feat: Allow readonly find -exec commands without permission prompt
#2829
+85
−6
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ions - Refined behavior to allow readonly `-exec` or `-execdir` commands by checking against `READONLY_COMMANDS`. - Introduced additional test cases to confirm expected handling of readonly vs. mutable operations. - Adjusted existing test formatting for consistency.
- Introduced `DANGEROUS_MID_PATTERNS` to identify unsafe patterns when they appear mid-argument. - Added logic to detect and handle these cases, ensuring stricter command validation.
- Updated logic to handle multiple `-exec` arguments, requiring confirmation if any are non-readonly. - Adjusted return behavior to reflect accurate validation outcomes. - Added test cases for mixed and readonly `-exec` scenarios.
h16rkim
changed the title
find -exec readonly commands without permission promptfind -exec commands without permission prompt
…le` helper - Unified logic for detecting dangerous patterns into a single function, reducing code complexity. - Simplified safety checks by removing redundant mid-pattern logic. - Added comprehensive test cases to validate `contains_in_middle` functionality.
h16rkim
force-pushed
the
fix/execute-bash-readonly
branch
from
a77ac45 to
78f98b4
Compare
h16rkim
commented
Sep 11, 2025
| .iter() | ||
| .any(|arg| DANGEROUS_PATTERNS.iter().any(|p| arg.contains(p))) | ||
| .any(|p| contains_but_not_ends_with(&self.command, p)) |
There was a problem hiding this comment.
If DANGEROUS_PATTERNS only appears at the end, it is no longer treated as a dangerous command.
Because these commands cannot appear at the end, or if they do, they are not dangerous commands (e.g., ;).
…_ends_with` - Improved function to better reflect its purpose of excluding patterns at the end of a string. - Adjusted logic to simplify checks and enhance clarity. - Updated test cases to align with renamed function and new scenarios.
h16rkim
force-pushed
the
fix/execute-bash-readonly
branch
from
e04bb36 to
6dc7a05
Compare
h16rkim
commented
Sep 11, 2025
| }) => | ||
| { | ||
| return true; | ||
| }, | ||
| // Check -exec commands separately to allow readonly commands |
There was a problem hiding this comment.
- when using
find + -exec, if the command following exec is readonly, no permission prompt is required. - this also works correctly when multiple
-execclauses are present.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
When using the Amazon Q Developer CLI, the LLM Agent often execute readonly file exploration commands such as:
Even with the agent config
toolSettings.execute_bash.allowReadonly = true, the CLI still asks user for permission when executing this type of command. (related documents)Root Cause
find + -execis currently treated as permission-required commands.;are treated as dangerous and require permission for security reasons.Changes
find -exechandlingfind+-exec, if the command following exec is readonly, no permission prompt is required.;) handling;is only considered dangerous when it appears in the middle of a command.;only appears at the end, it is no longer treated as a dangerous command.Related Issue
#1917
Review Notes