mangabaka-seeder/docs/PERMISSIONS.md

Agent permissions

Source of truth for what AI coding agents may run here. Tool files are renderings of this page: .claude/settings.json, .codex/config.toml, .codex/rules/project.rules, .gemini/settings.json. Change this page and every tool file in the same commit.

Verified commands

Run in this session. Only worked rows may appear in a tier, a tool file, or AGENTS.md Commands.

Command	Result
git status, git log, git diff, git mv	worked
bun --version	worked (1.3.14)
bun test	failed — no test files yet (no package.json, no code)
bun install --frozen-lockfile	not run — no package.json / bun.lock yet
bunx tsc --noEmit	not run — typescript not installed yet

TODO(maintainer): confirm every row above that is not worked, once the Bun scaffold exists, then add the verified ones to Allow here and in each tool file.

Tiers

Tier	Commands	Why
Allow	git status, git diff, git log, git show, git branch --list, git rev-parse, git add, git commit	Inspection and the dev loop; no prompt needed.
Ask	git push, git merge, git rebase, git switch, git restore, git commit --amend, rm (any); bun add, bun remove, bun update, bun upgrade; bunx, npx (download and run code, incl. wrangler deploy)	Leaves the machine, rewrites work, changes dependencies, or deploys — a human decides.
Deny	git push --force / -f / --force-with-lease, git reset --hard, git clean, git add -f / --force, git commit --no-verify / -n, rm -r / -R / -rf / -fr / -Rf / -fR / --recursive, sudo; reading .env, .env.*, .dev.vars, secrets/**	Destroys work, skips checks, or exposes secrets.

Known gaps

• Allowlists save prompts; they are not a security boundary. Use the tool's sandbox for isolation.
• Prefix rules are bypassable: git -C dir push, flags placed later (git push origin main --force), +refspec pushes. Claude Code's :* matches at a word boundary, so each flag cluster must be listed — which is why git clean is denied whole and rm always asks.
• Allowed test, lint, and build commands run code from the repo; an agent that can edit package.json or the tests can run anything through them.
• Denying reads of .env / .dev.vars does not stop a script that opens them itself, and git can print staged or committed secrets (git show HEAD:.env). git add -f is denied so an agent cannot stage an ignored secret; keep real secrets out of the working tree.
• Codex: loaded only once the project is trusted; approval_policy here can loosen a stricter user setting. No allow rules (in Codex that means "outside the sandbox"); git add/git commit ask for escalation because .git/ is read-only in workspace-write. Codex cannot deny file reads. --force-with-lease=<ref>, +refspec, and later-placed flags only match the Ask rule.
• Gemini: ignored until the folder is trusted; tools.exclude is deprecated but is the only project-level deny. No Ask tier (anything not allowed asks). Gemini cannot deny file reads.