Comment by kingds
5 days ago
it feels like a clear improvement across the board but a heads up: i got bitten by upgrading - since all tool calls now go through the background process, the sandbox that i use to wrap the TUI process quietly became useless. took me a day or two to realize that web fetches, etc. which should have been blocked were succeeding.
There are at least 3 security regressions (imo) in the initial v2 release
1. configuration loading (now fixed) dropped support for system level, then restored it incorrectly, now it is better, but still some issues in user space
2. hot-reloading of plugins, agents can now change them with immediate effect
3. this, which I was unaware of
I wonder how many more there are given this much has been found already
4. Tools added by plugins don’t respect your permission config! For example you can set a tool to always ask when used, but it auto allows.
you should be able to deny it though, yea? (not common, I use this for certain subagents)
ideally that should look more like enforced preflight by the plugin system
Yeah, it is a regression IMO.
You need to run it with —standalone to properly sandbox it.
Those tools should be designed to be sandboxed.
[flagged]
[flagged]