Hard-block rm by default in both harnesses, no prompt - #56
Merged
Conversation
Claude Code: .claude/settings.json permissions.deny (Bash(rm *)/Bash(rm))
already blocks rm outright, no prompt -- verified live.
OpenCode: opencode.jsonc's declarative permission.bash glob deny
("rm **": deny alongside "*": allow) does NOT actually block rm in
practice -- confirmed empirically across several pattern/ordering
attempts. The real fix is scripts/hooks/scope_gate_hook.py: a new
unconditional _is_rm_command() check (independent of scope/engagement
state entirely, chain-aware across ;/&&/||/|/subshells/backticks so it
can't be smuggled in as the second half of a chained command) that
blocks any Bash command whose (sub-)command is rm. .opencode/plugin/
scope-gate.ts already invokes this exact script on every Bash call via
OpenCode's tool.execute.before hook, so it inherits this for free --
confirmed live via a real opencode run through huntbrain -> recon-agent,
including under --auto (OpenCode's bypass-permissions mode), which
skips the declarative permission.bash block entirely but still hit this
hook-level block.
The now-nonfunctional declarative rm-deny glob entries in opencode.jsonc
and the three .opencode/agents/*.md files are kept as documented
defense-in-depth (harmless, and would help if a future OpenCode version
fixes the glob matching), with a comment pointing at the real
enforcement point so nobody mistakes them for the actual guarantee.
17 new tests in tests/test_scope_gate_hook.py cover _is_rm_command()
directly (chained commands, sudo/env prefixes, absolute paths, and the
false-positive case of a bare ')' from unrelated command text) plus two
end-to-end main() tests confirming the block fires with no
engagement.yaml and no in-scope host at all -- this is a blanket rule,
not a scope rule.
4 pre-existing test_scope_gate_hook.py failures remain, caused by a
real active engagement on this machine colliding with
scope_guard.DEFAULT_PATH's import-time binding (documented, unrelated
to this change -- zero of the touched lines are anywhere near that
codepath).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kya kiya
User ne kaha tha: rm command disallow karo by default, na pooche, dono (Claude Code + OpenCode) me, baaki allow karo.
Verification
Non-functional declarative rm-deny glob entries kept as documented defense-in-depth (harmless, comment points at the real enforcement point).
🤖 Generated with Claude Code