hubcio commented on PR #4244: URL: https://github.com/apache/iggy/pull/4244#issuecomment-5759587009
@justinmclean thanks, fixed. the bot no longer runs any PR code: no rust toolchain, no serena, no rtk, no plugin, no hooks, no cache. the agent runs claude with --restricted and --tools "Read,Grep,Glob,Write,Agent", so there is no bash anywhere (subagents included), file access ends at the checkout plus one dir of its own, and one Edit allow rule with --permission-prompts none denies every other write. the key stays in the step env, which the agent cannot read without a shell. simple english rules moved into comment-style.md, the control file snapshot is gone. on your list: build.rs and .cargo/config.toml have nothing that executes them, a forged findings.json needs code that runs and none does, and cache-mode is moot since no cache action is left. prompt injection stays a model-level thing, a misled model can still only read the tree and write its own dir. verified the fence locally with the same flags and ran it on my fork: 8 min instead of 17, about $0.20 per run, review posted fine. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
