claude-token compliance, leaner role-routed kit, LSP + public plugin marketplace - #5
Merged
Merged
Conversation
…ter Claude proxy
- harness claude-code: exact-host allowlist (api.anthropic.com, Bedrock,
Vertex, Foundry, loopback, EIGHTSYNC_SELF_HOSTED_GATEWAY), https except
loopback, checked before any write; subscription/OAuth tokens only for
api.anthropic.com; omp and Windows env get Console keys (sk-ant-api) only;
token masked to last 4; probe uses x-api-key + anthropic-version via stdin
- harness gateway: remove the cc/ provider that made omp pose as Claude
Code, strip deployed 9router-cc blocks, provider-scoped key read/write,
refuse sk-ant- keys, keep other providers, opt-in EIGHTSYNC_GATEWAY_ACCEPT=1
- harness add-model: refuse non-Console Anthropic tokens and Claude-protocol
providers outside the allowlist; re-check registry entries on sync
- forge: Console key only for anthropic, refuse claude_code provider, warn on
existing claude_code OAuth credential, credentials file 0600
- codex-web: opt-in (EIGHTSYNC_CODEX_WEB_ACCEPT=1)
- feynman: bridge skips every Claude/Anthropic model; find Pi packages under
@earendil-works/* then @mariozechner/* (Feynman >= 0.5.35)
- Claude 5.5 model IDs; setup-claude-key.{sh,ps1} only forward to
`8sync harness claude-code` on stdin
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- repo CLAUDE.md block compact (<=1.1 KB), no forced SKILL.md reads, no "MCP always present" claim; skip su-code/ memory dirs; no new block under an ancestor that already has one (existing blocks refreshed, never stripped) - kit CLAUDE.md summarises the 8 Sync / Anthropic rules instead of @importing the 6.7 KB doc; integrity + subagent-envelope lines; /aup-audit triggers - user-scope skillOverrides name-only for linked on-demand bundled skills, keyed by frontmatter name, core skills and user values kept - agents: model/effort/maxTurns/disallowedTools by role; new researcher + verifier; deep-research v2 pipeline (adapted from Feynman, MIT — THIRD_PARTY_NOTICES.md); /ship cites command output for done claims - stop gate on Haiku 5.5 allows waiting on background agents; ask gate on Sonnet 5.5; mirror_mcp reports why servers are not registered, serena alwaysLoad:false - `8sync ccc hook session-start`: byte-stable su-code STATE/KNOWLEDGE digest (<=6000 B, startup|clear|compact, found from subdirectories) - legal snapshot date in docs/legal/anthropic/index.md (refreshed on change) - CHANGELOG, KNOWLEDGE lessons, research plan plans/2026-10-12-ccc-beyond-omp.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- `8sync ccc kit` enables claude-plugins-official LSP plugins (rust-analyzer, typescript, gopls, pyright) only for servers on PATH, insert-only; serena stays as fallback - `.claude-plugin/marketplace.json` publishes `8sync-kit` (subagents + /ship from assets/claude); validated with `claude plugin validate` - test keeps plugin.json version in sync with the crate - README kit table updated (rules summary, role-routed agents, stop gate, LSP, SessionStart digest, plugin install) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
harness claude-code(https; subscription/OAuth tokens only for api.anthropic.com), Console keys only into omp/Windows env/forge/add-model, 9routercc/Claude proxy removed (it made omp pose as Claude Code), gateway + codex-web opt-in, Feynman bridge skips every Claude model, setup-claude-key scripts forward on stdin only, tokens masked to last 4.8syncwith plugin8sync-kit(/plugin marketplace add 8-Sync-Dev/su-code,/plugin install 8sync-kit@8sync).plans/2026-10-12-ccc-beyond-omp.md(omp, Feynman, ForgeCode, Claude Code public repo read locally; no decompiling).Test plan
cargo test— 194 passed, 0 failedcargo build --no-default-featuresclaude plugin validate .andclaude --plugin-dir ./assets/claude plugin details 8sync-kit/aup-auditon the diff → PASSsetup-claude-key.ps1on real PowerShell 5.1 (no pwsh locally)🤖 Generated with Claude Code