anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

A command block list? #865

New Issue
Closed
opened 2026-02-16 17:28:36 -05:00 by yindo · 4 comments
yindo commented 2026-02-16 17:28:36 -05:00
Owner
Copy Link
Copy Source

Originally created by @ironbelly on GitHub (Jul 22, 2025).

Originally assigned to: @thdxr on GitHub.

Been following discussions around permissions and like where things are going but had a troubling incident this morning that really made me long for Claude Code. In the end there was a task list that was incorrectly created by Claude, first item on that list was 'confirm that folder X doesn't exist, if it does your are blocked and must stop'.

I directed Gemini 2.5 Pro to that task list with an execution prompt and told it to go through and complete the first task in the list.
If found this folder, got blocked and then took it upon itself to unblock itself by deleting the entire folder with rm -rf . The folder in question contained the entire code base

While I prefer using git and git workspaces, I do think that a command like "rm -rf" has far too much destructive potential to be allowed by default and we would benefit from having a block list of commands that just can't be run unless removed from. To be clear, not 'rm' , I'm talking about 'rm -rf' in this case

Originally created by @ironbelly on GitHub (Jul 22, 2025). Originally assigned to: @thdxr on GitHub. Been following discussions around permissions and like where things are going but had a troubling incident this morning that really made me long for Claude Code. In the end there was a task list that was incorrectly created by Claude, first item on that list was 'confirm that folder X doesn't exist, if it does your are blocked and must stop'. I directed Gemini 2.5 Pro to that task list with an execution prompt and told it to go through and complete the first task in the list. If found this folder, got blocked and then took it upon itself to unblock itself by **deleting the entire folder with rm -rf** . The folder in question contained the entire code base While I prefer using git and git workspaces, I do think that a command like "rm -rf" has far too much destructive potential to be allowed by default and we would benefit from having a block list of commands that just can't be run unless removed from. To be clear, not 'rm' , I'm talking about 'rm -rf' in this case
yindo closed this issue 2026-02-16 17:28:36 -05:00
yindo commented 2026-02-16 17:28:36 -05:00
Author
Owner
Copy Link
Copy Source

@pepperpepperpepper commented on GitHub (Jul 22, 2025):

Just want to add to say that if a specific whitelist or blacklist that included rm were customizable through opencode.json, that would be preferred. Claude Code's constant need for authorization for use of standard tools is frustrating. The language model in Claude Code can be inconsistent in recognizing the whitelists. The current implementation here in opencode -- BUILD mode vs PLAN mode, is a huge improvement over that design. opencode, currently, without modifications, can be told to block "rm" in a custom mode defined in opencode.json, just not in exactly the same per-command way as claude, which is ultimately frustrating to use

@pepperpepperpepper commented on GitHub (Jul 22, 2025): Just want to add to say that if a specific whitelist or blacklist that included rm were customizable through opencode.json, that would be preferred. Claude Code's constant need for authorization for use of standard tools is frustrating. The language model in Claude Code can be inconsistent in recognizing the whitelists. The current implementation here in opencode -- BUILD mode vs PLAN mode, is a huge improvement over that design. opencode, currently, without modifications, _can_ be told to block "rm" in a custom mode defined in opencode.json, just not in exactly the same per-command way as claude, which is ultimately frustrating to use
yindo commented 2026-02-16 17:28:37 -05:00
Author
Owner
Copy Link
Copy Source

@Hawful commented on GitHub (Jul 27, 2025):

Just wanted to add to this because I got REAL scared just a few minutes ago. I was just goofing around, so no harm no foul, but TRULY concerning that it hallucinates that guardrails exist when they either do not, or can be ignored.

Image
@Hawful commented on GitHub (Jul 27, 2025): Just wanted to add to this because I got REAL scared just a few minutes ago. I was just goofing around, so no harm no foul, but TRULY concerning that it hallucinates that guardrails exist when they either do not, or can be ignored. <img width="1240" height="1240" alt="Image" src="https://github.com/user-attachments/assets/90b6c113-f34a-48a8-9d24-ebd0bbaa8682" />
yindo commented 2026-02-16 17:28:37 -05:00
Author
Owner
Copy Link
Copy Source

@bartokon commented on GitHub (Jul 31, 2025):

What about running a small LLM that would analyze generated output?
Many times, I saw model add rm command to python script (that bypasses forbidden commands).
A Small model would act like a supervisor. LLM that checks if generated code/command is following the rules and is non destructive -> good command for given context.

For example:
If I have a rules.md specified in my codebase or a json opencode with an agent that has in description "use only ls command". The supervisor LLM would check if the output text is a ls command. If not, block output or allow the user to decide.

It should be a really small model (with small context window) that should only have the executed command, workspace rules, and possibly last few ran commands from console.

TLDR: Rules are great but can be bypassed, add supervisor LLM.

What do you think? 🤔

@bartokon commented on GitHub (Jul 31, 2025): What about running a small LLM that would analyze generated output? Many times, I saw model add rm command to python script (that bypasses forbidden commands). A Small model would act like a supervisor. LLM that checks if generated code/command is following the rules and is non destructive -> good command for given context. For example: If I have a rules.md specified in my codebase or a json opencode with an agent that has in description "use only ls command". The supervisor LLM would check if the output text is a ls command. If not, block output or allow the user to decide. It should be a really small model (with small context window) that should only have the executed command, workspace rules, and possibly last few ran commands from console. TLDR: Rules are great but can be bypassed, add supervisor LLM. What do you think? 🤔
yindo commented 2026-02-16 17:28:37 -05:00
Author
Owner
Copy Link
Copy Source

@adamdotdevin commented on GitHub (Jul 31, 2025):

moving the conversation to #239

@adamdotdevin commented on GitHub (Jul 31, 2025): moving the conversation to #239
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#865
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?