Evidence record / heypi
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opt
approval.command() allows unmatched commands after opt-in. approval.command() gates nothing until the tool opts in. Its four block patterns cover rm -rf /, mkfs, shutdown and reboot; thirteen approval patterns cover curl, wget, ssh, scp, rsync, docker, kubectl, terraform, helm, git push, npm publish, pnpm publish and rm -rf. Raw-text regexes then allow everything unmatched with a Safe default reason. git -C . push does not satisfy the git-push regex. Python and gh are absent from the lists but present in the template image; the template can expose an optional GitHub token to these commands.
Channel: preview-or-beta heypi 0.3.0-beta.2. Half: defect. Date: 2026-07-21 (historical beta.0 policy); re-verified for the 2026-10-13 profile.
Operator consequence: Treat the classifier as a convenience filter, not exhaustive authorization. For consequential tools choose approval.always(), or a predicate that asks for everything outside a short known-good set. The predicate receives the current actor, but credential and network controls still belong in the runtime. A textual list cannot establish that equivalent effects through other commands are gated.
Receipt
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/packages/heypi/src/approval.ts#L88-L104
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/packages/heypi/src/approval.ts#L165-L176
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/packages/heypi/src/tool-config.ts#L30-L51
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/examples/codex-tag/index.ts#L16-L20
- https://github.com/hunvreus/heypi/blob/436da22ceab0bc4e2db133e8626649b4bf76286d/examples/codex-tag/Dockerfile#L3-L13
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opt
Source links
Primary links, including exact changelog lines when available.
- tagged commit file2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opthunvreus/heypi / packages/heypi/src/approval.ts#L88-L104tagged commit file2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opthunvreus/heypi / packages/heypi/src/approval.ts#L165-L176tagged commit file2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opthunvreus/heypi / packages/heypi/src/tool-config.ts#L30-L51tagged commit file2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opthunvreus/heypi / examples/codex-tag/index.ts#L16-L20tagged commit file2026-10-13-heypi-approval-command-allows-unmatched-commands-after-opthunvreus/heypi / examples/codex-tag/Dockerfile#L3-L13
Versioned source: run artifact