Skip to content

feat(shell): cc y oc arrancan en bypass/auto por defecto (absorber ccb/ocb) #42

Open

Description

@barbatdev

Qué quiero

Que los launchers por defecto arranquen en el modo de mínima fricción, sin tener que acordarme de la variante b:

  • cc → que use claude --dangerously-skip-permissions (lo que hoy hace ccb)
  • oc → que use opencode --auto (lo que ocb pretendía vía OPENCODE_DEFAULT_FLAGS)

Contexto (verificado el 2026-07-17)

Estuvimos peleando con los modos de permiso y quedó claro:

  • --permission-mode bypassPermissions está bloqueado en mi cuenta — se degrada silenciosamente a dontAsk. El único camino a bypass real es --dangerously-skip-permissions (el flag de ccb).
  • dontAsk es restrictivo en este build (deniega, no es sin-fricción). No sirve como default.
  • --auto de OpenCode respeta los deny explícitos (.env, secrets) — o sea, auto-aprueba todo salvo lo prohibido. Es el equivalente correcto.
  • Los hooks de cortex siguen mordiendo en bypass — verificado: block-destructive-ops cortó un DROP TABLE en una sesión bypass real. La red de seguridad no se pierde.

A decidir en la implementación

  • ccb/ocb quedan redundantes si cc/oc ya son bypass. Definir: ¿se eliminan, o se repurposean como variante "segura" (ej. cc bypass / un launcher aparte para auto/manual)?
  • Hoy hay un fix local (OPENCODE_DEFAULT_FLAGS="--auto" en config/env.zsh) que da el comportamiento en mi máquina. Esta issue es para bakearlo como default del repo, no depender del override local.

cc y oc viven en zsh/scripts/claude-helpers.zsh.

Activity

  1. barbatdev commented on Oct 17, 2026

    @barbatdev
    OwnerAuthor

    Fleet issue review (glm)

    Recommendation: needs work

    The verified context is excellent — bypassPermissions is blocked on the account (silently degrades to dontAsk), dontAsk denies rather than streamlines, OpenCode's --auto respects explicit denies and is the correct equivalent, and cortex hooks still bite under bypass (a real DROP TABLE was cut) — but the issue has no acceptance criteria at all, and it carries an explicit open implementation decision: what happens to ccb/ocb (delete them or repurpose them as the safe variant). The local fix (OPENCODE_DEFAULT_FLAGS="--auto" in config/env.zsh) is correctly identified as needing to become a repo default in zsh/scripts/claude-helpers.zsh. Define the ccb/ocb end state and a short criteria list (cc/oc defaults, safe variant escape hatch, hooks still enforced under bypass) and this is ready.

    Item Pass Evidence
    clear problem yes Concrete and verified on 2026-07-17: default launchers require remembering the b variant; the permission-mode findings (blocked bypass, restrictive dontAsk, equivalent --auto, hooks still enforced) are documented with a real enforcement example.
    acceptance criteria present and testable no No acceptance criteria section exists; the desired end state (cc uses --dangerously-skip-permissions, oc uses --auto) is stated only in the request text, not as verifiable criteria.
    scope bounded yes Two launchers in zsh/scripts/claude-helpers.zsh plus the fate of their ccb/ocb siblings; no broader scope.
    no open questions no The issue's own 'A decidir en la implementación' section leaves ccb/ocb's fate (delete vs repurpose as safe variant) undecided.

    Only Juan adds the status:approved label; this review is advisory.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions