chore(hardening): ask before writing files a later command executes - #9
Merged
Merged
Conversation
In-workspace writes are approved without a prompt, which is the right default for source files: editing them is the job, and the change shows up in the diff before anything runs it. A handful of files do not fit that shape. Nothing happens when package.json, a Makefile, a workflow under .github, conftest.py or a pre-commit config is written, and then the next install, test run or CI job executes whatever they now say — so the write is the dangerous act and that is where the prompt has to be. Add execution-trigger-write-ask ahead of the blanket in-workspace write approval and ahead of auto mode, matching where the sensitive-file and git-control checks sit. Session approvals and user allow rules keep their precedence, so a decision already made is not re-asked. Only write access counts: reading package.json stays routine. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
git-cwd-write-approveapproves any Write/Edit whose target is inside the git workspace, with no prompt. For source files that is the right call — editing them is the job, and the change is visible in the diff before anything runs it.A small set of files break that assumption. Nothing executes when they are written; the next routine command executes what they now say:
package.json→scripts.postinstall/preparerun on the nextnpm installMakefile,justfile,Taskfile.yml→ nextmake/just/task.github/workflows/*,.circleci/*,.gitlab-ci.yml,Jenkinsfile→ next CI runconftest.py,setup.py→ next test/install run.pre-commit-config.yaml,.husky/*→ next commitSo an instruction the model picked up from repo content could rewrite one of these with no prompt, and the payload runs later under whatever ran the build. This was the last remaining "injected content reaches execution" path after the earlier hardening PRs.
What changed
New
execution-trigger-write-askpolicy, placed immediately after the git-control ask and beforeauto-mode-approve— the same position the sensitive-file check occupies, and for the same reason: "it was inside the repo" is not a good enough justification to skip the prompt for these particular files.Deliberate limits:
package.jsonis routine and stays unprompted; there is a test for that.src/package.json.tsanddocs/Makefile.mdare unaffected — also tested.allowrules still win, since they sit earlier in the chain. Approving once does not mean being asked again.Testing
git-cwd-write-approvefast path; a read ofpackage.jsondoes not fire the policy.git stash pushsilently ignores untracked files, so the new policy file was never removed and the tests "passed" against unchanged code. Re-ran it by unregistering the policy from the chain instead, which correctly fails the 2 positive tests.agent-core-v2suite green: 310 files / 4905 tests.oxlintclean on changed files (one pre-existing warning inuser-configured-rule.ts, untouched here);tsc --noEmitclean.Checklist
minor).