Verify read-only, workspace-contained commands before LOW auto-run - #21
Merged
Conversation
…sses. Require capability-bearing LOW tools to prove they cannot execute helpers, write files, or read outside the workspace, with an adversarial regression corpus for the previously auto-run cases.
Escalate tree -R and clustered -o writes, path-check date file reads, and treat ps format env/environ columns as environment exposure.
Parse -r/-f path operands in split, glued, and clustered forms so out-of-workspace date reads cannot auto-run.
lavindeep
changed the title
lavindeep
changed the title
lavindeep
changed the title
Extend DESIGN.md 36.1 to cover the LOW-invariant hardening: searcher preprocessor and unrecognized-option escalation with the out-of-workspace operand check, read-only git verb external-helper and no-index boundary escalation, tree output-writing forms, ps environment-display forms, the ls boundary check, and date file-backed reads across split, =, glued, and clustered forms. Correct the now-false "Accepted residual" paragraph: the date/tree/ps glued and clustered forms are closed, leaving only the searcher glued pattern-file form (grep -f/etc/passwd) as the documented LOW residual. Add the matching residual note to the command_policy module docstring so the code and spec agree.
lavindeep
force-pushed
the
fix/command-policy-low-invariant
branch
from
July 10, 2026 12:23
d879a6d to
71273f3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tighten the deterministic command classifier's LOW criteria under the
balancedprofile. A command now runs without approval only when its exact argv form is verified to be read-only, workspace-contained, and free of external-helper execution — LOW is established per option, not inferred from the executable basename. Before a command classifies LOW, the policy must confirm its argv cannot execute helpers, write or truncate files, perform network I/O, or read outside the workspace boundary.Per-tool checks now enforce that requirement; forms the policy cannot verify are classified MEDIUM or HIGH, which routes them through the standard approval prompt:
grep/egrep/fgrep/rg) —--pre/--pre-globpreprocessor options classify HIGH (they run a configured program over matched files); unrecognized long options classify MEDIUM; path operands resolving outside the workspace classify HIGH.--ext-diff/--textconvclassify MEDIUM (they invoke configured external helpers);git diff --no-indexwith paths resolving outside the workspace classifies HIGH.tree— output-writing forms (-o/--output,-R, clustered-ao) classify MEDIUM, or HIGH when the output path is outside the workspace; unrecognized long options classify MEDIUM; out-of-workspace operands classify HIGH.ps— forms that display process environments (e,-E,-o environ,--format=…,env, including clusteredauxe) classify MEDIUM; unrecognized long options classify MEDIUM.ls— unrecognized long options classify MEDIUM; path operands resolving outside the workspace classify HIGH.date— file-backed reads via-r/-f/--file/--reference(split,=-attached, glued, and clustered forms) classify HIGH outside the workspace and MEDIUM inside it.Everyday read-only forms still classify LOW and run without a prompt: plain searches,
git diff --stat,tree -L 2,ps aux,ls -la, and baredate.Behavior change
ls ../now classifies HIGH — its path operand resolves outside the workspace — rather than LOW; its regression expectation is updated accordingly. A new parametrized regression corpus intest_command_policy.pypins each classification above, alongside the everyday forms that must keep running without a prompt.Testing
pytest tests/test_command_policy.py tests/test_approvals.py tests/test_run_command.pyruff check/ruff format --checkon touched filesmypy shellpilot/policy/command_policy.py --strict