[bug] Dangerous-command rules miss standard forms: git push -f, dd with reordered args, systemctl poweroff, dead ":>" regex

[hobostay]

What happened?

The dangerous-command rules in packages/coding-agent/src/step/command-policy.ts:93-105 miss several standard, unobfuscated forms of the exact command classes they are meant to catch. Since the default permission preset is bypass ("Run ordinary tools without approval; dangerous commands still ask") and an unmatched command analyzes as ordinary and is allowed with no confirmation (decideStepToolCall, permissions.ts), these execute silently in the default configuration:

• dd bs=4M if=disk.img of=/dev/sda / dd of=/dev/sda if=/dev/zero — the copy-device rule /\bdd\s+if=/iu requires if= immediately after dd; any bs=/of= first defeats it.
• git push -f origin main / git push origin +main — destructive-git only matches --force, not -f or +refspec.
• git -C repo reset --hard / git -c x=y push --force — the regex requires the subcommand to immediately follow git, so any global option defeats all three git rules.
• systemctl poweroff / systemctl halt / init 0 — DANGEROUS_LIFECYCLE_COMMANDS only contains reboot/shutdown.
• :> /dev/sda — /\b:>\s*\/dev\//u can never match realistic input: \b before : requires a preceding word character, so only odd forms like x:> /dev/sda match. The rule is effectively dead code.

Steps to reproduce

/\bdd\s+if=/iu.test("dd bs=4M if=disk.img of=/dev/sda")   // false
// destructive-git:
/\bgit\s+(?:reset\s+--hard|clean\s+-[^\n]*f|push\s+[^\n]*--force(?:-with-lease)?)/iu.test("git push -f origin main") // false
/\b:>\s*\/dev\//u.test(":> /dev/sda")                     // false

Feeding each command through analyzeCommandPolicy returns { kind: "ordinary" }, and decideStepToolCall("run_command", ..., bypass) returns { action: "allow" } — while rm -rf ./build and git push --force correctly return confirm.

Expected behavior

Standard forms of these dangerous commands should trigger confirmation, as the bypass preset promises. Suggestions: match of=/dev/ anywhere in dd args; evaluate git via parsed argv (as isRecursiveForceRemove already does) to cover -f, +refspec, and git -C/-c prefixes; add poweroff/halt and init 0|6 to the lifecycle set; fix or drop the :> rule; add tests using each rule’s standard spellings. Happy to implement this if you’d like.

Version

main @ e411b1a

[github-actions]

This issue was auto-closed. All issues from new contributors are auto-closed by default.

Maintainers review auto-closed issues daily and reopen worthwhile ones. Issues that do not meet the quality bar in CONTRIBUTING.md will not be reopened or receive a reply.

If a maintainer replies lgtmi on one of your issues, your future issues will stay open. If a maintainer replies lgtm, your future issues and PRs will stay open. The command must be at the start of the reply (optionally after one or more @username mentions) or at the end.

See CONTRIBUTING.md.

[hobostay]

The fix is ready on my fork: https://github.com/hobostay/Step-Code/tree/fix/dangerous-command-rules .
Summary: dd/git rules moved from raw-text patterns to parsed argv (covers dd arg reordering, git push -f, +refspec, git -C/-c prefixes, --force-with-lease); lifecycle set gains poweroff/halt and init/telinit 0/6; the :> anchor is fixed so the rule actually fires. npm run check passes and the coding-agent suite is green (3487 tests), with new cases for each spelling above.