WEB-4871: forward Grep/Glob/LS reads from the claude-code hook

[MohamedAklamaash]

WEB-4871 — forward Grep/Glob/LS reads from the claude-code hook

Linear: https://linear.app/unboundsec/issue/WEB-4871/classifier-output-uses-inconsistent-field-names-for-the-same-concept

What

Grep / Glob / LS are read-equivalent (they expose file contents or enumerate paths), but the hook never sent them, so they bypassed policy. The hook now forwards them with their target path so read / secret policies evaluate them like a native Read.

Notes

• Based on web-4850 (well ahead of main) for a clean diff — retarget if preferred.

🤖 Generated with Claude Code

Greptile Summary

Review completed and submitted via the mcp__greptile-review__submit_review tool.

Confidence Score: 4/5

Safe to merge with attention to the approval-retry path for Grep/Glob.

The new forwarding logic for Grep/Glob/LS is backward-compatible and the file_path derivation is correct for the common cases. The approval_key for Grep and Glob is built from the search pattern alone, not from the combination of pattern and path, enabling a scoped search approval to be reused by a broader search within the 4-hour timeout window.

claude-code/hooks/unbound.py — specifically extract_command_for_pretool and the approval_key construction for Grep and Glob.

Comments Outside Diff (1)

1. claude-code/hooks/unbound.py, line 497-515 (link)

   LS added to NATIVE_FILE_TOOLS and READ_EQUIVALENT_FILE_TOOLS but extract_command_for_pretool was not updated for it. The function explicitly handles Grep (returns pattern) and Glob (returns pattern), but LS falls through to return tool_name — always yielding the literal string "LS". Downstream, approval_key = f"{tool_name}:{command}" becomes "LS:LS" for every single LS invocation, collapsing distinct path listings into one deduplication bucket and sending the gateway an uninformative command value.

_{Reviews (2): Last reviewed commit: "WEB-4871: only fall back to pattern for ..." | Re-trigger Greptile}

[vigneshsubbiah16]

Superseded by #161 — a clean re-base onto staging containing only the WEB-4871 hook change (this PR's base was web-4850, which dragged in the unrelated 'longest handoff calc' commit). Same two commits, cherry-picked unchanged.