File tools (read_file, write_file, edit_file, notebook_edit) resolve
user-supplied paths via Path.expanduser().resolve() but the permission
layer has no default deny rules for high-value credential files. In
FULL_AUTO mode — or when no path_rules are configured — the LLM can be
directed (including via prompt injection) to read ~/.ssh/id_rsa,
~/.aws/credentials, ~/.kube/config, and similar targets.
This commit adds a SENSITIVE_PATH_PATTERNS tuple to the permission
checker that is always evaluated before any other permission logic,
including the FULL_AUTO allow-all rule and the explicit allowed_tools
list. The patterns cover SSH keys, AWS/GCP/Azure credentials, GPG
keyrings, Docker/Kubernetes configs, and OpenHarness's own credential
stores.
Tests verify that:
- Sensitive paths are blocked in all three permission modes
- Write operations are also blocked, not just reads
- allowed_tools cannot bypass the protection
- Normal project files are unaffected
- Every pattern in the tuple actually matches a concrete path
A lightweight open-source Python implementation of the Agent Harness architecture.
44x lighter than Claude Code (11K vs 512K lines), 98% core tool coverage.
- 43 tools with Pydantic validation and parallel execution
- Skills system compatible with anthropics/skills (17+ tested)
- Plugin system compatible with claude-code/plugins (12+ tested)
- API retry with exponential backoff
- Multi-level permissions with path rules
- React/Ink TUI with "Oh my Harness!" branding
- 114 unit tests + 6 E2E test suites
- MIT License
tjb-tech