From 7b418d5c2afedbd91566e8739afd0c9c86f60992 Mon Sep 17 00:00:00 2001
From: 0xernesto <78889960+0xernesto@users.noreply.github.com>
Date: Thu, 18 Jun 2026 21:55:49 -0700
Subject: [PATCH] Bound Claude Code transcript discovery

---
 .../host_apps/transcripts/claude_code.py      |  2 +
 .../test_claude_code_discovery.py             | 50 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 tests/infrastructure/test_claude_code_discovery.py

diff --git a/app/infrastructure/host_apps/transcripts/claude_code.py b/app/infrastructure/host_apps/transcripts/claude_code.py
index c921c9e..feae2cb 100644
--- a/app/infrastructure/host_apps/transcripts/claude_code.py
+++ b/app/infrastructure/host_apps/transcripts/claude_code.py
@@ -225,6 +225,8 @@ def _iter_metadata_files(root: Path) -> Iterable[Path]:
     if direct_root.exists():
         yield from direct_root.rglob("local_*.json")
         return
+    if root.resolve() == Path.home().resolve():
+        return
     yield from root.rglob("local_*.json")
 
 
diff --git a/tests/infrastructure/test_claude_code_discovery.py b/tests/infrastructure/test_claude_code_discovery.py
new file mode 100644
index 0000000..e0fa67d
--- /dev/null
+++ b/tests/infrastructure/test_claude_code_discovery.py
@@ -0,0 +1,50 @@
+"""Claude Code transcript discovery guardrails."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from app.infrastructure.host_apps.transcripts.claude_code import (
+    list_claude_code_sessions_for_repo,
+)
+
+
+def test_claude_code_session_listing_does_not_scan_arbitrary_home_subdirectories(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Claude discovery should not fall back to a full home-directory crawl."""
+
+    repo_root = Path.cwd().resolve()
+    cli_session_id = "46cc92ee-1291-49d2-89e5-ef0ac1603709"
+    unrelated_metadata_path = tmp_path / "Contacts" / "local_private.json"
+    unrelated_metadata_path.parent.mkdir(parents=True)
+    unrelated_metadata_path.write_text(
+        json.dumps(
+            {
+                "sessionId": "local-private",
+                "cliSessionId": cli_session_id,
+                "cwd": str(repo_root),
+            }
+        ),
+        encoding="utf-8",
+    )
+    transcript_path = (
+        tmp_path
+        / ".claude"
+        / "projects"
+        / str(repo_root).replace("/", "-")
+        / f"{cli_session_id}.jsonl"
+    )
+    transcript_path.parent.mkdir(parents=True)
+    transcript_path.write_text("", encoding="utf-8")
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+
+    candidates = list_claude_code_sessions_for_repo(
+        repo_root=repo_root,
+        search_roots=[tmp_path],
+    )
+
+    assert candidates == []