Lucas WintherandClaude Opus 5.5
219a05c039
Revise the covers spec: both links given directly, static page served by a Cloudflare Worker plus a userscript on one pure core, Bun instead of Node, and R2 rehosting with a 30-day expiry. Move the spec to docs/specs/, merge HANDOVER.md into docs/DECISIONS.md, the spec and docs/TODO.md, and add AGENTS.md, pointer files, PERMISSIONS.md and agent permission configs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
3.1 KiB
Markdown
46 lines
3.1 KiB
Markdown
# Agent permissions
|
|
|
|
Source of truth for what AI coding agents may run here. Tool files are renderings of this page:
|
|
`.claude/settings.json`, `.codex/config.toml`, `.codex/rules/project.rules`, `.gemini/settings.json`.
|
|
Change this page and every tool file in the same commit.
|
|
|
|
## Verified commands
|
|
|
|
Run in this session. Only `worked` rows may appear in a tier, a tool file, or `AGENTS.md` Commands.
|
|
|
|
| Command | Result |
|
|
|---|---|
|
|
| `git status`, `git log`, `git diff`, `git mv` | worked |
|
|
| `bun --version` | worked (1.3.14) |
|
|
| `bun test` | failed — no test files yet (no `package.json`, no code) |
|
|
| `bun install --frozen-lockfile` | not run — no `package.json` / `bun.lock` yet |
|
|
| `bunx tsc --noEmit` | not run — `typescript` not installed yet |
|
|
|
|
TODO(maintainer): confirm every row above that is not worked, once the Bun scaffold exists, then
|
|
add the verified ones to Allow here and in each tool file.
|
|
|
|
## Tiers
|
|
|
|
| Tier | Commands | Why |
|
|
|---|---|---|
|
|
| Allow | `git status`, `git diff`, `git log`, `git show`, `git branch --list`, `git rev-parse`, `git add`, `git commit` | Inspection and the dev loop; no prompt needed. |
|
|
| Ask | `git push`, `git merge`, `git rebase`, `git switch`, `git restore`, `git commit --amend`, `rm` (any); `bun add`, `bun remove`, `bun update`, `bun upgrade`; `bunx`, `npx` (download and run code, incl. `wrangler deploy`) | Leaves the machine, rewrites work, changes dependencies, or deploys — a human decides. |
|
|
| Deny | `git push --force` / `-f` / `--force-with-lease`, `git reset --hard`, `git clean`, `git add -f` / `--force`, `git commit --no-verify` / `-n`, `rm -r` / `-R` / `-rf` / `-fr` / `-Rf` / `-fR` / `--recursive`, `sudo`; reading `.env`, `.env.*`, `.dev.vars`, `secrets/**` | Destroys work, skips checks, or exposes secrets. |
|
|
|
|
## Known gaps
|
|
- Allowlists save prompts; they are not a security boundary. Use the tool's sandbox for isolation.
|
|
- Prefix rules are bypassable: `git -C dir push`, flags placed later (`git push origin main --force`),
|
|
`+refspec` pushes. Claude Code's `:*` matches at a word boundary, so each flag cluster must be
|
|
listed — which is why `git clean` is denied whole and `rm` always asks.
|
|
- Allowed test, lint, and build commands run code from the repo; an agent that can edit
|
|
`package.json` or the tests can run anything through them.
|
|
- Denying reads of `.env` / `.dev.vars` does not stop a script that opens them itself, and
|
|
git can print staged or committed secrets (`git show HEAD:.env`). `git add -f` is denied so an agent
|
|
cannot stage an ignored secret; keep real secrets out of the working tree.
|
|
- Codex: loaded only once the project is trusted; `approval_policy` here can loosen a stricter user
|
|
setting. No `allow` rules (in Codex that means "outside the sandbox"); `git add`/`git commit`
|
|
ask for escalation because `.git/` is read-only in `workspace-write`. Codex cannot deny file reads.
|
|
`--force-with-lease=<ref>`, `+refspec`, and later-placed flags only match the Ask rule.
|
|
- Gemini: ignored until the folder is trusted; `tools.exclude` is deprecated but is the only
|
|
project-level deny. No Ask tier (anything not allowed asks). Gemini cannot deny file reads.
|