From b2249f0859e3c31b7d8bf602fab390dc5810d8bf Mon Sep 17 00:00:00 2001 From: Ryder Sun Date: Thu, 15 Oct 2026 19:04:42 +0800 Subject: [PATCH] fix: stop skipping every WorkBuddy permission check in write mode 28127b3 added --dangerously-skip-permissions next to acceptEdits when a conversation allows workspace writes. That flag lets the CLI run any command and write anywhere on the machine without confirmation, which goes beyond Meldwork's opt-in workspace-write boundary and differs from every other Agent. Write mode now relies on acceptEdits, which accepts file edits in the working directory. The local machine has no CodeBuddy CLI, so an edit-only tool allowlist was not added; an unverified flag could break every WorkBuddy turn. Checks: new cli-adapters test for WorkBuddy write/read-only arguments; WorkBuddy adapter and protocol tests (7 pass). Full desktop suite: 1537. --- desktop/src/agents/cli/cli-invocations.cjs | 4 +++- desktop/test/agents/cli/cli-adapters.test.cjs | 8 ++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/desktop/src/agents/cli/cli-invocations.cjs b/desktop/src/agents/cli/cli-invocations.cjs index 5357f5b..f01c39b 100644 --- a/desktop/src/agents/cli/cli-invocations.cjs +++ b/desktop/src/agents/cli/cli-invocations.cjs @@ -145,8 +145,10 @@ function invocation(kind, executable, workdir, sessionRef = '', options = {}) { '--print', '--output-format', 'stream-json', '--include-partial-messages', + // Workspace write access means accepting file edits in the working + // directory. Skipping every permission check would also let the CLI + // run any command anywhere on the machine without confirmation. '--permission-mode', options.sandbox === 'workspace-write' ? 'acceptEdits' : 'plan', - ...(options.sandbox === 'workspace-write' ? ['--dangerously-skip-permissions'] : []), ...(maxTurns ? ['--max-turns', String(maxTurns)] : []), ...(sessionRef ? ['--resume', sessionRef] : []), ], diff --git a/desktop/test/agents/cli/cli-adapters.test.cjs b/desktop/test/agents/cli/cli-adapters.test.cjs index ec9c60c..701fa9a 100644 --- a/desktop/test/agents/cli/cli-adapters.test.cjs +++ b/desktop/test/agents/cli/cli-adapters.test.cjs @@ -1653,6 +1653,14 @@ test('Pi uses non-interactive JSON flags and keeps provider settings out of argu assert.equal(typeof parsePiOutput, 'function') }) +test('WorkBuddy write mode accepts edits without skipping every permission check', () => { + const writable = invocation('workbuddy', '/tmp/codebuddy', '/tmp', '', { sandbox: 'workspace-write' }) + assert.equal(writable.args[writable.args.indexOf('--permission-mode') + 1], 'acceptEdits') + assert.equal(writable.args.includes('--dangerously-skip-permissions'), false) + const readOnly = invocation('workbuddy', '/tmp/codebuddy', '/tmp', '', { sandbox: 'read-only' }) + assert.equal(readOnly.args[readOnly.args.indexOf('--permission-mode') + 1], 'plan') +}) + test('Hermes forwards one image and rejects additional images instead of dropping them', () => { const first = path.resolve('diagram-one.png') const second = path.resolve('diagram-two.png')