You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(shell): cc y oc arrancan en bypass/auto por defecto (absorber ccb/ocb) #42
Que los launchers por defecto arranquen en el modo de mínima fricción, sin tener que acordarme de la variante b:
cc → que use claude --dangerously-skip-permissions (lo que hoy hace ccb)
oc → que use opencode --auto (lo que ocb pretendía vía OPENCODE_DEFAULT_FLAGS)
Contexto (verificado el 2026-07-17)
Estuvimos peleando con los modos de permiso y quedó claro:
--permission-mode bypassPermissions está bloqueado en mi cuenta — se degrada silenciosamente a dontAsk. El único camino a bypass real es --dangerously-skip-permissions (el flag de ccb).
dontAsk es restrictivo en este build (deniega, no es sin-fricción). No sirve como default.
--auto de OpenCode respeta los deny explícitos (.env, secrets) — o sea, auto-aprueba todo salvo lo prohibido. Es el equivalente correcto.
Los hooks de cortex siguen mordiendo en bypass — verificado: block-destructive-ops cortó un DROP TABLE en una sesión bypass real. La red de seguridad no se pierde.
A decidir en la implementación
ccb/ocb quedan redundantes si cc/oc ya son bypass. Definir: ¿se eliminan, o se repurposean como variante "segura" (ej. cc bypass / un launcher aparte para auto/manual)?
Hoy hay un fix local (OPENCODE_DEFAULT_FLAGS="--auto" en config/env.zsh) que da el comportamiento en mi máquina. Esta issue es para bakearlo como default del repo, no depender del override local.
The verified context is excellent — bypassPermissions is blocked on the account (silently degrades to dontAsk), dontAsk denies rather than streamlines, OpenCode's --auto respects explicit denies and is the correct equivalent, and cortex hooks still bite under bypass (a real DROP TABLE was cut) — but the issue has no acceptance criteria at all, and it carries an explicit open implementation decision: what happens to ccb/ocb (delete them or repurpose them as the safe variant). The local fix (OPENCODE_DEFAULT_FLAGS="--auto" in config/env.zsh) is correctly identified as needing to become a repo default in zsh/scripts/claude-helpers.zsh. Define the ccb/ocb end state and a short criteria list (cc/oc defaults, safe variant escape hatch, hooks still enforced under bypass) and this is ready.
Item
Pass
Evidence
clear problem
yes
Concrete and verified on 2026-07-17: default launchers require remembering the b variant; the permission-mode findings (blocked bypass, restrictive dontAsk, equivalent --auto, hooks still enforced) are documented with a real enforcement example.
acceptance criteria present and testable
no
No acceptance criteria section exists; the desired end state (cc uses --dangerously-skip-permissions, oc uses --auto) is stated only in the request text, not as verifiable criteria.
scope bounded
yes
Two launchers in zsh/scripts/claude-helpers.zsh plus the fate of their ccb/ocb siblings; no broader scope.
no open questions
no
The issue's own 'A decidir en la implementación' section leaves ccb/ocb's fate (delete vs repurpose as safe variant) undecided.
Only Juan adds the status:approved label; this review is advisory.
Activity
barbatdev commentedon Oct 17, 2026
Fleet issue review (glm)
Recommendation: needs work
The verified context is excellent — bypassPermissions is blocked on the account (silently degrades to dontAsk), dontAsk denies rather than streamlines, OpenCode's --auto respects explicit denies and is the correct equivalent, and cortex hooks still bite under bypass (a real DROP TABLE was cut) — but the issue has no acceptance criteria at all, and it carries an explicit open implementation decision: what happens to ccb/ocb (delete them or repurpose them as the safe variant). The local fix (OPENCODE_DEFAULT_FLAGS="--auto" in config/env.zsh) is correctly identified as needing to become a repo default in zsh/scripts/claude-helpers.zsh. Define the ccb/ocb end state and a short criteria list (cc/oc defaults, safe variant escape hatch, hooks still enforced under bypass) and this is ready.
Only Juan adds the
status:approvedlabel; this review is advisory.