fix(daemon): exclude USER/WORK/YOUR_COMPANIES from the aggregator - #2110
Open
pai-scaffolde wants to merge 1 commit into
Open
fix(daemon): exclude USER/WORK/YOUR_COMPANIES from the aggregator#2110pai-scaffolde wants to merge 1 commit into
pai-scaffolde wants to merge 1 commit into
Conversation
DaemonAggregator's structural deny list names USER/BUSINESS as the business-confidential zone, but the shipped USER scaffold puts business data at USER/WORK/YOUR_COMPANIES (installer layout, canonical per issue danielmiessler#1720; the same path observability.ts reads). The real location was therefore not covered by isExcluded(). Add it; USER/BUSINESS stays for installs that created one. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reproduced on a fresh LifeOS 7.40.4 install (macOS, Claude Code in the Claude desktop app); the fix was applied to that install before filing. Related decision: #1720 (installer layout is canonical).
Observed
skills/Daemon/Tools/DaemonAggregator.tsEXCLUDED_PATHSnamesUSER/BUSINESSas the business-confidential zone; the installed tree has noUSER/BUSINESSand business data lives atUSER/WORK/YOUR_COMPANIES(present on the install), which the deny list does not cover.Root cause
The structural deny list was written for the pre-#1720 layout.
isExcluded()is a prefix match onEXCLUDED_PATHS, so the real business directory is not excluded. Stated plainly: no current read path in the aggregator walksUSER/WORK/(it reads TELOS, KNOWLEDGE/Ideas, PROJECTS.md, PRINCIPAL_IDENTITY.md andMEMORY/WORK), so this is not an observed leak; it is the guard every future read goes through being wrong about where the confidential data is.Fix
Add
join(USER_DIR, "WORK", "YOUR_COMPANIES")toEXCLUDED_PATHS.USER/BUSINESSstays for installs that created one (CLAUDE.md still listsBUSINESS/as a conventional location).How tested
No test surface:
isExcludedis module-private and nothing reads the directory today, so there is no observable before/after. Transpiles (bun build --target=bun --no-bundle).🤖 Generated with Claude Code