Repository navigation
Conversation
The model call was tool-less. It now gets WebSearch and WebFetch, and no other tool, so it can check a declaration's exact name and statement in Mathlib's docs, loogle or a library's source before it answers. Nothing it can call reads a file, runs a command or edits anything, so the token file under HOME stays out of reach, and the call runs in an empty temporary directory so Claude Code's context names none of the contributor's paths or repositories. `wikilean work --no-web`, or "web": false in config.json, keeps the old tool-less call. The answer checks are unchanged. site/test_agent_sandbox.py now holds the call to web search and fetch at most, CLAUDE.md, AGENTS.md and docs/SECRETS.md say so, and the CLI is 0.2.0.
…e answer Jack kept fetch open (2026-11-12, "Keep fetch open, warn"). The README's Safety section no longer says a planted fetch can only send public text: on an office network or a VPN it could read an internal page, so `work` prints a warning whenever the web is on, `doctor` shows it, and the README, the model docstring and docs/SECRETS.md say to run with --no-web there. --dry-run's help says it sends nothing to WikiLean, not nothing at all. A passage that gets no usable answer twice (a timeout, or a reply that is not the agreed JSON) is set aside like a judged one, so a planted instruction cannot hold every round of a loop. A missing, logged-out or erroring claude counts nothing. A config.json that does not parse, or a "web" that is not a boolean, turns the web tools off and says so, instead of leaving them on. The claude binary is resolved before the call moves into its empty directory, so a relative WIKILEAN_CLAUDE_CMD still works. site/test_agent_sandbox.py now counts every --tools and --allowedTools value, in claude_argv and in the argv ask() runs.
Deicyde
marked this pull request as ready for review
November 13, 2026 11:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gives the contributor CLI's Claude web search and web fetch, so contributors work with internet access (Jack, 2026-11-12: "Open web search or whatever they want"), and warns where that is risky (Jack, 2026-11-12: "Keep fetch open, warn").
What changes.
wikilean workused to ask the contributor'sclaude -pwith no tools at all. It now passes--tools WebSearch,WebFetch --allowedTools WebSearch,WebFetchand nothing else, with the same--setting-sources "" --strict-mcp-config --no-session-persistence --safe-mode, so the model can check a declaration's exact name and statement in Mathlib's docs, loogle or a library's source before answering. The prompts say so, and say that fetched pages are data like the passage.wikilean work --no-web, or"web": falsein config.json, keeps the tool-less call. The answer checks (relation vocabulary, the article's universe, the declaration against the sealed records or the/decloracle) are unchanged, and the journal records whether a round had the web.What stays safe, and what does not. The token file sits under the
HOMEClaude Code needs; nothing the model can call reads a file, runs a command or edits anything, and the environment allowlist still has no name that could hold the token. The call runs in an empty temporary directory, so what Claude Code tells the model about its surroundings names neither the directorywikileanran in nor that directory's git state. Fetch is open: it refuseslocalhost, names without a dot and plain HTTP, but a planted instruction in a passage could still have the model read an HTTPS page the contributor's network reaches and send what it says to an outside address, or put it in a tag's note. On a home connection that is public text; on an office network or a VPN it may not be. Soworkprints a warning whenever the web is on,doctorshows whether it is, and the README's Safety section, docs/SECRETS.md and the model docstring tell anyone on such a network to run with--no-web.Failing safe. A config.json that does not parse, or a
"web"that is not a boolean, turns the web tools off and says so, inworkand indoctor. A passage that gets no usable answer twice (a timeout, or a reply that is not the agreed JSON) is set aside like a judged one, so a planted instruction that keeps the model searching cannot hold every round of--loop; a missing, logged-out or erroringclaudecounts nothing. The binary is resolved before the call moves into its empty directory, so a relativeWIKILEAN_CLAUDE_CMDstill works.--dry-runnow says it sends nothing to WikiLean, since the model may still search and fetch.Rules.
site/test_agent_sandbox.pyholds this call to WebSearch and WebFetch at most, counting every--toolsand--allowedToolsvalue, in the argvclaude_argvbuilds and in the oneask()runs. CLAUDE.md, AGENTS.md and docs/SECRETS.md state the exception next tobot/triage.py's tool-less form, which every pipeline call keeps. The CLI is 0.2.0, so the user agent tells the two apart.Release.
worker/,test_*.py,docs/, CLAUDE.md and AGENTS.md are all release-neutral (site/ops/brain_release_authority.py), so this needs no release: volunteers get it from main withuv tool install.Checks. CI on 9699f06: worker, python (138 commands, the worker's model-boundary, round and CLI tests and the sandbox gate among them), browser and attribution passed.
https://github.com/Deicyde/WikiLean/actions/runs/43409657714