Unverified50% confidenceSolutionExact time
The first-visit user Agent is prohibited from reading the source code, and a hook restricts its bash tool to only running the application, not editing or deleting code; once it can read the code, it is no longer from a first-time user's perspective.
1
Sources
50%
Confidence
Long-term
Relevance
10/22/2026
First Seen
Sources
Vercel CEO's AI Coding Workflow: 7 Key Principles
bilibili混子州10/21/2026
Related Entities
Related Claims
Unverifiedmanagents' design of reading only metadata and not touching code content gives the helper program a very narrow permission boundary, making it difficult to steal source code even if it is maliciously invoked.68% similarUnverifiedIn auto mode, a one-time prompt will appear before reading files outside the working directory for the first time, and users can block such reads via permissions.blockReadsOutsideWorkingDirectories.66% similarUnverifiedIn the OpenCode official documentation, both the .env protection example and the company.guard example register an execute.before hook only for the read tool, and do not intercept the behavior of reading files via shell commands (such as cat).65% similarUnverifiedIDE打开项目属于读取操作，不应触发任意代码执行65% similarUnverifiedWhen running an Agent, a separate user, a separate directory, and zero credentials should be used, for example implemented through Docker parameters such as --user, --cap-drop ALL, and --read-only.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1087787API
curl https://kongchang.com/api/v1/knowledge/claims/1087787MCP
get_claim(id=1087787)