Repository navigation

fix(agents): stop asking for commands the hooks can prove safe - #242

Merged

furedea merged 25 commits into

mainfrom

fix/reduce-safe-confirmations

Oct 20, 2026

Merged

fix(agents): stop asking for commands the hooks can prove safe#242
furedea merged 25 commits into
mainfrom
fix/reduce-safe-confirmations

Commits on Oct 19, 2026
- fix(agents): stop asking for commands the hooks can prove safe
  
  furedea
  and
  claude
  committed
  6fe3db1
- fix(agents): close option and rm bypasses found in review
  
  furedea
  and
  claude
  committed
  2bd208e
- fix(agents): judge request options on decoded arguments
  
  furedea
  and
  claude
  committed
  da72615
- fix(agents): judge curl and wget on their arguments, not on text
  
  furedea
  and
  claude
  committed
  9c80ab8
- fix(agents): find spreading expansions in the syntax tree
  
  furedea
  and
  claude
  committed
  2b81edd
- fix(agents): ask for every remote curl and wget request
  
  furedea
  and
  claude
  committed
  14cd610
- fix(agents): give wget its own options and see compound redirects
  
  furedea
  and
  claude
  committed
  d6f0c0f
- fix(agents): resolve rm targets against the tool workdir
  
  furedea
  and
  claude
  committed
  31652b6
- build(agents): list the new hook libraries as first-party for deptry
  
  furedea
  and
  claude
  committed
  060d82b
- fix(agents): narrow rm, functions, and local requests to what the hook can see
  
  furedea
  and
  claude
  committed
  f4892fe
- fix(agents): shrink the relaxations to what the hook can prove
  
  furedea
  and
  claude
  committed
  c142ca6
- fix(agents): ask for line continuations and any unquoted brace
  
  furedea
  and
  claude
  committed
  7d63c1e
- fix(agents): allow rm only for absolute temporary paths
  
  furedea
  and
  claude
  committed
  3e45203
- fix(agents): trust only plain rm paths, real temp roots, and main's gh api rules
  
  furedea
  and
  claude
  committed
  785b450
- fix(agents): keep main's denials for escaped and unsettled rm trees
  
  furedea
  and
  claude
  committed
  0016fda
- fix(agents): take rm out of this change and hold Herdr's new forms to literal words
  
  furedea
  and
  claude
  committed
  c029c72
- fix(agents): restore main's rm rules and describe the curl and wget allows
  
  furedea
  and
  claude
  committed
  d96ac05
- fix(agents): treat any expansion as non-literal for the literal_words rules
  
  furedea
  and
  claude
  committed
  e27369b
- fix(agents): judge literal_words rules on the whole command text
  
  furedea
  and
  claude
  committed
  ad0420d
- fix(agents): skip single-quoted text in the literal_words check
  
  furedea
  and
  claude
  committed
  690bc01
- fix(agents): apply literal_words rules only to one plain gh or herdr call
  
  furedea
  and
  claude
  committed
  2f3ba45
- fix(agents): keep assignments and redirects out of the literal_words call
  
  furedea
  and
  claude
  committed
  f819d44
- fix(agents): close Herdr's global options and local requests that leave the machine
  
  furedea
  and
  claude
  committed
  4ddab4b
- fix(agents): ask for every wget and allow local curl only as one plain call
  
  furedea
  and
  claude
  committed
  734a0fe
- fix(agents): let local curl clusters hold only value-less flags
  
  furedea
  and
  claude
  committed
  b0c98da

Commits

Commits on Oct 19, 2026