UAT: TUI shell mode blocks dangerous commands instead of advising — violates spec's advisory-only requirement #6823

New issue

Open

opened 2026-04-10 02:16:44 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-10 02:16:44 +00:00

Owner

Bug Report

Feature Area: TUI — Shell Mode / Shell Danger Detection
Spec Reference: §TUI — Shell Danger Detection

Summary

The spec explicitly states that shell danger detection is "advisory only — it never prevents command execution." However, shell_exec.py's run_shell_command() silently blocks commands matched by looks_dangerous() when the confirm_dangerous callback returns False (which is always the case without CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1). This contradicts the spec's requirement that detection must be non-blocking/advisory.

Spec Requirements

Danger detection is controlled by the shell.warn_dangerous setting (default: true). The detection is advisory only — it never prevents command execution. The warning text reads: ⚠ Potentially destructive command detected.

The spec requires:

Detection → show warning (⚠ Potentially destructive command detected)
Command proceeds regardless (advisory, non-blocking)
shell.warn_dangerous = false disables the warning display, but does NOT block execution

What Was Found

File: src/cleveragents/tui/input/shell_exec.py (lines 49–68)

if looks_dangerous(command):
    confirmed = False
    if confirm_dangerous is not None:
        confirmed = confirm_dangerous(command)
    if not confirmed:
        return ShellResult(
            command=command,
            exit_code=1,
            stdout="",
            stderr="blocked dangerous shell command",  # ← BLOCKS the command!
        )

When a dangerous command is detected and the confirm_dangerous callback returns False, the command is silently blocked with exit_code=1 and no user-visible warning. The app.py passes a callback that always returns False unless CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1 is set in the environment.

The actual result in the TUI is:

User types !rm -rf /tmp/data
looks_dangerous() matches the pattern
shell_confirm returns False (env var not set)
The command silently fails: stderr: "blocked dangerous shell command"
No ⚠ warning shown, no explanation, and — most critically — the command was prevented from executing in direct violation of the spec's "advisory only" requirement.

Expected Behavior

The run_shell_command() function should NOT block dangerous commands
Instead, the TUI layer should display ⚠ Potentially destructive command detected as a warning indicator
The command should then execute normally regardless of danger level
Only when shell.warn_dangerous = false should warnings be suppressed (but execution still proceeds)

This is related to but distinct from issue #6361 (ShellSafetyService dead code). That issue covers the lack of visual warning UI. This issue covers the blocking behavior that violates the spec's "advisory only" requirement.

Steps to Reproduce (Code Analysis)

Read src/cleveragents/tui/input/shell_exec.py
Find run_shell_command(), check if looks_dangerous(command): ... if not confirmed: return ShellResult(...stderr="blocked dangerous shell command")
Read spec §TUI — Shell Danger Detection: "advisory only — it never prevents command execution"
Confirm the implementation blocks instead of warns

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area**: TUI — Shell Mode / Shell Danger Detection **Spec Reference**: §TUI — Shell Danger Detection ### Summary The spec explicitly states that shell danger detection is "advisory only — it never prevents command execution." However, `shell_exec.py`'s `run_shell_command()` silently **blocks** commands matched by `looks_dangerous()` when the `confirm_dangerous` callback returns `False` (which is always the case without `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1`). This contradicts the spec's requirement that detection must be non-blocking/advisory. ### Spec Requirements > Danger detection is controlled by the `shell.warn_dangerous` setting (default: `true`). **The detection is advisory only — it never prevents command execution.** The warning text reads: `⚠ Potentially destructive command detected`. The spec requires: - Detection → show warning (`⚠ Potentially destructive command detected`) - Command proceeds regardless (advisory, non-blocking) - `shell.warn_dangerous = false` disables the warning display, but does NOT block execution ### What Was Found **File**: `src/cleveragents/tui/input/shell_exec.py` (lines 49–68) ```python if looks_dangerous(command): confirmed = False if confirm_dangerous is not None: confirmed = confirm_dangerous(command) if not confirmed: return ShellResult( command=command, exit_code=1, stdout="", stderr="blocked dangerous shell command", # ← BLOCKS the command! ) ``` When a dangerous command is detected and the `confirm_dangerous` callback returns `False`, the command is **silently blocked** with `exit_code=1` and no user-visible warning. The `app.py` passes a callback that **always returns `False`** unless `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1` is set in the environment. The actual result in the TUI is: - User types `!rm -rf /tmp/data` - `looks_dangerous()` matches the pattern - `shell_confirm` returns `False` (env var not set) - The command silently fails: `stderr: "blocked dangerous shell command"` - No `⚠` warning shown, no explanation, and — most critically — the command was **prevented from executing** in direct violation of the spec's "advisory only" requirement. ### Expected Behavior 1. The `run_shell_command()` function should NOT block dangerous commands 2. Instead, the TUI layer should display `⚠ Potentially destructive command detected` as a warning indicator 3. The command should then execute normally regardless of danger level 4. Only when `shell.warn_dangerous = false` should warnings be suppressed (but execution still proceeds) ### Related This is related to but distinct from issue #6361 (ShellSafetyService dead code). That issue covers the lack of visual warning UI. This issue covers the blocking behavior that violates the spec's "advisory only" requirement. ### Steps to Reproduce (Code Analysis) 1. Read `src/cleveragents/tui/input/shell_exec.py` 2. Find `run_shell_command()`, check `if looks_dangerous(command): ... if not confirmed: return ShellResult(...stderr="blocked dangerous shell command")` 3. Read spec §TUI — Shell Danger Detection: "advisory only — it never prevents command execution" 4. Confirm the implementation blocks instead of warns --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

Rows
Columns