Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code runs Git reset –hard origin/main against project repo every 10 mins

github.com

Post reply on HN
Print view View original

121–130 of 219 posts

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#121

Post by Twirrim »

bschwindHN wrote: post #67
jeswin wrote: post #64

Earlier quoted context omitted.

It's not a one off issue - it has happened to me a few times. It has once even force pushed to github, which doesn't allow branch protection for private personal projects. Here's an example. 1) claude will stash (despite clear instructions never to do so). 2) claude will use sed to bulk replace (despite clear instructions never to do so). sed replacements make a mess and replaces far too many files. 3) claude restore…

When will you all learn that merely "telling" an LLM not to do something won't deterministically prevent it from doing that thing? If you truly want it to never use those commands, you better be prepared to sandbox it to the point where it is completely unable to do the things you're trying to stop.

Even worse, explicitly telling it not to do something makes it more likely to do it. It's not intelligent. It's a probability machine write large. If you say "don't git push --force", that command is now part of the context window dramatically raising the probability of it being "thought" about, and likely to appear in the output.

Like you say, the only way to stop it from doing something is to make it impossible for it to do so. Shove it in a container. Build LLM safe wrappers around the tools you want it to be able to run so that when it runs e.g. `git`, it can only do operations you've already decided are fine.

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#123

Post by minitech »

0xbadcafebee wrote: post #103
kibwen wrote: post #62

Let's focus on the real issue here, which is that HN has apparently normalized the double hyphen in the title to an en dash--yes, an en dash, not even an em dash.

Article: "Major issue with most popular AI coding tool" comments: "ThE tItLe iS aI cOded !!!1"

No, the comment was pointing out that the HN platform automatically replaces `--` in titles with `–`. (I don’t know if that’s true, but that was the intent. Nothing to do with AI.)

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#124

Post by jachee »

SoftTalker wrote: post #110
unchar1 wrote: post #98

Earlier quoted context omitted.

Claude tends to disregard "NEVER do X" quite often, but funnily enough, if you tell it "Always ask me to confirm before going X", it never fails to ask you. And you can deny it every time

If it disregards "NEVER do" instructions, why would it honor your denial when it asks?

Because it’s just fancy auto-complete.

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#125

Post by ajross »

minitech wrote: post #119
ajross wrote: post #90

Earlier quoted context omitted.

It's a command line argument. The undeniably correct way to render it is with two minus signs[1] and absolutely not something non-ascii. [1] Not strictly a hyphen, which has its own unicode point (0x2010) outside of ascii. Unicode embraced the ambiguity by calling this point (0x2d) "HYPHEN-MINUS" formally, but really its only unique typographic usage is to represent subtraction.

They meant “more appropriate [than an em dash]”. And that minus sign usage of hyphen-minus isn’t unique in Unicode either – see U+2212 MINUS SIGN.

But... it's not more appropriate than an em dash for representing command line arguments? I don't see how either is any more incorrect than the other. There's a uniquely correct answer here and the em-dash is not it. Period.

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#126

Post by raddan »

repiret wrote: post #99
bruce_one wrote: post #84

Earlier quoted context omitted.

eBPF is a great tool to use for debugging this kind of thing too, e.g. [bpftrace]( https://bpftrace.org ) has an [execsnoop]( https://github.com/bpftrace/bpftrace/blob/master/tools/execs... ) script for looking at everything being exec'd on the system :-) (No need to use bpftrace, just an easy example :-) )

Or just `strace`.

Seconded. Way simpler than BPF, especially when all you want to see is syscalls.

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#127

Post by mememememememo »

throw5 wrote: post #77
mememememememo wrote: post #52

As a side note. Always configure remote to reject any kind of trunk push. And ideally any forced push on branches.

This! The safeguards need to be outside LLM and they need to be deterministic. Now I wish I could reject `git reset --hard` on my local system somehow.

Sounds like you care about data stored on your filesystem! Take one step back and solve that problem. Use a proper isolated sandbox, e.g. Github workspace on an account that is working with a fork.

Care about the data in that workspace? Push it first.

Othwerwise it is a cat and mouse game of whackamole.

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#128

Post by SpicyLemonZest »

petcat wrote: post #96
addandsubtract wrote: post #24

Earlier quoted context omitted.

The rules and permissions are no longer program flags, but plain text for the agent to "obey".

That's not what tool use permissions are. The LLM doesn't just magically spawn processes or run code. The Claude Code program itself does those things when the LLM indicates that it wants to. The program has checks and permissions whether those things will be done or not.

Claude Code has a sandboxing functionality that works the way you're describing when you opt into it, but my understanding is that the Claude Code program in the default configuration does not second-guess the LLM's decisions on what it'd like to run. Has Anthropic said something to the contrary?

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#129

Post by SpicyLemonZest »

jatora wrote: post #72
SpicyLemonZest wrote: post #36

Earlier quoted context omitted.

Who knows whether permissions would prevent this? Anthropic's documentation on permissions ( https://code.claude.com/docs/en/permissions ) does not describe how permissions are enforced; a slightly uncharitable reading of "How permissions interact with sandboxing" suggests that they are not really enforced and any prompt injection can circumvent them.

With hooks you can enforce permissions much more concretely.

Perhaps they're more functional. Hooks are configured in the same settings file, which makes me pretty skeptical in the absence of explicit confirmation that they represent a stronger security boundary. (But of course, this is a fundamental challenge with LLM agent security - if you're using a well-aligned model that doesn't want to be prompt injected, how do you go about auditing something like this?)

Re: Claude Code runs Git reset –hard origin/main against project repo every 10 mins

#130

Post by minitech »

ajross wrote: post #125
minitech wrote: post #119

Earlier quoted context omitted.

They meant “more appropriate [than an em dash]”. And that minus sign usage of hyphen-minus isn’t unique in Unicode either – see U+2212 MINUS SIGN.

But... it's not more appropriate than an em dash for representing command line arguments? I don't see how either is any more incorrect than the other. There's a uniquely correct answer here and the em-dash is not it. Period.

It’s about the top-level comment’s horror that ”--” was substituted with “an en dash, not even an em dash”. If you’re picking a substitution for “--”, en dash makes more sense. The comment you originally replied to had already agreed “that it should be left as a double hyphen”.
Post reply on HN