Development record
An agent's `rm -f "$VAR"/*` triggers the host's own dangerous-rm permission prompt ("possibly-empty variable path ... rewrite it as "${VAR:?}"/* or use a literal path"), even with permissions skipped. The person cannot tell whether the variable is empty and cannot make the agent take the suggested form, so they must approve blind. abcd's guard allows the shape today, and sub-agents never receive the injected SHELL rules, so nothing steers an agent away from it. Reported by the product thinker on 2026-10-09 from two prompts raised by a review sub-agent.
issueresolvedminoriss-2610091942156774
An agent's rm -f "$VAR"/* triggers the host's own dangerous-rm permission prompt ("possibly-empty variable path ... rewrite it as "${VAR:?}"/* or use a literal path"), even with permissions skipped. The person cannot tell whether the variable is empty and cannot make the agent take the suggested form, so they must approve blind. abcd's guard allows the shape today, and sub-agents never receive the injected SHELL rules, so nothing steers an agent away from it. Reported by the product thinker on 2026-10-09 from two prompts raised by a review sub-agent.
Frontmatter
| id | iss-2610091942156774 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610091942156774-guard-allows-rm-on-unguarded-variable.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610151422111866The brief at .abcd/development/brief/05-internals/01-agents.md:98 says: A cold-reading definition holds five parts (## Object, ## Question, ## The blindness core, ## Regime, ## Item shape), and a test asserts exactly that composition. The shipped surface differs: All four agents/cold-reading-*.md carry a sixth top-level section, '## Shell commands the guard refuses' (the guard-lessons block added under iss-2610091942156774, noted in internal/core/reading/definitions_test.go). No test asserts an exact five-part composition: definitions_test.go fetches the named sections individually and asserts exactly one fenced JSON block in Item shape, so a sixth section passes. (v0.14.2 release crosscheck, false-claim, raised by opus in a33.)