fix(yara): repeat-block escalation + scan only edit replacement text (stacked on #804)#820
Merged
Merged
Conversation
The pi harness security fence called the embedded yara-scanner.ts, a pre-warlock snapshot of the rules that was deleted in #597 and re-added in #701. Its stale rules blocked the canonical $set / $set_once person-property pattern, looping agents on retries. pi now scans through @posthog/warlock via yara-hooks scanAndTriage – same engine, rules, chunking, and LLM triage as the anthropic harness – and block messages include the rule remediation so a blocked agent can self-correct. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pi auths the LLM gateway programmatically and never sets ANTHROPIC_BASE_URL/AUTH_TOKEN, so the env-based triage provider returned undefined on the pi path: fail-closed, but every flagged match acted on with no false-positive filtering. The provider now accepts explicit gateway auth and pi passes its boot credentials. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…(stacked on #804) The YARA guard split out of #816, rebuilt on top of #804's warlock-based pi fence, plus the one surviving piece of the closed #818: 1. Repeat-block escalation: agents retry identically-blocked payloads (~4.2 blocks per affected run) despite the prompt saying not to. Both fences (pi pre-execution scan, anthropic PreToolUse Bash hook) now hash the payloads they block; an identical retry gets an escalated reason ("this exact content was ALREADY blocked — change the code, not the retry"), and from the third attempt the agent is told to note it in the setup report and move on. The escalation decorates #804's remediation-bearing block message, never replaces it. Tracker lives in yara-hooks, shared by both fences; policy denies are unaffected. 2. Edit scanning scoped to replacement text: #804 still scans JSON.stringify(input.edits), which includes each edit's oldText — pre-existing file content. That blocked edits whose surroundings contained a violation and even edits REMOVING one (field FPs: capture edits adjacent to existing identify() PII; pre-existing violations blocking their own replacement). Now scans only the joined newText, matching the anthropic path which scans new_string only. Generated-By: PostHog Code Task-Id: bcb96bcb-e37f-421d-841d-738647c73b8e
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Results will be posted here when complete. |
sarahxsanders
approved these changes
Jul 7, 2026
Collaborator
Author
|
/wizard-ci basic-integration/next-js |
🧙 Wizard CI ResultsTrigger ID:
Configuration
|
# Conflicts: # src/lib/agent/runner/harness/pi/__tests__/security.test.ts # src/lib/agent/runner/harness/pi/security.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #804. Merge #804 first. This PR's diff is only the changes below.
Two problems. Agents keep retrying edits that YARA already blocked. And the edit scanner reads the old file text, not just the new text, so old code causes false blocks.
Changes:
Why:
Check after ship: blocks per affected run on the switchboard YARA tile. Target under 1.5.
🤖 Generated with Claude Code