| ▲ | sReinwald an hour ago |
| "That's the model running a command nobody asked for, and OpenCode doesn't stop to confirm." Well, yes, because you invoked OpenCode with the --auto flag telling it not to stop for confirmation. |
|
| ▲ | FeepingCreature an hour ago | parent [-] |
| No, opencode allows bash by default. |
| |
| ▲ | sReinwald 31 minutes ago | parent [-] | | OpenCode also defaults to ask for external_directory, which applies to bash commands touching paths outside the workspace. sre on archlinux 10.0.0.193 ~/opencode-test took 0s
opencode run "use bash to touch an empty txt file in my home dir"
> build · moonshotai/kimi-k3
! permission requested: external_directory (/home/sre/*); auto-rejecting
touch ~/empty.txt && ls -la ~/empty.txt failed
Error: The user rejected permission to use this specific tool call.
sre on archlinux 10.0.0.193 ~/opencode-test took 0s
opencode run --auto "use bash to touch an empty txt file in my home dir"
> build · moonshotai/kimi-k3
$ touch ~/empty.txt && ls -l ~/empty.txt
-rw-r--r-- 1 sre sre 0 Aug 24 10:34 /home/sre/empty.txt
Done — created `/home/sre/empty.txt` (0 bytes).
The obvious question would be: why include --auto in the PoC at all if it's supposedly superfluous? | | |
| ▲ | akoboldfrying 5 minutes ago | parent [-] | | Getting around that external_directory check looks trivial, though. You could ask it to run, e.g., the result of decoding a base64-encoded command that writes outside the current directory, or simply the result of concatenating two strings that together specify a file outside the current directory, etc., etc. |
|
|
