patch_guardrails.py

#!/usr/bin/env python3
"""
Patch evil-opencode binary: remove all remaining security guardrail strings.

winmin/evil-opencode removes 8 guardrails from session/prompt/*.txt files.
This script removes the REMAINING guardrails that winmin missed:
  - Soft refusal instructions in default.txt, trinity.txt, gemini.txt
  - Operational security rules in default.txt, trinity.txt, gemini.txt
  - Security confirmation trigger in codex.txt
  - "never commit secrets" in tool/shell/shell.txt

Strategy: replace guardrail lines with spaces of the same byte length
to preserve Bun standalone executable's embedded filesystem offsets.
"""
import shutil
import sys
import os

# Default binary path (override with first argument)
BINARY = sys.argv[1] if len(sys.argv) > 1 else "/usr/local/bin/opencode"
TMP = BINARY + ".patching"

# Unique substrings to locate guardrail lines in the binary.
# Each entry is (substring, description) — the script finds the full
# line containing the substring and replaces the entire line with spaces.
SEARCH_PATTERNS = [
    # Soft refusal instructions (default.txt + trinity.txt)
    (
        b"If you cannot or will not help the user with something",
        "soft refusal instruction (default.txt:15, trinity.txt:7)",
    ),
    # Operational security rules (default.txt + trinity.txt)
    (
        b"Always follow security best practices. Never introduce code that exposes or logs secrets",
        "security best practices rule (default.txt:65, trinity.txt:67)",
    ),
    # gemini.txt Handling Inability
    (
        b"If unable/unwilling to fulfill a request",
        "Handling Inability instruction (gemini.txt)",
    ),
    # gemini.txt Security and Safety Rules header
    (
        b"## Security and Safety Rules",
        "Security and Safety Rules header (gemini.txt:48)",
    ),
    # gemini.txt Explain Critical Commands
    (
        b"Explain Critical Commands",
        "Explain Critical Commands rule (gemini.txt:49)",
    ),
    # gemini.txt Security First
    (
        b"Always apply security best practices. Never introduce code that exposes, logs",
        "Security First rule (gemini.txt:50)",
    ),
    # gemini.txt Command Execution safety reference
    (
        b"safety rule to explain modifying commands first",
        "Command Execution safety reference (gemini.txt:55)",
    ),
    # codex.txt security posture confirmation trigger
    (
        b"The action is destructive/irreversible, touches production, or changes billing/security posture",
        "security posture confirmation trigger (codex.txt:46)",
    ),
    # shell.txt "never commit secrets" in git workflow
    (
        b"and never commit secrets",
        "never commit secrets (shell.txt:15)",
    ),
]


def patch_binary(binary_path: str) -> int:
    """Patch the binary, replacing guardrail lines with spaces. Returns count of replacements."""
    # Copy binary to temp location for patching
    shutil.copy2(binary_path, TMP)

    with open(TMP, "rb") as f:
        data = f.read()

    original_len = len(data)
    total_replaced = 0

    for pattern, description in SEARCH_PATTERNS:
        replaced_for_this = 0
        search_from = 0

        while True:
            idx = data.find(pattern, search_from)
            if idx == -1:
                break

            # Find start of line (after previous \n)
            line_start = data.rfind(b"\n", 0, idx)
            if line_start == -1:
                line_start = 0
            else:
                line_start += 1

            # Find end of line (next \n)
            line_end = data.find(b"\n", idx)
            if line_end == -1:
                line_end = len(data)

            full_line = data[line_start:line_end]

            # Skip if already all spaces (already replaced)
            if full_line.strip() == b"":
                search_from = line_end
                continue

            replacement = b" " * len(full_line)

            # Count how many times this exact full line appears
            count = data.count(full_line)
            data = data.replace(full_line, replacement)
            total_replaced += count
            replaced_for_this += count

            preview = full_line[:80].decode("utf-8", errors="replace")
            print(f"  REPLACED {count}x [{description}]: {preview}...")

            # Move search past this region
            search_from = line_start + len(replacement)

        if replaced_for_this == 0:
            # Try substring-only replacement as fallback
            count = data.count(pattern)
            if count > 0:
                replacement = b" " * len(pattern)
                data = data.replace(pattern, replacement)
                total_replaced += count
                print(f"  REPLACED {count}x (substring) [{description}]")
            else:
                print(f"  ALREADY GONE [{description}]")

    # Verify byte length unchanged
    if len(data) != original_len:
        print(f"FATAL: byte length changed! {original_len} -> {len(data)}")
        sys.exit(1)

    with open(TMP, "wb") as f:
        f.write(data)

    return total_replaced


def verify_binary(binary_path: str) -> bool:
    """Verify the patched binary works."""
    import subprocess

    result = subprocess.run(
        [binary_path, "--version"],
        capture_output=True,
        text=True,
        timeout=10,
    )
    if result.returncode == 0:
        print(f"  Binary works: v{result.stdout.strip()}")
        return True
    else:
        print(f"  Binary FAILED: {result.stderr}")
        return False


def main():
    if not os.path.exists(BINARY):
        print(f"Error: binary not found at {BINARY}")
        sys.exit(1)

    print(f"Target: {BINARY}")
    print(f"Size: {os.path.getsize(BINARY):,} bytes")
    print()

    # Patch
    print("Patching guardrails...")
    count = patch_binary(BINARY)
    print()
    print(f"Total replacements: {count}")
    print()

    # Replace original with patched version
    backup = BINARY + ".bak"
    if not os.path.exists(backup):
        shutil.copy2(BINARY, backup)
        print(f"Backup saved: {backup}")

    shutil.move(TMP, BINARY)
    print(f"Patched binary installed: {BINARY}")
    print()

    # Verify
    print("Verifying...")
    ok = verify_binary(BINARY)

    if ok:
        print()
        print("Done! Guardrails removed successfully.")
    else:
        print()
        print("WARNING: Binary verification failed. Restore from backup:")
        print(f"  cp {backup} {BINARY}")
        sys.exit(1)


if __name__ == "__main__":
    main()