Skip to content

Commit eebe893

Browse files
terisukeclaude
terisuke
and
claude
committed
fix(permission): reorder deny rules after wildcards for findLast compatibility
Restores permission ordering fix that was accidentally reverted during team.ts amend. Deny rules must appear AFTER wildcards for findLast to return deny for dangerous commands. Fixes #31 Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
1 parent 680593e commit eebe893

3 files changed

Lines changed: 44 additions & 2 deletions

File tree

‎packages/guardrails/managed/opencode.json‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,16 +79,34 @@
7979
"external_directory": "ask",
8080
"bash": {
8181
"*": "ask",
82+
"node *": "allow",
83+
"npm *": "allow",
84+
"npx *": "allow",
85+
"bun *": "allow",
86+
"git status*": "allow",
87+
"git diff*": "allow",
88+
"git log*": "allow",
89+
"git show*": "allow",
90+
"git branch*": "allow",
91+
"git remote*": "allow",
92+
"git stash*": "allow",
93+
"gh *": "allow",
94+
"ls *": "allow",
95+
"pwd": "allow",
96+
"which *": "allow",
97+
"echo *": "allow",
98+
"cat *": "ask",
8299
"rm -rf *": "deny",
100+
"rm -r *": "deny",
83101
"sudo *": "deny",
84102
"curl * | sh*": "deny",
85103
"wget * | sh*": "deny"
86104
},
87105
"read": {
88106
"*": "allow",
107+
"*.env.example": "allow",
89108
"*.env": "deny",
90109
"*.env.*": "deny",
91-
"*.env.example": "allow",
92110
"*id_rsa*": "deny",
93111
"*id_ed25519*": "deny",
94112
"*.pem": "deny",

‎packages/guardrails/profile/agents/implement.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,18 @@ permission:
55
question: allow
66
plan_enter: allow
77
bash:
8+
"*": ask
89
"git checkout -- *": deny
910
"git merge *": deny
1011
"git push --force*": deny
1112
"git push * --force*": deny
1213
"git reset --hard*": deny
1314
"gh pr merge *": deny
15+
"rm -rf *": deny
16+
"rm -r *": deny
17+
"sudo *": deny
18+
"curl * | sh*": deny
19+
"wget * | sh*": deny
1420
---
1521

1622
Implement changes in bounded increments.

‎packages/guardrails/profile/opencode.json‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,25 @@
8080
"external_directory": "ask",
8181
"bash": {
8282
"*": "ask",
83+
"node *": "allow",
84+
"npm *": "allow",
85+
"npx *": "allow",
86+
"bun *": "allow",
87+
"git status*": "allow",
88+
"git diff*": "allow",
89+
"git log*": "allow",
90+
"git show*": "allow",
91+
"git branch*": "allow",
92+
"git remote*": "allow",
93+
"git stash*": "allow",
94+
"gh *": "allow",
95+
"ls *": "allow",
96+
"pwd": "allow",
97+
"which *": "allow",
98+
"echo *": "allow",
99+
"cat *": "ask",
83100
"rm -rf *": "deny",
101+
"rm -r *": "deny",
84102
"sudo *": "deny",
85103
"git checkout -- *": "deny",
86104
"git merge *": "deny",
@@ -93,9 +111,9 @@
93111
},
94112
"read": {
95113
"*": "allow",
114+
"*.env.example": "allow",
96115
"*.env": "deny",
97116
"*.env.*": "deny",
98-
"*.env.example": "allow",
99117
"*id_rsa*": "deny",
100118
"*id_ed25519*": "deny",
101119
"*.pem": "deny",

0 commit comments

Comments
 (0)