Judge the file body when a command runs an interpreter on a session-written script

Open
#67 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
cli, security

Research direction

Start by tracing the command-classification entry point for interpreter invocations and the existing heredoc-body handling; no implementation file or test is named. Review the evidence in ~/.omp/agent/dreams/2026-09-16.md and the stopgap in ~/.omp/agent/AGENTS.md. Done means bounded body reads fail closed, import behavior and L1 coverage are decided, and tests show path or filename changes no longer alter the verdict.

Written by the indexing model from the issue text.

Description

A headless worker can run any code it wrote, as long as the file sits in the worktree and not in /tmp. The gate judges the command text (python3 .scratch/x.py), not what x.py does, so where a script lives decides whether it runs, and renaming it can flip the verdict.

Evidence from the 2026-09-16 autodream run (~/.omp/agent/dreams/2026-09-16.md, open question 2):

  • ~28 sessions had a session-written /tmp script refused as unverifiable provenance.
  • The byte-identical script inside the assigned worktree ran. Workers found that independently ~8 times.
  • P4Carriers got a refused file through by renaming cleanup_row.py to rs3_remove_import.py.

Trusting session-written files would be a straight bypass: the model writes whatever it wants, then runs it. The fix goes the other way. When a command invokes an interpreter (python, node, bun, bash, sh, ruby, php, ...) on a readable file, read the file and judge its body as part of the command, the same way heredoc bodies are handled now. Then path and filename stop mattering, in both directions.

Things to settle:

  • Size cap on the body read, and what happens past it (fail closed).
  • Files that import siblings: judge only the entry file, or refuse when the entry pulls in session-written modules.
  • Whether L1 critical patterns run over the body too, or only Jev.

Stopgap in place since 2026-09-19: ~/.omp/agent/AGENTS.md tells workers to write probes under <worktree>/.scratch/ and never rename a refused script.

Dominant language
TypeScript
Stars
0
Forks
1
Avg merge
1h 20m
Merged PRs (30d)
32

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from STRML/omp-classifier

All issues in STRML/omp-classifier

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.