[quality] attach --dangerous passes omp's '--approval-mode yolo' as a single argv token #229

Finding

pluk attach --cli=omp --dangerous launches omp with a single argv token --approval-mode yolo instead of --approval-mode + yolo.

#225 added omp: '--approval-mode yolo' to DANGEROUS_FLAGS in src/attach.ts. Every other entry is a single word, and attach() appends the flag with shellQuote(dangerFlag) (src/attach.ts:298), which single-quotes the whole string. The resulting send-keys line is:

send-keys -t =agent-o: -- 'omp' '--approval-mode yolo' Enter

The shell inside the pane therefore passes one argument containing a space; omp sees an unknown option and either errors out or ignores the approval mode, so --dangerous is silently a no-op for the one CLI it was just added for.

Reproduced on main @ 0a8dee6 with the same stub-tmux harness test/cli.test.js uses (fake tmux on PATH recording argv):

$ pluk attach agent-o --cli=omp --run-dir=$S/run --no-open --dangerous
Starting omp: 'omp' '--approval-mode yolo'
$ eval "set -- 'omp' '--approval-mode yolo'"; printf '[%s]\n' "$@"
[omp]
[--approval-mode yolo]

The same quoting is used in the "session already exists" hint (src/attach.ts:313), which does go through buildCliCommand → splitShellWords, so the two code paths already disagree with each other.

Unit evidence: test/cli.test.js "attach --dangerous appends the per-CLI danger flag" only exercises --cli=claude; nothing pins the omp flag's tokenisation. test/cli-support-matrix.test.js checks DANGEROUS_FLAGS keys against CLI_COMMANDS but not the values.

Recommendation

Fix in src/attach.ts (production code — outside the quality lane, so no PR from me). Split the flag the same way buildCliCommand already does:

    if (opts.dangerouslySkipPermissions) {
      const dangerFlag = resolveDangerousFlag(cli);
      if (dangerFlag) {
-       fullCmd += ` ${shellQuote(dangerFlag)}`;
+       fullCmd += ` ${splitShellWords(dangerFlag).map(shellQuote).join(' ')}`;
      } else {

(or, if omp accepts it, change the entry to omp: '--approval-mode=yolo' — but the splitting fix is robust for any future multi-word flag).

Then pin it in test/cli.test.js next to the claude case:

test('attach --dangerous for omp sends --approval-mode and yolo as separate words', () => {
  rmSync(tmuxLog, { force: true });
  const runDir = makeRunDir();
  const { code } = runCli(['attach', 'agent-o', '--cli=omp', `--run-dir=${runDir}`, '--no-open', '--dangerous']);
  assert.equal(code, 0);
  const calls = readFileSync(tmuxLog, 'utf-8');
  assert.match(calls, /^send-keys -t =agent-o: -- 'omp' '--approval-mode' 'yolo' Enter$/m);
});

A companion PR adds a support-matrix guard so the README --dangerous row must list every DANGEROUS_FLAGS entry with its exact flag (omp is currently missing from that row).

Priority

• Impact: high (--dangerous is broken for omp; shipped in the same change that added omp)
• Effort: low (one-line fix + one test)

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 0a8dee6

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88