@mortz.prk/opencode-auto-mode 1.1.1 → 1.1.2

package/README.llm.md

@@ -178,9 +178,15 @@ are bounded by `reviewTimeoutMs`.
 Built-in guards are not a policy language and are not user-extensible. They cover
 protected repository/config paths, credential paths, risky shell structure,
 recursive external deletion, history changes, symlink traversal, project scope,
-and ambiguous syntax. Protected shell operands are a hard deny; protected
-`read`/`edit` targets and symlink traversal have a mandatory ask floor. `glob` and
-`grep` scope is not verified, so static review abstains. `webfetch`, `websearch`,
+and ambiguous syntax. Credential/config shell operands are a hard deny; their
+`read`/`edit` targets and symlink traversal have a mandatory ask floor. `.git`
+metadata access, Git global options, and complex/dynamic POSIX shell syntax stay
+HIGH and reach configured decision/LLM stages; static review abstains instead of
+forcing a user prompt. Visible blocked operations still win, and malformed or
+oversized requests remain bounded. Windows shell dialects retain a mandatory
+ask floor. Loading a `skill` is LOW because it only loads instructions; subsequent
+tool calls are checked independently. `glob` and `grep` scope is not verified,
+so static review abstains. `webfetch`, `websearch`,
 `execute`, and unknown tools remain HIGH.
 
 Code Mode is bridged in `execute.before` through `ctx.permission.assert`.

package/README.md

@@ -122,7 +122,13 @@ Stage shapes:
    are re-reviewed but never deleted or rewritten.
 3. Built-in guards run first: protected paths and credentials, risky shell
    structure, recursive external deletion, history changes, and ambiguous syntax.
-   These guards are not user-extensible.
+   These guards are not user-extensible. Git metadata (`.git`), Git global
+   options, and complex POSIX shell syntax are left to the configured decision/LLM
+   stages, not automatically denied or forced to a user prompt. Credential
+   protections and visible blocked operations still take precedence. Unsupported
+   Windows shell dialects still require manual approval. Loading a skill is
+   low-risk: it loads instructions, not executable code; later tool calls are
+   checked separately.
 4. Configured classifiers run in array order. A static stage may resolve low-risk
    work; a decision stage uses OpenCode's native decision API; an LLM stage uses
    its explicit reviewer. The first decisive allow or deny stops the chain.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mortz.prk/opencode-auto-mode",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Configurable automatic permission review for OpenCode v2.",
   "author": {
     "name": "Andrew Mellen",

package/src/index.ts

@@ -22,7 +22,7 @@ const INTERRUPTED_REASON = "Auto-mode review was interrupted; please decide your
 const PAUSED_REASON = "Auto mode is paused; please decide yourself";
 const INVALID_CONFIG_ACTION = "Auto-mode review is disabled because its configuration is invalid";
 const NATIVE_DENY_REASON = "Native permission deny";
-const REVIEW_ACTIONS = /^(?:read|edit|write|glob|grep|shell|execute|webfetch|websearch|question|todowrite)$/;
+const REVIEW_ACTIONS = /^(?:read|edit|write|glob|grep|shell|execute|webfetch|websearch|question|todowrite|skill)$/;
 const SAFER_ALTERNATIVE = "Continue with a safer alternative.";
 function denialMessage(reason: string): string {
   const trimmed = reason.trim().replace(/[\s.]+$/, "");

package/src/score/files.ts

@@ -9,12 +9,14 @@ export function isFileAction(action: string): boolean {
   return FILE_ACTIONS.has(action);
 }
 
-/** Protected paths and symlink traversal need human approval, never a hard deny. */
+/** Credentials/config and symlinks ask; Git metadata goes to model review. */
 function pathApproval(resources: readonly string[], projectDir?: string): RequestScore | undefined {
-  if (resources.some((target) => isProtected(target, projectDir)))
+  if (resources.some((target) => isProtected(target, projectDir, false)))
     return ask("Protected path access requires human approval");
   if (resources.some((target) => hasSymlinkTraversal(target, projectDir)))
     return ask("Symlink traversal requires human approval");
+  if (resources.some((target) => isProtected(target, projectDir)))
+    return high("Git metadata access requires further review");
   return undefined;
 }
 

package/src/score/index.ts

@@ -27,6 +27,7 @@ export function scoreRequest(request: PermissionRequest & { worktreeRoot?: strin
   // No host allowlist exists, so a URL/query name cannot bound what is fetched.
   if (NETWORK_ACTIONS.has(action)) return high("Network fetch/search has no verified host allowlist");
   if (INTERACTIVE_ACTIONS.has(action)) return low("User interaction without host side effects");
+  if (action === "skill") return low("Loading skill instructions without executing them");
   // JavaScript can hide egress behind aliases, templates and computed URLs.
   // Even literal allowlisted fetches do not prove the rest of the program safe.
   if (action === "execute")

package/src/score/shell-safety.ts

@@ -5,25 +5,25 @@ import { historyChange, historyScore, isGitGlobalOption } from "./history.js";
 import { executableShapeScore, pathTargets, type ShellScan } from "./shell-argv.js";
 import { ask, deny, high, type RequestScore } from "./types.js";
 
-function commandTouchesProtected(command: ParsedShellCommands | undefined, projectDir?: string): boolean {
+function commandTouchesProtected(command: ParsedShellCommands | undefined, projectDir?: string, includeGit = true): boolean {
   if (!command) return false;
-  return command.segments.some((segment) => protectedSegment(segment, projectDir)) ||
-    command.leftovers.some((word) => isProtectedShellWord(word, projectDir));
+  return command.segments.some((segment) => protectedSegment(segment, projectDir, includeGit)) ||
+    command.leftovers.some((word) => isProtectedShellWord(word, projectDir, includeGit));
 }
 
 /** A redirection always names a file, so its target takes the full path-aware check. */
-function redirectsProtected(commands: readonly (ParsedShellCommands | undefined)[], projectDir?: string): boolean {
-  return commands.some((command) => command?.redirects.some((target) => isProtected(target, projectDir)));
+function redirectsProtected(commands: readonly (ParsedShellCommands | undefined)[], projectDir?: string, includeGit = true): boolean {
+  return commands.some((command) => command?.redirects.some((target) => isProtected(target, projectDir, includeGit)));
 }
 
 /** Denies and asks that depend only on the literal parsed command text. */
 function literalShellScore(scan: ShellScan, request: PermissionRequest, worktreeRoot?: string): RequestScore | undefined {
   if (scan.scanned.some((argv) => recursiveExternalDelete(argv, request.projectDir, worktreeRoot)))
     return deny("Recursive/force deletion outside the project");
-  // Git global options alter cwd/config or helper execution. Do not guess the
-  // effective subcommand or let a reviewer lift this uncertainty.
+  // Global options can change cwd/config/helpers: not static clearance, but
+  // reviewers can evaluate the full invocation and its effective scope.
   if (scan.scanned.some(isGitGlobalOption))
-    return ask("Git global options require manual approval");
+    return high("Git global options require further review");
   // A history-rewriting invocation is gated once, against the request's VCS facts.
   if (scan.scanned.some(historyChange)) return historyScore(scan.scanned, request.gitState);
   // No regex fallback. Only the guard's literal, fully parsed representation
@@ -32,17 +32,20 @@ function literalShellScore(scan: ShellScan, request: PermissionRequest, worktree
   return undefined;
 }
 
-/** Protected paths deny; a path that traverses a symlink asks for human review. */
+/** Credential/config paths deny; Git metadata is left to configured reviewers. */
 function protectedPathScore(scan: ShellScan, projectDir?: string): RequestScore | undefined {
   // Wrappers do not erase destructive semantics (env rm / command git push).
   // Each simple command is judged by its own grammar, so a pattern/script/filter
   // is data even when spelled like a path, while tokens outside any command keep
   // the generic word check.
-  if (redirectsProtected(scan.commands, projectDir) ||
-      scan.commands.some((command) => commandTouchesProtected(command, projectDir)))
+  if (redirectsProtected(scan.commands, projectDir, false) ||
+      scan.commands.some((command) => commandTouchesProtected(command, projectDir, false)))
     return deny("Protected path access");
   if (pathTargets(scan).some((arg) => hasSymlinkTraversal(arg, projectDir)))
     return ask("Symlink traversal requires human approval");
+  if (redirectsProtected(scan.commands, projectDir) ||
+      scan.commands.some((command) => commandTouchesProtected(command, projectDir)))
+    return high("Git metadata access requires further review");
   return undefined;
 }
 

package/src/score/shell.ts

@@ -3,21 +3,22 @@ import { guardShell, visibleShellDeny } from "../shell.js";
 import { scanShell, type ShellScan } from "./shell-argv.js";
 import { scoreShellBaseline } from "./shell-baseline.js";
 import { shellSafetyScore } from "./shell-safety.js";
-import { ask, deny, type RequestScore } from "./types.js";
+import { ask, deny, high, type RequestScore } from "./types.js";
 
-/** Honours a guard deny/ask before the residual scorer runs. */
+/** Preserve visible denies; parser uncertainty must reach configured reviewers. */
 function guardScore(guarded: ReviewResult | undefined, resources: readonly string[],
   projectDir?: string, worktreeRoot?: string): RequestScore | undefined {
   if (guarded?.decision === "deny") return deny(guarded.reason);
   if (guarded?.decision !== "ask") return undefined;
-  // An ask is a manual-approval floor, not a clearance: a deny already visible
-  // in the literal prefix must still win before the ask is honored.
+  // The POSIX scanner cannot safely analyze other shell dialects.
+  if (process.platform === "win32") return ask(guarded.reason);
+  // The parser cannot clear uncertain syntax, but visible dangers still win.
   const blocked = visibleShellDeny(resources, projectDir, worktreeRoot);
   if (blocked !== undefined) return deny(blocked);
-  return ask(guarded.reason);
+  return undefined;
 }
 
-/** Scores one shell request: guard floor, hard safety checks, then residual band. */
+/** Scores one shell request: visible denies, safety checks, then residual band. */
 export function scoreShellRequest(request: PermissionRequest, worktreeRoot?: string): RequestScore {
   const { resources, projectDir } = request;
   const guarded = guardShell(resources, projectDir);
@@ -26,5 +27,6 @@ export function scoreShellRequest(request: PermissionRequest, worktreeRoot?: str
   const scan: ShellScan = scanShell(resources);
   const unsafe = shellSafetyScore(scan, request, worktreeRoot);
   if (unsafe) return unsafe;
+  if (guarded?.decision === "ask") return high(guarded.reason);
   return scoreShellBaseline(scan, guarded, projectDir, worktreeRoot);
 }

package/src/shell.ts

@@ -277,17 +277,23 @@ export function parseShellCommands(command: string, limits: { maxChars?: number
  * path word is checked with `isProtectedPathOperand` and every other word keeps
  * the generic shell-word check.
  */
-export function protectedSegment(segment: { words: readonly string[] }, projectDir?: string): boolean {
+export function protectedSegment(segment: { words: readonly string[] }, projectDir?: string, includeGit = true): boolean {
   const roles = operandRoles(segment.words);
   const data = new Set(roles.data);
   const paths = new Set(roles.paths);
-  if (roles.pathValues.some((value) => isProtectedPathOperand(value, projectDir))) return true;
+  if (roles.pathValues.some((value) => isProtectedPathOperand(value, projectDir, includeGit))) return true;
   return segment.words.some((word, index) => {
     if (data.has(index)) return false;
-    return paths.has(index) ? isProtectedPathOperand(word, projectDir) : isProtectedShellWord(word, projectDir);
+    return paths.has(index) ? isProtectedPathOperand(word, projectDir, includeGit) : isProtectedShellWord(word, projectDir, includeGit);
   });
 }
 
+function protectedCommands(parsed: ParsedLine, projectDir?: string, includeGit = true): boolean {
+  return parsed.redirects.some((target) => isProtected(target, projectDir, includeGit)) ||
+    parsed.segments.some((segment) => protectedSegment(segment, projectDir, includeGit)) ||
+    parsed.leftovers.some((word) => isProtectedShellWord(word, projectDir, includeGit));
+}
+
 function analyzeLine(command: string, projectDir?: string): Verdict {
   if (!command.trim()) return { decision: "allow" };
   if (!BALANCED_QUOTES.test(command)) return { decision: "ask" };
@@ -304,10 +310,8 @@ function analyzeLine(command: string, projectDir?: string): Verdict {
   // keeps the protected-path check. Tokens no command consumed (words inside a
   // substitution) keep the generic shell-word check. None of this depends on the
   // line parsing completely: a deny visible in the literal text must win over the
-  // manual-approval floor.
-  if (redirects.some((target) => isProtected(target, projectDir)) ||
-      segments.some((segment) => protectedSegment(segment, projectDir)) ||
-      leftovers.some((word) => isProtectedShellWord(word, projectDir)))
+  // parser uncertainty.
+  if (protectedCommands({ segments, redirects, leftovers, complete }, projectDir, false))
     return { decision: "deny", reason: "protected path access" };
   // Deny rules that are already visible must win even when later arguments are
   // dynamic (`sudo id $(...)`) and even when the line only parses partially.
@@ -326,7 +330,7 @@ function analyzeLine(command: string, projectDir?: string): Verdict {
   if (!complete || DYNAMIC_SYNTAX.test(command)) return { decision: "ask" };
 
   let ask = false;
-  let review = false;
+  let review = protectedCommands({ segments, redirects, leftovers, complete }, projectDir);
   for (const segment of segments) {
     const verdict = analyzeSegment(segment);
     if (verdict.decision === "deny") return verdict;
@@ -518,9 +522,7 @@ export function visibleShellDeny(resources: readonly string[], projectDir?: stri
       if (FORK_BOMB.test(visible)) return "dangerous shell operation";
       const parsed = parseShellCommands(visible, { maxChars: MAX_COMMAND_BYTES });
       if (parsed === undefined) continue;
-      if (parsed.redirects.some((target) => isProtected(target, projectDir)) ||
-          parsed.segments.some((segment) => protectedSegment(segment, projectDir)) ||
-          parsed.leftovers.some((word) => isProtectedShellWord(word, projectDir)))
+      if (protectedCommands(parsed, projectDir, false))
         return "protected path access";
       const commands = parsed.segments.map((segment) => effectiveInvocation(segment.words));
       for (const command of commands) {
@@ -609,7 +611,6 @@ export function guardShell(resources: readonly string[], projectDir?: string): R
     if (verdict.decision === "ask") ask = true;
     else if (verdict.decision === "review") review = true;
   }
-  if (ask) return { decision: "ask", reason: "Shell syntax requires manual approval" };
+  if (ask) return { decision: "ask", reason: "Shell syntax requires further review" };
   return review ? undefined : { decision: "allow", reason: "read-only command" };
 }
-

package/src/tiers.ts

@@ -83,6 +83,12 @@ function projectRootSpellings(projectDir?: string): string[] {
   return roots;
 }
 
+function protectionSpelling(candidate: string, includeGit?: boolean): string {
+  // Metadata needs model review, not a credential deny. Do not normalize here:
+  // sensitive descendants and resolved symlink destinations must still count.
+  return includeGit === false ? candidate.replace(/(^|[/\\])\.git(?=[/\\]|$)/gi, "$1") : candidate;
+}
+
 /**
  * Sensitive spelling of one candidate.
  *
@@ -92,14 +98,14 @@ function projectRootSpellings(projectDir?: string): string[] {
  * still applied to the whole candidate and, in `isProtected`, to every resolved
  * component: a real `.ssh` or `.config` directory stays protected.
  */
-function sensitiveSpelling(candidate: string, roots: readonly string[]): boolean {
-  if (SENSITIVE_PATH.test(candidate)) return true;
+function sensitiveSpelling(candidate: string, roots: readonly string[], includeGit?: boolean): boolean {
+  if (SENSITIVE_PATH.test(protectionSpelling(candidate, includeGit))) return true;
   if (path.isAbsolute(candidate)) {
     for (const root of roots) {
-      if (isInProject(candidate, root)) return DOT_COMPONENT.test(path.relative(root, path.resolve(candidate)));
+      if (isInProject(candidate, root)) return DOT_COMPONENT.test(protectionSpelling(path.relative(root, path.resolve(candidate)), includeGit));
     }
   }
-  return DOT_COMPONENT.test(candidate);
+  return DOT_COMPONENT.test(protectionSpelling(candidate, includeGit));
 }
 
 /** Inspect components before normalization can erase an alias followed by `..`.
@@ -123,16 +129,17 @@ export function hasSymlinkTraversal(target: string, locationDir = process.cwd())
   return false;
 }
 
-/** Check lexical spelling and each resolved component, preserving symlink/.. traversal. */
-export function isProtected(target: string, projectDir?: string): boolean {
+/** Check lexical and resolved components. Excluding Git only removes the metadata
+ * marker; credentials inside it and symlink/.. traversal remain protected. */
+export function isProtected(target: string, projectDir?: string, includeGit?: boolean): boolean {
   const roots = projectRootSpellings(projectDir);
   const candidates = [target, ...target.split("="), ...target.split(":")];
-  if (candidates.some((candidate) => sensitiveSpelling(candidate, roots) ||
+  if (candidates.some((candidate) => sensitiveSpelling(candidate, roots, includeGit) ||
       /^\/proc\/(?:self|thread-self|\d+)\/(?:environ|mem)(?:$|\/)/.test(candidate))) return true;
   let current: string;
   try { current = path.isAbsolute(target) ? path.parse(target).root : realpathSync(projectDir ?? process.cwd()); }
   catch { return hasSymlinkTraversal(target, path.resolve(projectDir ?? process.cwd())); }
-  const protectedPath = (candidate: string) => SENSITIVE_PATH.test(candidate) ||
+  const protectedPath = (candidate: string) => SENSITIVE_PATH.test(protectionSpelling(candidate, includeGit)) ||
     /^\/proc\/(?:self|thread-self|\d+)\/(?:environ|mem)(?:$|\/)/.test(candidate);
   if (protectedPath(current)) return true;
   for (const part of target.split(path.sep).filter(Boolean)) {
@@ -205,13 +212,13 @@ function operandValue(word: string): string {
  * reason to deny `.name`, `.gitignore` or `.cache`. Paths with a separator keep
  * the full check, including resolved components, symlinks and `file:` URLs.
  */
-export function isProtectedPathOperand(target: string, projectDir?: string): boolean {
+export function isProtectedPathOperand(target: string, projectDir?: string, includeGit?: boolean): boolean {
   if (!target) return false;
   const word = operandValue(target);
   const local = fileUrlPath(word);
-  if (local !== undefined) return isProtected(local, projectDir);
+  if (local !== undefined) return isProtected(local, projectDir, includeGit);
   if (SCHEME_URL.test(word) || SCP_URL.test(word)) return false;
-  return /[/\\]/.test(word) ? isProtected(word, projectDir) : SENSITIVE_PATH.test(word);
+  return /[/\\]/.test(word) ? isProtected(word, projectDir, includeGit) : SENSITIVE_PATH.test(protectionSpelling(word, includeGit));
 }
 
 /**
@@ -227,33 +234,33 @@ export function isProtectedPathOperand(target: string, projectDir?: string): boo
  * (`signing.pem`) stay protected everywhere, and redirect targets are checked
  * with the full `isProtected` because a redirection always names a file.
  */
-export function isProtectedShellWord(target: string, projectDir?: string): boolean {
+export function isProtectedShellWord(target: string, projectDir?: string, includeGit?: boolean): boolean {
   if (!target) return false;
   const separator = target.startsWith("-") ? target.indexOf("=") : -1;
   // `--grep=config/auth`, `--format=src/.env` and `--exclude=.env` carry
   // pattern/format data even when the value is spelled like a path.
   if (separator !== -1 && isDataOption(target.slice(0, separator))) return false;
   const local = fileUrlPath(target);
-  if (local !== undefined) return isProtected(local, projectDir);
+  if (local !== undefined) return isProtected(local, projectDir, includeGit);
   if (SCHEME_URL.test(target) || SCP_URL.test(target)) return false;
   const candidates = [target, ...target.split("="), ...target.split(":")];
   // A `file:` value is a local path even when it arrives through an option.
   const files = candidates.map(fileUrlPath).filter((candidate): candidate is string => candidate !== undefined);
-  if (files.length) return files.some((file) => isProtected(file, projectDir));
+  if (files.length) return files.some((file) => isProtected(file, projectDir, includeGit));
   // Any other scheme or an SCP-style location is remote, never a local path.
   if (candidates.some((candidate) => SCHEME_URL.test(candidate) || SCP_URL.test(candidate))) return false;
   if (target.startsWith("-")) {
     if (separator === -1) return false;
     // `--config=credentials.json` and `--file=.env` name files.
-    return isProtectedPathOperand(target.slice(separator + 1), projectDir);
+    return isProtectedPathOperand(target.slice(separator + 1), projectDir, includeGit);
   }
   // `git show HEAD:.env` names a file after the colon; schemes and SCP
   // locations were already excluded above.
-  if (!target.includes("=") && target.split(":").slice(1).some((part) => isProtectedPathOperand(part, projectDir)))
+  if (!target.includes("=") && target.split(":").slice(1).some((part) => isProtectedPathOperand(part, projectDir, includeGit)))
     return true;
   // A separator-less word is only a file reference when it carries a
   // filename-shaped name; a bare keyword such as `auth` stays data here.
-  return /[/\\]/.test(target) ? isProtected(target, projectDir) : SENSITIVE_NAME.test(target);
+  return /[/\\]/.test(target) ? isProtected(target, projectDir, includeGit) : SENSITIVE_NAME.test(protectionSpelling(target, includeGit));
 }
 
 export function isInProject(target: string, projectDir: string): boolean {