Unverified50% confidenceFactExact time
In the OpenCode official documentation, both the .env protection example and the company.guard example register an execute.before hook only for the read tool, and do not intercept the behavior of reading files via shell commands (such as cat).
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/13/2026
First Seen
Valid until: 1/11/2027
Sources
Related Entities
Related Claims
UnverifiedThe OpenCode migration table maps v1's shell.env hook to v2's ctx.shell.hook("create.before", ...), which can be used to inject variables into the command environment, but throwing an error will likewise fail the command.67% similarUnverifiedIDE打开项目属于读取操作，不应触发任意代码执行65% similarUnverifiedIn auto mode, a one-time prompt will appear before reading files outside the working directory for the first time, and users can block such reads via permissions.blockReadsOutsideWorkingDirectories.64% similarUnverifiedWindows默认隐藏已知文件类型的扩展名，导致用户创建.env文件时实际生成的是.env.txt64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1017657API
curl https://kongchang.com/api/v1/knowledge/claims/1017657MCP
get_claim(id=1017657)