Repository navigation
docs(permissions): explain that any { widens a pattern in overlap checks - #3846
Merged
Merged
Conversation
…hecks
Document that a pattern containing `{` (alternation, ranges, nested
braces or a `${VAR}` reference) overlaps everything in the withheld-allow
comparison, and add a regression test for a comma-less `${OUT}` restriction
that the pre-#3840 regex let through.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XcU6mYjWis3a6YpqCW2xgB
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XcU6mYjWis3a6YpqCW2xgB
# Conflicts: # src/generated/docs-content.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups from #3840, which made any pattern containing
{widen to*in the withheld-allow overlap check.docs/reference/file-formats.md: the overlap rules said only "a{a,b}alternation overlaps everything". They now say that any pattern containing{does — alternations, ranges such as{1..3}, nested braces, and${VAR}references whose value is unknown at generation time — with therm -rf ${TMPDIR}/*deny withholding agit statusallow as the example.src/generated/docs-content.tsis regenerated.shell-command-categories.test.ts: adds a regression test that the allowrm -rf buildis withheld under the denyrm -rf ${OUT}. The existing nested-brace cases mostly passed with the pre-fix(permissions): block allows shadowed by brace-range restrictions #3840 regex as well; this one fails against it (checked by temporarily restoring the old condition), so a later change that stops widening${would be caught.Item 3 of the issue (saying in the warning that a
{-containing pattern was widened) is left out on purpose: the warning already names the restriction and each withheld allow, and the docs now explain why such a restriction covers everything.Test plan
pnpm cicheckCloses #3842
🤖 Generated with Claude Code
https://claude.ai/code/session_01XcU6mYjWis3a6YpqCW2xgB