请勿通过公开 Issue 提交安全漏洞。
Please do NOT report security vulnerabilities via public GitHub Issues.

请将漏洞详情发送至：
Please send vulnerability details to:

novelnexusai@outlook.com

我们承诺在 72 小时内 确认收到报告，并在 14 天内 发布修复版本。
We commit to acknowledging receipt within 72 hours and releasing a fix within 14 days.

请在报告中包含以下信息 / Please include the following in your report:

• 受影响的版本 / Affected version(s)
• 复现步骤 / Steps to reproduce
• 影响评估 / Impact assessment (CVSS score if possible)
• 建议修复方案（如有）/ Suggested fix (if any)
• 是否已有公开利用代码 / Whether a public exploit exists

We follow a coordinated disclosure model:

1. Reporter submits vulnerability via email (novelnexusai@outlook.com)
2. Maintainer acknowledges within 72 hours
3. Fix developed and tested within 14 calendar days
4. CVE requested if severity warrants (CVSS >= 7.0)
5. Public advisory published alongside the patch release
6. Reporter credited in the advisory (unless anonymity requested)

Safe Harbor: We will not pursue legal action against security researchers who act in good faith and follow this disclosure policy. We consider security research conducted in accordance with this policy to be "authorized" under applicable anti-hacking laws.

loop-opencode 内置 8 层闸门 保护 agent 行为安全：
loop-opencode has a built-in 8-gate system to protect agent behavior:

Gate priority order: Lower-numbered gates fire first. All 8 gates run in the safe (L1) and auto (L2) modes. In unsafe (L3) mode, only G4 (L0-L2 hard blocks) and Permission Block are active.

G4 (Dangerous Ops Guard) implements a 5-level command classification:

• Sandbox enforcement (G5): All file writes constrained within projectRoot; system paths (/etc/, /usr/, /boot/, ~/.ssh/) hard-blocked
• Atomic writes: state.json uses 4-step protocol (tmp → fsync → rename → fsync dir), ensuring no partial writes survive crashes
• Automatic backup: .loop-opencode/state.json.bak created before every write; .bak auto-restore on corruption detection
• Gate state isolation: gate_state.json write-protected by Gate State Guard; agent reads allowed, writes denied

• Configuration file protection: Agent cannot modify opencode.json (Permission Block guard, priority 800)
• Sensitive key monitoring: 9 sensitive keys monitored (allowed_tools, command_permissions, disabled_tools, tool_whitelist, tool_blacklist, approval_policy, max_turns, safety_mode, sandbox)
• Whitelist enforcement: G3 validates install commands against known package managers only (npm, yarn, pip, cargo, gem, go)
• Confirmation gating: requireConfirmation: true returned when critical guard is triggered; agent must obtain explicit user approval

• G3 guard patterns:
  • --force flag: Hard block (npm/pip/yarn)
  • Piped installs (curl | bash): Hard block
  • eval / $(...) injection: Hard block
  • sudo prefix: Warn, block in safe mode
  • Unknown package managers: Block
• Whitelist registries: npmjs.org, pypi.org, crates.io only
• No automated global installs: -g / --global flags blocked

• File-based PID locking: .loop-opencode/.lock and .loop-opencode/.gate_lock prevent concurrent state corruption
• Watchdog monitoring: Independent Bun subprocess (ROLE=watchdog) checks:
  1. Parent heartbeat (90s staleness → alert + pause)
  2. Agent stuck detection (60s same phase → alert)
  3. Gate violation escalation (>10 accumulated blocks → escalation)
  4. Budget exhaustion (>= 95% consumed → alert)
  5. Output stagnation (state hash unchanged 30s → alert)
  6. Session timeout (total elapsed > max_cycles * 10min → alert + pause)
• Automatic cleanup: cleanupLocks() on process exit; orphan lock expiry via timeout

1. TypeScript strict mode enabled (tsconfig.json: strict: true)
2. bun run tsc --noEmit type-check before every commit
3. .editorconfig enforces consistent formatting (UTF-8, LF, 2-space tab)
4. All new features require corresponding guard tests

1. Test matrix: Ubuntu + Windows + macOS, Bun 1.1 + 1.2
2. Coverage: bun test --coverage with >= 70% line/function threshold
3. Integration tests: Separate job with 30s timeout
4. Plugin verification: All 8 guard plugins verified present in CI
5. Build: Multi-platform binary compilation (linux-x64, linux-arm64, macos-x64, macos-arm64, windows-x64)

• Lockfile-based installs: bun install --frozen-lockfile in CI
• Dev dependencies only: @types/bun, @types/node, typescript (no runtime deps)
• Bun runtime: >= 1.0.0 (includes built-in security sandboxing)

No data leaves the local machine. loop-opencode is a local-only CLI tool. It does not send telemetry, error reports, or usage data to any external service.

In case of a confirmed security incident:

1. Containment: Immediately stop all loop-opencode instances
2. Assessment: Review .loop-opencode/runs.log and gate_state.json for the attack timeline
3. Mitigation: Apply the fix and verify all 8 guard gates pass
4. Notification: If the incident involves a vulnerability, follow the disclosure policy above
5. Post-mortem: Document the root cause and update guard rules accordingly

• License: Apache-2.0 (OSI approved, no copyleft restrictions)
• Dependencies: All dev-only; no runtime dependencies = minimal supply chain risk
• SBOM: Available via bun.lockb (lockfile)
• Vulnerability scanning: Recommended to run bun audit (when available) or npm audit on the bun-types dependency

• Runtime: Bun >= 1.0.0 (JavaScript runtime with built-in security: --sandbox, --no-install)
• Type system: TypeScript 5.x (strict mode: strict: true, noUncheckedIndexedAccess, noImplicitOverride)
• File operations: Node.js fs module (constrained to project root by G5 guard)
• Testing: Bun test runner (built-in, no external test framework dependency)

All dependencies are dev dependencies only. Runtime is single-binary (Bun compile), eliminating npm dependency chain attacks at runtime.

1. 始终使用 --safe 模式用于生产环境项目 / Always use --safe mode for production projects
2. 定期审计 .loop-opencode/runs.log 检查异常行为 / Regularly audit runs.log for anomalies
3. 不要信任 --unsafe 模式下的自动提交 / Do not trust automated commits in --unsafe mode
4. 保持 opencode.json 中的 allowed_tools 最小化 / Keep allowed_tools in opencode.json minimal
5. 使用版本控制监控 opencode.json 变更 / Monitor opencode.json changes via VCS
6. 定期备份 .loop-opencode/ 目录 / Regularly back up the runtime directory
7. 限制 agent 的 session 时长 / Limit agent session duration via --max-cycles
8. 生产环境使用 dedicated 用户运行 / Run under a dedicated user account in production
9. 在 CI/CD 中启用覆盖率检查 / Enable coverage thresholds in CI/CD
10. 发生安全事件时立即检查 gate_state.json / Check gate_state.json immediately after suspected security incidents

Copyright 2026 Perry Link

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

GitHub: PerryLink
Project: loop-opencode -- Closed-Loop Development Driver
Contact: novelnexusai@outlook.com
Copyright: 2026 Perry Link
Version: 0.1.0
Last Updated: 2026-06-13