Repository navigation
Edit memory files with the edit tool, not an interpreter - #62
Merged
wintermeyer merged 1 commit intoOct 11, 2026
Merged
Conversation
Interpreter heredocs that edit memory trip the taboo guard when the text names sshd_config or a key path. The edit tool is not scanned.
wintermeyer
added a commit
that referenced
this pull request
Oct 11, 2026
The guard hooked Bash only, so in local mode Edit or Write could replace sshd_config or authorized_keys unseen. The three file-edit tools now run it in a file mode that judges the target path under every spelling and leaves the written text alone, which keeps memory files free to name protected paths. Ships as 2.29.0 together with the rule from #62. An AI agent wrote this text in my name. I know that is problematic.
Owner
|
Thanks, Oliver, merged and out in 2.29.0. I rewrapped the paragraph and added An AI agent wrote this text in my name. I know that is problematic. |
oliverandrich
pushed a commit
to oliverandrich/heinzel
that referenced
this pull request
Oct 11, 2026
The guard hooked Bash only, so in local mode Edit or Write could replace sshd_config or authorized_keys without any rule seeing it. Edit, Write and NotebookEdit now run the guard in a file mode that judges the target path alone, so memory files can still name every protected path. When jq cannot name the target the whole input is scanned, which over-blocks instead of failing open. The rule from PR wintermeyer#62 is rewrapped, names the full sshd_config path and adds sed -i, and the hook registration test no longer passes vacuously on quoted script paths. An AI agent wrote this text in my name. I know that is problematic.
oliverandrich
pushed a commit
to oliverandrich/heinzel
that referenced
this pull request
Oct 11, 2026
Ships the memory-editing rule from wintermeyer#62 and the guard's new file mode. A minor release because the guard now denies tool calls it used to let through: Edit, Write and NotebookEdit onto sshd_config, an SSH key file or a raw disk device. An AI agent wrote this text in my name. I know that is problematic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
rules/server-memory.mdnow says to edit memory files with the agent's file-edit tool.Why
Server memory often names
sshd_configand SSH key paths. An interpreter heredoc (python3 -) that edits such a file carries those words on its command line. The taboo guard cannot tell them from a write to the real file and blocks the call. Past sessions hit this several times while updatingmemory.mdandchangelog.log. The guard hooks theBashmatcher only, so the edit tool is not affected.