root/Jyotisha
1
0
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

tools(agent-loop): Grok Gitea calls via fixed gitea.ps1; drop open powershell -Command allow

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Ad9rqAB8pXXvyzh7f4X8v
This commit is contained in:
Jesse_Chen
2026-10-13 12:42:49 +08:00
co-authored by Claude Opus 5.5
parent 7e298419a4
commit 941b06c193
3 changed files with 63 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/agent-loop/grok-permissions.json
+2 -2
View File
@@ -1,5 +1,5 @@
{
"_comment": "Allowlist for an unattended Grok session. Do not use bypassPermissions. This machine's ~/.grok/config.toml sets permission_mode=always-approve, and CLI overrides that for the process, so the session must be started with --permission-mode dontAsk plus one --allow or --deny per string below. grok --help names the flags as --allow <RULE> and --deny <RULE>. Verified on this machine: Bash(cmd:*) is a prefix rule (Bash(docker info:*) allowed docker info; Bash(git status:*) did not allow docker ps, which dontAsk cancelled). A bare Read/Edit/Write/Glob/Grep allows that tool. /loop has no permission flags of its own; write it as /loop 15m <prompt> (Ns, Nm, Nh, or Nd; under 60s is raised to 60s). It fires immediately in a subagent that inherits this session mode. A powershell -Command is one shell segment, so git deny rules do not see a push hidden inside it; the session pre-push hook is what refuses anything other than refs/heads/codex/*.",
"_comment": "Allowlist for an unattended Grok session. Do not use bypassPermissions. This machine's ~/.grok/config.toml sets permission_mode=always-approve, and CLI overrides that for the process, so the session must be started with --permission-mode dontAsk plus one --allow or --deny per string below. grok --help names the flags as --allow <RULE> and --deny <RULE>. Verified on this machine: Bash(cmd:*) is a prefix rule (Bash(docker info:*) allowed docker info; Bash(git status:*) did not allow docker ps, which dontAsk cancelled). A bare Read/Edit/Write/Glob/Grep allows that tool. /loop has no permission flags of its own; write it as /loop 15m <prompt> (Ns, Nm, Nh, or Nd; under 60s is raised to 60s). It fires immediately in a subagent that inherits this session mode. Arbitrary powershell -Command is NOT allowed (2026-10-13 review): a push or token read hidden inside it would escape every rule. Gitea calls go through the fixed wrapper %USERPROFILE%\\.jyotisha-agent\\bin\\gitea.ps1 only. The session pre-push hook still refuses anything other than refs/heads/codex/*.",
"mode": "dontAsk",
"allow": [
"Read",
@@ -20,7 +20,7 @@
"Bash(git fetch:*)",
"Bash(git checkout:*)",
"Bash(git push origin HEAD:refs/heads/codex/*)",
"Bash(powershell -NoProfile -Command:*)",
"Bash(powershell -NoProfile -ExecutionPolicy Bypass -File C:\\Users\\74082\\.jyotisha-agent\\bin\\gitea.ps1:*)",
"Bash(npm run lint:*)",
"Bash(npm run test:db:*)",
"Bash(node node_modules/tsx/dist/cli.mjs --test:*)",