agent-harness 0.28.4 → 0.28.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d0d7ed4f6ef8391d0b495868dd13f0fbfb84ee496c63ccabdd2900bba04f3d0
-  data.tar.gz: 0c8dd8c73feee507a47397dce38c1575889d25413cf4fb93fe66407e736f18c0
+  metadata.gz: 0e59433136b9fefab1e54397b752f0843b05db3b4f26dfd27a3607650ff3b4ad
+  data.tar.gz: 6043894c347081129f4486795bcb6d0d1f95750ac980dabe464e889ee0266bd2
 SHA512:
-  metadata.gz: f22bd0d258e06b594fd56a2cb523f6823d975988002f9b50338b0e46d1ebabd478c90f43fd3acaae8dced8842635c249e8d7b27a02fad45e528fc060b59143c1
-  data.tar.gz: 6d8b8f987d8fb747c134743729ed47c105bb4ba0689c350bd8868674c07a3da17df84cfe6a64a137403b022032800fb21477a7319d02820ee996fe5f8b3bd367
+  metadata.gz: 480f739434416487cef969aa1f21bbb772d5694099418468604c41be315da9f0cbe8d2167bfb2c3e9f9620cb62d162b725ac414959b5e9cd3723c867265a6625
+  data.tar.gz: 9d625423fd5a2956567626074c66479d951b3d4988684fb8da12b414b3500bd4535050e6fef33e46e0c84792b6bb2599b58a2a757b07d9ef0879971d967aacb3

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.28.4"
+  ".": "0.28.5"
 }

data/CHANGELOG.md

@@ -6,6 +6,13 @@
 * **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
 
+## [0.28.5](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.4...agent-harness/v0.28.5) (2026-07-10)
+
+
+### Bug Fixes
+
+* Kilocode/OpenCode: external_directory permission also blocks ~/.config and ~/.local/share paths, not just /tmp ([#290](https://github.com/viamin/agent-harness/issues/290)) ([7042f57](https://github.com/viamin/agent-harness/commit/7042f572e5723120159c96b735906edeede6ef76))
+
 ## [0.28.4](https://github.com/viamin/agent-harness/compare/agent-harness/v0.28.3...agent-harness/v0.28.4) (2026-07-10)
 
 

data/lib/agent_harness/providers/kilocode.rb

@@ -16,14 +16,23 @@ module AgentHarness
       # Kilo CLI (an OpenCode fork) ships the same external_directory
       # permission category as OpenCode, defaulting to "ask" for anything
       # outside the project dir. In non-interactive execution there is no
-      # human to answer the prompt, so reads of scratch files under /tmp are
-      # auto-rejected and the agent silently loses access to its own scratch
-      # output, killing the run without a recoverable error. This default rule
-      # broadens the allowlist to all of /tmp so the agent can read back files
-      # it (or its sub-agents) wrote there. See #282 (precedent: #277/#280).
-      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      # human to answer the prompt, so dedicated read/write/edit tool calls
+      # targeting paths outside the project dir are auto-rejected and the
+      # agent silently loses access to its own scratch output or its own
+      # config/data files, killing the run without a recoverable error.
+      #
+      # This default rule broadens the allowlist to all of /tmp (so the agent
+      # can read back files it or its sub-agents wrote there) and to the full
+      # agent home directory (so the agent can inspect/maintain its own
+      # config, cache, and data files such as ~/.config/kilocode,
+      # ~/.local/share/kilo, ~/.cache). The container is already isolated
+      # (Docker, non-root user) and the agent runs with --auto which approves
+      # everything inside the project dir. See #289 (precedent: #282/#277).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS = ["/tmp/**", "/home/agent/**"].freeze
       DEFAULT_PERMISSION_CONFIG = {
-        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+        "external_directory" => DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS
+          .to_h { |pattern| [pattern, "allow"] }
+          .freeze
       }.freeze
       USAGE_EVENT_TYPES = %w[result usage].freeze
       TOKEN_USAGE_KEYS = %w[

data/lib/agent_harness/providers/opencode.rb

@@ -13,10 +13,14 @@ module AgentHarness
       SUPPORTED_CLI_VERSION = "1.3.2"
       SUPPORTED_CLI_REQUIREMENT = Gem::Requirement.new(">= #{SUPPORTED_CLI_VERSION}", "< 1.4.0").freeze
       INSTALL_COMMAND_PREFIX = ["npm", "install", "-g", "--ignore-scripts"].freeze
+      # Allowlist of external_directory patterns auto-approved in
+      # non-interactive execution. See the DEFAULT_PERMISSION_RULE comment
+      # below for the rationale (precedent: #289/#282/#277/#280).
+      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS = ["/tmp/**", "/home/agent/**"].freeze
       DEFAULT_PERMISSION_CONFIG = {
-        "external_directory" => {
-          "/tmp/**" => "allow"
-        }
+        "external_directory" => DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS
+          .to_h { |pattern| [pattern, "allow"] }
+          .freeze
       }.freeze
       SUPPORTED_CLI_VERSIONS = [SUPPORTED_CLI_VERSION].freeze
       POSTINSTALL_COMMAND = "node $(npm root -g)/opencode-ai/postinstall.mjs"
@@ -132,13 +136,23 @@ module AgentHarness
       # `/tmp/opencode/*`, but its own sub-agent delegation pattern (e.g. the
       # Explore-Agent used to summarize large diffs/outputs) writes scratch
       # files to other `/tmp/*` paths. In non-interactive execution there is no
-      # human to approve the resulting permission prompt, so the agent silently
-      # loses access to its own scratch output and never completes the task.
-      # This default rule broadens the allowlist to all of `/tmp` so the agent
-      # can read back files it (or its sub-agents) wrote there.
-      DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN = "/tmp/**"
+      # human to approve the resulting permission prompt, so dedicated
+      # read/write/edit tool calls targeting paths outside the project dir are
+      # auto-rejected and the agent silently loses access to its own scratch
+      # output (or its own config/data files) and never completes the task.
+      #
+      # This default rule broadens the allowlist (see
+      # DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS) to all of `/tmp` (so
+      # the agent can read back files it or its sub-agents wrote there) and to
+      # the full agent home directory (so the agent can inspect/maintain its
+      # own config, cache, and data files such as ~/.config/opencode,
+      # ~/.local/share/opencode, ~/.cache). The container is already isolated
+      # (Docker, non-root user) and the agent runs with --auto which approves
+      # everything inside the project dir. See #289 (precedent: #282/#277/#280).
       DEFAULT_PERMISSION_RULE = {
-        "external_directory" => {DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERN => "allow"}
+        "external_directory" => DEFAULT_PERMISSION_EXTERNAL_DIRECTORY_PATTERNS
+          .to_h { |pattern| [pattern, "allow"] }
+          .freeze
       }.freeze
 
       def name

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.28.4"
+  VERSION = "0.28.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.28.4
+  version: 0.28.5
 platform: ruby
 authors:
 - Bart Agapinan