env-read-guard-sibling-rollout

Rollout tracker — Read-tool .env guard across sibling repos

Tracking issue: radieu/p24-infra#5938 Origin incident: #5923 · writeup Porting playbook: prevent-env-local-read.md §Port this guard to sibling repos Guard origin: #1500

Why this tracker exists

The Read-matcher PreToolUse guard (pre-read-safety.sh / pre-read-safety-windows.ps1) that blocks Read from loading a plaintext .env/.env.local credential file is enforced per-repo — PreToolUse hooks live in each repo’s own .claude/settings.json. A Claude subagent that opens a sibling repo runs with that repo’s hooks, not p24-infra’s. #1500 only wired the guard into p24-infra; the 2026-08-09 et-op exposure (#5923) proved a sibling without it has no technical block at all — the CLAUDE.md prose is not enforcement.

#5923’s postmortem Prevention §1 requires the guard in every repo a Claude subagent can open. et-op (the exposed repo) is tracked by et-operational-platform#1626; the 4 remaining sibling repos were untracked until this tracker.

Coordination shape

One tracking issue (#5938) + one child issue per target repo. A p24-infra worker cannot edit another repo’s .claude/settings.json from here — the hook template already exists in p24-infra/.claude/hooks/, and porting means copying the two scripts + wiring the Read matcher into each repo’s own config, which only a PR inside that repo can do. So each port is a child issue → PR in the target repo; this tracker + the child issues are the audit trail.

Target repos and status

Repo	Child issue	Status
p24-infra/brandpilot (issue body said radieu/brandpilot — the org is actually p24-infra)	p24-infra/brandpilot#61	☐ open — awaiting in-repo PR
radieu/Art-Agency	radieu/Art-Agency#36	☐ open — awaiting in-repo PR
radieu/whatsup-android-chat-puller	radieu/whatsup-android-chat-puller#159	☐ open — awaiting in-repo PR
radieu/radekkonarski-personal-brand	radieu/radekkonarski-personal-brand#158	☐ open — awaiting in-repo PR
radieu/et-operational-platform (already-exposed repo — out of scope here)	et-operational-platform#1626	tracked separately (pre-existing)

Mark a row ☑ when its in-repo PR merges and the block/allow probes pass in that checkout.

Per-repo port steps (identical to each child issue)

1. Copy pre-read-safety.sh and pre-read-safety-windows.ps1 from p24-infra/.claude/hooks/ into the target repo’s .claude/hooks/.
2. Add a PreToolUse entry with "matcher": "Read" → bash .claude/hooks/pre-read-safety.sh in the target repo’s .claude/settings.json, mirroring p24-infra’s Read matcher block. Use the bash script — Read runs on both Linux workers and Windows local; a PowerShell command there would error (and block every read) on Linux.
3. Confirm permissions.allow carries no bare unrestricted "Read" that bypasses intent.
4. Verify with the block/allow probes from the playbook §Verifying the guard, inside that checkout.
5. Confirm the hook fires for subagent tool calls too — the exposing session in #5923 was a subagent.
6. Add the credentials-handling rule to the target repo’s own CLAUDE.md if absent.