Add per-repo opt-out marker for devcontainer host-protection hooks - #30
Merged
Conversation
Introduce a .devcontainer-mcp-disable marker file at the repo root that disables both the devcontainer-guard (PreToolUse) and devcontainer-skill-loader (SessionStart) hooks when present. This lets stale or unmaintained .devcontainer configs be treated as non-blocking so the agent can work directly on the host, without weakening the default protection for repos that don't opt out. Documented in README (new Host Protection & Opt-Out section) and SKILL.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a file-based opt-out so a stale or unmaintained
.devcontainerno longer forces all work through the MCP tools.Dropping a
.devcontainer-mcp-disablemarker file at the repo root now disables both host-protection hooks for that repo:devcontainer-guard(PreToolUse) — allows host commands through instead of blocking them.devcontainer-skill-loader(SessionStart) — skips injecting the container-only SKILL.md context.Default behavior is unchanged for repos without the marker: the guard stays on whenever
.devcontainer/devcontainer.jsonexists.Why
It gets annoying when a repo ships a
.devcontainerthat isn't maintained or isn't the way forward — the guard still forces everything into containers. This gives a lightweight per-repo escape hatch while keeping protection on by default.Changes
.github/hooks/devcontainer-guard.sh— return "allow" when the marker exists (checked right after thedevcontainer.jsonpresence check); header docs updated..github/hooks/devcontainer-skill-loader.sh— skip context injection when the marker exists; header docs updated.README.md— new Host Protection & Opt-Out section documenting both hooks, the marker, the fail-open behavior, and the existingUSER_CONFIRMED_HOST_OPERATION=1one-off bypass.SKILL.md— opt-out note in Core Rules.Testing
Verified with crafted hook payloads against both a temp dir and this repo's own path (which has a
.devcontainer):npm testis denied (guard active).gitremains allowlisted regardless.The one-off
USER_CONFIRMED_HOST_OPERATION=1bypass still works and is unchanged.