fix(truncate): block --help in read-only mode, consistent with disallowed commands#534
Merged
Merged
Conversation
When truncate --help is run outside remediation mode the command is fully blocked, yet --help previously printed full usage and exited 0 with no indication that the command is unavailable. Now a note is appended to the help output so users understand why truncate does nothing if they try to run it. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
…owed commands When a command is not in the allow-list, --help is blocked at the interpreter level before the handler runs. truncate --help in read-only mode now behaves the same way: the capability check fires first, so --help returns the same error as invoking truncate itself. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
julesmcrt
changed the title
julesmcrt
marked this pull request as ready for review
June 22, 2026 14:45
julesmcrt
requested review from
AlexandreYang,
astuyve,
matt-dz,
thieman and
val06
as code owners
June 22, 2026 14:45
astuyve
approved these changes
Jun 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Inconsistency in the READ-ONLY mode:
truncate --helpworks but nottruncateas the builtin is blockedSummary
truncate --helpin read-only mode previously printed full help text and exited 0,even though the command is completely blocked
--helpis rejected at the interpreterlevel before the handler runs — this fix makes the mode-based block behave the same way
truncate --helpreturns thesame error as
truncateitself:truncate: filesystem capability not available (remediation mode required)with exit 1Test plan
tests/scenarios/cmd/truncate/errors/readonly_mode_help.yamlverifiesthat
truncate --helpin read-only mode exits 1 with the capability error on stderr andnothing on stdout
readonly_mode.yamlscenario continues to verify thattruncate -s 0 f.txtfails the same way
🤖 Generated with Claude Code