From 328dd5ab0f2bbd20fb0a89ecbc8b79a223e060f4 Mon Sep 17 00:00:00 2001 From: clever-agent Date: Sun, 3 May 2026 15:51:57 -0400 Subject: [PATCH] build: For extra protection added a deny to all sudo in bash --- .opencode/agents/async-agent-util.md | 2 ++ .opencode/agents/auto-agents.md | 2 ++ .opencode/agents/git-commit-util.md | 2 ++ .opencode/agents/git-isolator-util.md | 2 ++ .opencode/agents/git-rebase-util.md | 2 ++ .opencode/agents/implementation-supervisor.md | 2 ++ .opencode/agents/implementation-worker.md | 2 ++ .opencode/agents/issue-estimator-util.md | 2 ++ .opencode/agents/pr-merge-supervisor.md | 2 ++ .opencode/agents/pr-merge-worker.md | 2 ++ .opencode/agents/pr-review-supervisor.md | 2 ++ .opencode/agents/pr-review-worker.md | 2 ++ .opencode/agents/session-health-evaluator.md | 2 ++ .opencode/agents/session-health-full-evaluator.md | 2 ++ .opencode/agents/session-health-quick-evaluator.md | 2 ++ .opencode/agents/supervisor.md | 2 ++ .opencode/agents/task-discovery-util.md | 2 ++ .opencode/agents/tier-codex.md | 2 ++ .opencode/agents/tier-devstral-instruct.md | 2 ++ .opencode/agents/tier-gpt5-mini.md | 2 ++ .opencode/agents/tier-gpt5-nano.md | 2 ++ .opencode/agents/tier-haiku.md | 2 ++ .opencode/agents/tier-kimi.md | 2 ++ .opencode/agents/tier-o4-mini.md | 2 ++ .opencode/agents/tier-opus.md | 2 ++ .opencode/agents/tier-qwen-instruct.md | 2 ++ .opencode/agents/tier-qwen-think.md | 2 ++ .opencode/agents/tier-sonnet.md | 2 ++ 28 files changed, 56 insertions(+) diff --git a/.opencode/agents/async-agent-util.md b/.opencode/agents/async-agent-util.md index c91337db6..6c2f4e0af 100644 --- a/.opencode/agents/async-agent-util.md +++ b/.opencode/agents/async-agent-util.md @@ -117,6 +117,8 @@ permission: "*api/v1/repos/*/labels*": deny "*https://git.cleverthis.com/api/v1/repos/cleveragents/cleveragents-core/labels*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/auto-agents.md b/.opencode/agents/auto-agents.md index b55fe7238..e410f4bd5 100644 --- a/.opencode/agents/auto-agents.md +++ b/.opencode/agents/auto-agents.md @@ -121,6 +121,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-commit-util.md b/.opencode/agents/git-commit-util.md index bf5cd20b9..c1abfe40f 100644 --- a/.opencode/agents/git-commit-util.md +++ b/.opencode/agents/git-commit-util.md @@ -120,6 +120,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-isolator-util.md b/.opencode/agents/git-isolator-util.md index 27dc4ef86..848a69f0c 100644 --- a/.opencode/agents/git-isolator-util.md +++ b/.opencode/agents/git-isolator-util.md @@ -125,6 +125,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-rebase-util.md b/.opencode/agents/git-rebase-util.md index 571039776..839096a61 100644 --- a/.opencode/agents/git-rebase-util.md +++ b/.opencode/agents/git-rebase-util.md @@ -128,6 +128,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/implementation-supervisor.md b/.opencode/agents/implementation-supervisor.md index fe6fde407..f1d88c289 100644 --- a/.opencode/agents/implementation-supervisor.md +++ b/.opencode/agents/implementation-supervisor.md @@ -119,6 +119,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/implementation-worker.md b/.opencode/agents/implementation-worker.md index 5010780c4..f76e130db 100644 --- a/.opencode/agents/implementation-worker.md +++ b/.opencode/agents/implementation-worker.md @@ -133,6 +133,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/issue-estimator-util.md b/.opencode/agents/issue-estimator-util.md index 281399635..233a07c57 100644 --- a/.opencode/agents/issue-estimator-util.md +++ b/.opencode/agents/issue-estimator-util.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-merge-supervisor.md b/.opencode/agents/pr-merge-supervisor.md index cc3981d1c..adbe614a6 100644 --- a/.opencode/agents/pr-merge-supervisor.md +++ b/.opencode/agents/pr-merge-supervisor.md @@ -114,6 +114,8 @@ permission: # CRITICAL: No direct HTTP calls to the OpenCode server "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-merge-worker.md b/.opencode/agents/pr-merge-worker.md index 8920fa4bc..bea8f6c9b 100644 --- a/.opencode/agents/pr-merge-worker.md +++ b/.opencode/agents/pr-merge-worker.md @@ -123,6 +123,8 @@ permission: # CRITICAL: No direct HTTP calls to the OpenCode server "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-review-supervisor.md b/.opencode/agents/pr-review-supervisor.md index 4d0cc71f2..ab2c79af4 100644 --- a/.opencode/agents/pr-review-supervisor.md +++ b/.opencode/agents/pr-review-supervisor.md @@ -117,6 +117,8 @@ permission: # CRITICAL: No direct HTTP calls to the OpenCode server "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-review-worker.md b/.opencode/agents/pr-review-worker.md index 0fba4f368..ffd3ad4a7 100644 --- a/.opencode/agents/pr-review-worker.md +++ b/.opencode/agents/pr-review-worker.md @@ -133,6 +133,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/session-health-evaluator.md b/.opencode/agents/session-health-evaluator.md index 7ed8c8e37..f8e8ccbc8 100644 --- a/.opencode/agents/session-health-evaluator.md +++ b/.opencode/agents/session-health-evaluator.md @@ -107,6 +107,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + task: "*": deny "session-health-quick-evaluator": allow diff --git a/.opencode/agents/session-health-full-evaluator.md b/.opencode/agents/session-health-full-evaluator.md index d0d157188..4baa953bd 100644 --- a/.opencode/agents/session-health-full-evaluator.md +++ b/.opencode/agents/session-health-full-evaluator.md @@ -107,6 +107,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + task: "*": deny diff --git a/.opencode/agents/session-health-quick-evaluator.md b/.opencode/agents/session-health-quick-evaluator.md index 55b427698..f1760d876 100644 --- a/.opencode/agents/session-health-quick-evaluator.md +++ b/.opencode/agents/session-health-quick-evaluator.md @@ -106,6 +106,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + task: "*": deny diff --git a/.opencode/agents/supervisor.md b/.opencode/agents/supervisor.md index df39a1f4f..be805d0ae 100644 --- a/.opencode/agents/supervisor.md +++ b/.opencode/agents/supervisor.md @@ -120,6 +120,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/task-discovery-util.md b/.opencode/agents/task-discovery-util.md index a49c9164a..2fb1858ab 100644 --- a/.opencode/agents/task-discovery-util.md +++ b/.opencode/agents/task-discovery-util.md @@ -124,6 +124,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # No subagents needed task: "*": deny diff --git a/.opencode/agents/tier-codex.md b/.opencode/agents/tier-codex.md index f8c649cb5..a7fb21fda 100644 --- a/.opencode/agents/tier-codex.md +++ b/.opencode/agents/tier-codex.md @@ -117,6 +117,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-devstral-instruct.md b/.opencode/agents/tier-devstral-instruct.md index 1dadac82c..dd8d581be 100644 --- a/.opencode/agents/tier-devstral-instruct.md +++ b/.opencode/agents/tier-devstral-instruct.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-gpt5-mini.md b/.opencode/agents/tier-gpt5-mini.md index 463449694..2873079f4 100644 --- a/.opencode/agents/tier-gpt5-mini.md +++ b/.opencode/agents/tier-gpt5-mini.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-gpt5-nano.md b/.opencode/agents/tier-gpt5-nano.md index b2c4fd918..cfc7528d2 100644 --- a/.opencode/agents/tier-gpt5-nano.md +++ b/.opencode/agents/tier-gpt5-nano.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-haiku.md b/.opencode/agents/tier-haiku.md index 3dff4dff7..08379c839 100644 --- a/.opencode/agents/tier-haiku.md +++ b/.opencode/agents/tier-haiku.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-kimi.md b/.opencode/agents/tier-kimi.md index b85905bc4..56337f03b 100644 --- a/.opencode/agents/tier-kimi.md +++ b/.opencode/agents/tier-kimi.md @@ -117,6 +117,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-o4-mini.md b/.opencode/agents/tier-o4-mini.md index 6e4640d3b..7c9441cb0 100644 --- a/.opencode/agents/tier-o4-mini.md +++ b/.opencode/agents/tier-o4-mini.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-opus.md b/.opencode/agents/tier-opus.md index beb23e085..49cf118c0 100644 --- a/.opencode/agents/tier-opus.md +++ b/.opencode/agents/tier-opus.md @@ -117,6 +117,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-qwen-instruct.md b/.opencode/agents/tier-qwen-instruct.md index bc5039cae..ade213a7b 100644 --- a/.opencode/agents/tier-qwen-instruct.md +++ b/.opencode/agents/tier-qwen-instruct.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-qwen-think.md b/.opencode/agents/tier-qwen-think.md index 19c7cea4c..188140948 100644 --- a/.opencode/agents/tier-qwen-think.md +++ b/.opencode/agents/tier-qwen-think.md @@ -117,6 +117,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow diff --git a/.opencode/agents/tier-sonnet.md b/.opencode/agents/tier-sonnet.md index 905d66ac3..a88325eb2 100644 --- a/.opencode/agents/tier-sonnet.md +++ b/.opencode/agents/tier-sonnet.md @@ -116,6 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "sudo *": deny + # Intentionally broad — target_agent is dynamic and caller-controlled task: "*": allow