fix(guardrails): OC-D1 stale dynamic-path test now asserts allowed (accepted C15 limitation) - #41371
Closed
terisuke wants to merge 200 commits into
Closed
fix(guardrails): OC-D1 stale dynamic-path test now asserts allowed (accepted C15 limitation)#41371terisuke wants to merge 200 commits into
terisuke wants to merge 200 commits into
Conversation
…l-pr fix: sync upstream guardrail runtime and tests
…l-runtime-fixes fix: sign macOS builds and harden team runtime
…owups fix: harden runtime path and team diagnostics
…e-hardening [codex] Fix team worker absolute path isolation
…60421 Sync upstream dev and fix ESM bin wrapper
…patch-fix [codex] fix team isolated worktree setup
Sync fork dev with upstream
…deadlock fix(team): prevent default limit and worker recursion deadlocks
* fix team worker model routing * update guardrail model defaults * fix team worker permission propagation
…light-abort [codex] Fix team run preflight aborts
…ew-guardrail [codex] Fix external review guardrail detection
Add deepseek to enabled_providers and provider whitelist (v4 flash/pro, chat, reasoner). Keep free-tier paid map and tier recommendations in sync so connect UI can search and use DeepSeek natively.
feat(guardrails): admit native deepseek provider
docs(specs): guardrails ADR — agent-spanning anti-patterns as OpenCode mechanism
feat(guardrails): アンチパターン10件のガードを実装
feat(team): deepseek実装タスク向けidleタイムアウトを延長
migration/初期schema・version pin・OpenAPI など、同一最終状態に 一致すべき片側だけの更新を助言する。ハードブロックはせず(I)、 /ssot-check・ssot-sync skill・pin 結線テストで PR 前に検出する。 Closes #288 Co-authored-by: Cursor <cursoragent@cursor.com>
feat(guardrails): パターンKのSSOT同期ドリフトガードを追加
SKIP黙認・worktree未準備・ハーネスAPI制限・env密閉不足を、助言 plugin / command / skill / 結線ヘルパーで検出する。ハードブロック はせず(I)、反証と陰性/陽性テストを同梱する。 Closes #290 Co-authored-by: Cursor <cursoragent@cursor.com>
feat(guardrails): パターンL–Oのテスト検証信頼性ガードを追加
#292) The default primary agent (implement) declared "gh pr merge *": "deny" in its frontmatter. agent.ts merges a user-defined agent's permission AFTER the user config and Permission.evaluate is last-wins, so the deny overrode the explicit "gh pr merge *": "allow" in opencode.json — silently blocking the main session from merging despite the config granting it (pattern I over-restriction). Remove the only primary-agent deny that contradicts a config allow. Specialized primary agents (planner) keep their intentional read-only denies. Add real-file regression tests (the prior mirror fixture missed this because it evaluated implement.md in isolation, not the merged effective ruleset): the effective permission now allows gh pr merge, the falsifiable deny case still blocks, destructive denies (rm -rf / force-push / reset --hard) still hold, and planner may still self-restrict.
fix(guardrails): stop primary agent deny overriding config merge allow
…-A2/A3 block ledger
…toctou-permission fix(guardrails): path-aware secrets, toctou write-through, permission scope, block ledger
docs: OC-D5 re-land on dev (was only on fix-merge-perm-leak)
feat(guardrails): OC-D7 hygiene ignore streak auto-issue
github-actions
Bot
added
the
needs:compliance
Contributor
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 2 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
Author
|
誤って作成されたクロスフォークPR — 正しいターゲットは Cor-Incorporated/opencode の dev です。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
opencode #302 の是正。D2 修正（#298）後に旧挙動（無条件 block）を期待したままのテストが dev で赤になっていた。
変更
packages/opencode/test/plugin/guardrail-access.test.ts:207— 動的組み立てパス（.open+code/guard+rails/...）を「block される」から「allow（受容）」に改訂cmd.includes(".opencode/guardrails")）の block テストは既存テストが維持検証（反証実証）
bun test test/plugin/guardrail-access.test.ts test/plugin/guardrail-access-oc-d1.test.ts test/plugin/guardrail-git.test.tsCloses #302