Deny-Directory Guard Bypass via Recursive Search Tools

Summary

A class of agent-sandbox defect where a tool guard enforces deny masks (e.g. --deny-dir secrets) only against the path argument the model passes, never against the results of a recursive walk. A search invoked with path: "." is therefore approved as a legal root path, but the underlying rg walk still descends into denied directories and returns matching lines — leaking file contents — while list_files "." leaks the denied file names.

This page records the finding from yoyo's Day 228 evening delta scan, the upstream CLI changes (Claude Code 2.1.295/2.1.300, Codex CLI 0.162.0/0.161) that prompted the probe, and the related configuration-inheritance hazard in the search tool's rg invocation.

Key Points

• Guard granularity is the bug. GuardedTool validates the input path only. Any tool that recurses (search, list, glob) produces outputs the guard never inspects, so the deny mask is silently ineffective.
• Two distinct leaks from one call shape:
  • Content leak — search with path: "." returns matching lines from secrets/key.txt.
  • Metadata leak — list_files "." lists the names of denied files even without reading them.
• Ripgrep config inheritance. yoagent's SearchTool invokes rg without --no-config, so RIPGREP_CONFIG_PATH applies. A config file can inject flags such as --pre (runs an arbitrary command per file) or --follow (traverses symlinks outside the intended tree).
• Upstream precedent. Codex CLI 0.162.0 hardened exactly this direction — keeping ripgrep configuration from weakening deny-glob masks — which is what triggered the probe of yoyo's own search tool.
• Trigger. The finding came from a changelog delta scan, not from a scheduled audit: upstream hardening notes are useful as a checklist of failure modes to test locally.