test(harness-ops): probe that an allowed gh issue view runs and a chained command after it is denied in dontAsk mode
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github, shell
- Domain
- security, testing-qa
Research direction
Start with the /harness-ops:behavior-probes entry point and the issue’s cited Claude Code permissions documentation on compound commands. Add the explicitly paired control and probe cases for the listed command forms, then run the probe in dontAsk mode and record the Claude Code version. Done means the plain gh issue view <n> is allowed and runs, while the chained forms are denied.
Written by the indexing model from the issue text.
Description
Problem
intake-triage (ci-workflows .github/workflows/intake-triage.yml:406-418, v0.49.0) runs the model with --permission-mode dontAsk and allows only Bash(gh issue view *), Bash(gh issue list *), Bash(gh search issues *) and Bash(gh label list *).
The job holds CLAUDE_CODE_OAUTH_TOKEN, and the model's environment holds an issues: write GITHUB_TOKEN (.github/actions/select-trusted-text/README.md:69-70).
Whether a compound command such as gh issue view 1 && gh issue edit 1 --add-label x, or one using ;, | or $(), is denied under those rules is untested. The GitHub Security & Cost tab accepted secret visibility only on the condition that untrusted issue text cannot reach a secrets-holding job in a way that lets it act.
Fix
Add a paired-control case to /harness-ops:behavior-probes with both cases stated explicitly. The probe does not claim gh issue view is denied.
- Control: a plain
gh issue view <n>is allowed and runs. - Probe:
gh issue view <n>; <second command>, and the&&,|and$()forms, are not approved by that rule and are denied.
The Claude Code docs, permissions, "Compound commands" (https://code.claude.com/docs/en/permissions), say: "a rule like Bash(safe-cmd *) won't give it permission to run the command safe-cmd && other-cmd ... A rule must match each subcommand independently". The probe confirms that documented behavior in dontAsk mode.
Verification
The probe passes on the current Claude Code version and is recorded with that version.
Owner decision: Issue Triage interview Q10 (2026-10-19).
- Dominant language
- Shell
- Stars
- 22
- Forks
- 2
- Avg merge
- 7h 8m
- Merged PRs (30d)
- 874
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from melodic-software/claude-code-plugins
-
needs-human
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
melodic-software/claude-code-plugins#8405 · 1 comment ·
Maintainers usually reply within 1 day
-
needs-human priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
melodic-software/claude-code-plugins#8366 · 1 comment ·
Maintainers usually reply within 1 day
-
priority: medium
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
melodic-software/claude-code-plugins#8341 · 1 comment ·
Maintainers usually reply within 1 day
-
priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
melodic-software/claude-code-plugins#8338 · 1 comment ·
Maintainers usually reply within 1 day
-
priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
melodic-software/claude-code-plugins#8321 · 1 comment ·
Maintainers usually reply within 1 day
All issues in melodic-software/claude-code-plugins
Similar issues
-
fix(backup-uploader): write current-round marker outside / so the container can run as non-rootOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
hiero-ledger/solo-containers#254 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
CachyOS/cachyos-hooks#23 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
bug cli security sev-6
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
area/cli good first issue size/S type/feature
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
lorica-labs/volant#549 ·
Maintainers usually reply within 1 day