What happens
Once you tick "Always trust commands from this folder", that trust is permanent and is not tied to what the file actually said when you approved it. If someone later changes programa.json in that repo and you pull, the new commands run with no prompt. You end up having approved a file you never saw.
Trust is stored as a plain list of directory paths in ~/Library/Application Support/programa/trusted-directories.json (Sources/ProgramaDirectoryTrust.swift). There is no hash of the config and no timestamp, so there is nothing to compare against when the file changes.
Why it matters
programa.json is meant to be shared through git. That is the whole point of it: a repo carries its own workspace layouts and commands, and everyone who clones gets them. So the file is expected to change over time and to be edited by people other than whoever first approved it.
Trust granted once, for one version of the file, currently covers every future version of it.
Steps to reproduce
- Clone a repo containing a
programa.json with one harmless command
- Run that command from the command palette, ticking "Always trust commands from this folder"
- Change
programa.json to add a different command
- Run the new command from the command palette
- It runs with no confirmation
Possible fix
Pin trust to the file's contents rather than to the directory alone:
- record a SHA-256 of
programa.json when trust is granted
- compare on execute, and prompt again when it does not match
- say so in the dialog, so it reads as "this file changed since you trusted it" rather than looking like a fresh prompt out of nowhere
Verify: with a trusted repo, editing programa.json makes the next palette run prompt again, and running it unchanged still does not prompt.
Worth deciding separately whether re-trusting should be one click or should require re-reading the diff.
Context
Found while inverting the trust gate so untrusted directories always prompt. This is not caused by that change and does not block it. It limits how much "trust this folder" is actually protecting you, which matters more now that trust is the only thing that suppresses a prompt.
What happens
Once you tick "Always trust commands from this folder", that trust is permanent and is not tied to what the file actually said when you approved it. If someone later changes
programa.jsonin that repo and you pull, the new commands run with no prompt. You end up having approved a file you never saw.Trust is stored as a plain list of directory paths in
~/Library/Application Support/programa/trusted-directories.json(Sources/ProgramaDirectoryTrust.swift). There is no hash of the config and no timestamp, so there is nothing to compare against when the file changes.Why it matters
programa.jsonis meant to be shared through git. That is the whole point of it: a repo carries its own workspace layouts and commands, and everyone who clones gets them. So the file is expected to change over time and to be edited by people other than whoever first approved it.Trust granted once, for one version of the file, currently covers every future version of it.
Steps to reproduce
programa.jsonwith one harmless commandprograma.jsonto add a different commandPossible fix
Pin trust to the file's contents rather than to the directory alone:
programa.jsonwhen trust is grantedVerify: with a trusted repo, editing
programa.jsonmakes the next palette run prompt again, and running it unchanged still does not prompt.Worth deciding separately whether re-trusting should be one click or should require re-reading the diff.
Context
Found while inverting the trust gate so untrusted directories always prompt. This is not caused by that change and does not block it. It limits how much "trust this folder" is actually protecting you, which matters more now that trust is the only thing that suppresses a prompt.