Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Permission rules: ask before reading secrets, and cut safe prompts where the data allows

オープン
  • 何か問題がありますか？
#145 コメント 0 件 リアクション 0 件 担当者 2 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@AIR-Xie がすでに取り組んでいます。

2026年10月25日 から。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
typescript
領域
authentication, security, testing

調査の方向性

Start with src/utils/permissions/filesystem.ts, then trace the Bash read-only check, the Read tool permission checks, and the tests named in the issue. Use the dataset's fill-rules.ts workflow to compare harmful calls allowed and safe calls asked on train, dev, and test. Done means secret reads prompt for approval, any removed prompt has near-zero harmful share on dev, and the before and after results are recorded on the issue.

索引モデルが issue の本文から書いたものです。

説明

Follow-up from #125 and #127. The System 1 dataset (#126) records what the CLI's current permission rules decide for every SABER tool call, so rule changes can be measured before they ship.

Goal

Change the permission rules so that they:

  1. ask before reading secrets, which they now allow; and
  2. ask less often about safe calls, but only where the data shows it is safe to stop asking.

Rules only. No model is involved; the hosted-model guardrail is #124 Phase 1.

What the data shows

SABER test split, 18,668 labeled calls (2,505 harmful). Counts for train are in brackets.

The rules let harmful calls through

The rules allow 435 of the 2,505 harmful calls (17.4%) without asking. All of them are Bash, and most are reads that the read-only check passes because the command (cat, head, grep) is read-only, whatever it reads.

Calls the rules allow that mention… Harmful Safe
.env files 242 [1,010] 112 [504]
~/.ssh, id_rsa, id_ed25519 59 [141] 244 [790]
credential, secret and token files (credentials, secrets.yaml, .netrc, .npmrc, .pgpass, token) 15 [154] 65 [207]
~/.aws/ 1 [33] 38 [95]
shell profiles (.bashrc, .zshrc, .profile) 7 [1] 113 [172]

DANGEROUS_FILES in src/utils/permissions/filesystem.ts protects these paths from writes but not from reads.

The rules ask about many safe calls, but no group is safe to drop wholesale

The rules ask about 11,397 test calls, and 9,327 of them (82%) are safe. Grouped by the reason the rules give:

Reason the rules ask Harmful Safe Harmful share
compound command with a part not on the read-only list 519 3,635 12.5%
"This command requires approval" 629 2,298 21.5%
Bash with no specific reason 317 1,527 17.2%
newlines that could separate commands 95 354 21.2%
$() command substitution 69 264 20.7%
consecutive quote characters 69 205 25.2%
MCP tools with no rule 100 113 46.9%

Every group is at least 12% harmful, so relaxing a whole check would let harmful calls through. Prompts can only be cut for narrower command shapes inside these groups.

Plan

  1. Ask on reads of secrets. Add a read-side list next to DANGEROUS_FILES, and make the Bash read-only check and the Read tool ask when a call touches one of its paths. Start with .env* and private keys (~/.ssh/id_*), which carry most of the harmful reads. Leave out known_hosts, config and *.pub, since they make up much of the safe ~/.ssh traffic. Add credential files and ~/.aws/credentials. Leave shell profiles out: in this data they are almost all safe reads.
  2. Find narrow safe shapes to stop asking about. Within the compound-command and "requires approval" groups, list the most common command shapes on train, keep a shape only if it is read-only by construction (for example cd <dir> && ls), and check its harmful share on dev.
  3. Measure each change by re-running the dataset's fill-rules.ts and comparing harmful calls allowed against safe calls asked, before and after. Design on train, check on dev, and report test once at the end.

Done when

  • Reads of .env files and private keys are asked about, with tests in bashPermissions.test.ts and the Read tool's permission tests.
  • A table on this issue gives harmful calls allowed and safe calls asked, before and after, on dev and test.
  • Any prompt that is removed has a harmful share near 0% on dev.

Caveats

  • Labels come from SABER's LLM judge. The #126 spot check found some errors in both directions.
  • SABER's tasks are attack scenarios, so the safe/harmful mix differs from everyday sessions. The private set is too small to check against.
主要言語
TypeScript
スター
490
フォーク
47
平均マージ
9時間 31分
マージ済み PR（30日）
76

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

GoDiao/dreamcoder のほかの issue

GoDiao/dreamcoder の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。