tools(agent-loop): Grok Gitea calls via fixed gitea.ps1; drop open powershell -Command allow

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Ad9rqAB8pXXvyzh7f4X8v

tools/agent-loop/gitea.ps1

@@ -0,0 +1,46 @@
+# Gitea issue wrapper for the Grok /loop session (Windows). The allowlist permits
+# only this script, not arbitrary PowerShell, so the session cannot read the
+# token or run other commands through it. ASCII only (PowerShell 5.1 reads
+# BOM-less scripts as ANSI); Chinese label names arrive as arguments.
+#   gitea.ps1 whoami
+#   gitea.ps1 issues <label1,label2>      open issues carrying ALL labels, oldest first (JSON)
+#   gitea.ps1 issue <N>                   number, title, body (body only if written by the owner)
+#   gitea.ps1 labels <N>                  label names, one per line
+#   gitea.ps1 add-label <N> <name>
+#   gitea.ps1 remove-label <N> <name>
+#   gitea.ps1 comments <N>                owner's comments only (JSON: created_at, body)
+#   gitea.ps1 comment <N> <file>          post a UTF-8 file as a comment
+param([Parameter(Mandatory = $true)][string]$Cmd, [string]$A1, [string]$A2)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$Utf8  = New-Object Text.UTF8Encoding $false
+$Base  = 'https://git.copse.top/api/v1'
+$Api   = "$Base/repos/root/Jyotisha"
+$Token = ([IO.File]::ReadAllText((Join-Path $HOME '.config\jyotisha-agent\gitea-token'))).Trim()
+
+function Call([string]$Method, [string]$Url, $Body = $null) {
+  $p = @{ Uri = $Url; Method = $Method; UseBasicParsing = $true; Headers = @{ Authorization = "token $Token" } }
+  if ($null -ne $Body) {
+    $p.Body = $Utf8.GetBytes(($Body | ConvertTo-Json -Depth 10 -Compress))
+    $p.ContentType = 'application/json; charset=utf-8'
+  }
+  $text = $Utf8.GetString((Invoke-WebRequest @p).RawContentStream.ToArray())
+  if ($text) { $text | ConvertFrom-Json } else { $null }
+}
+function Owner { (Call GET "$Base/user").login }
+function LabelId([string]$name) { (@(Call GET "$Api/labels?limit=100") | Where-Object { $_.name -eq $name } | Select-Object -First 1).id }
+function Json($o) { $o | ConvertTo-Json -Depth 10 }
+
+switch ($Cmd) {
+  'whoami'       { Owner }
+  'issues'       { Json @(@(Call GET "$Api/issues?state=open&type=issues&limit=50&labels=$([uri]::EscapeDataString($A1))") |
+                     Sort-Object created_at | ForEach-Object { [ordered]@{ number = $_.number; title = $_.title; labels = @($_.labels | ForEach-Object { $_.name }) } }) }
+  'issue'        { $o = Owner; $i = Call GET "$Api/issues/$A1"
+                   Json ([ordered]@{ number = $i.number; title = $i.title; body = $(if ($i.user.login -eq $o) { $i.body } else { '' }) }) }
+  'labels'       { @(Call GET "$Api/issues/$A1/labels") | ForEach-Object { $_.name } }
+  'add-label'    { Call POST "$Api/issues/$A1/labels" @{ labels = @($A2) } | Out-Null; "added $A2" }
+  'remove-label' { $id = LabelId $A2; if ($id -and (@(Call GET "$Api/issues/$A1/labels") | Where-Object { $_.id -eq $id })) { Call DELETE "$Api/issues/$A1/labels/$id" | Out-Null }; "removed $A2" }
+  'comments'     { $o = Owner; Json @(@(Call GET "$Api/issues/$A1/comments") | Where-Object { $_.user.login -eq $o } | ForEach-Object { [ordered]@{ created_at = $_.created_at; body = $_.body } }) }
+  'comment'      { Call POST "$Api/issues/$A1/comments" @{ body = [IO.File]::ReadAllText($A2, [Text.Encoding]::UTF8) } | Out-Null; "commented on #$A1" }
+  default        { throw "unknown command: $Cmd" }
+}

tools/agent-loop/grok-permissions.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Allowlist for an unattended Grok session. Do not use bypassPermissions. This machine's ~/.grok/config.toml sets permission_mode=always-approve, and CLI overrides that for the process, so the session must be started with --permission-mode dontAsk plus one --allow or --deny per string below. grok --help names the flags as --allow <RULE> and --deny <RULE>. Verified on this machine: Bash(cmd:*) is a prefix rule (Bash(docker info:*) allowed docker info; Bash(git status:*) did not allow docker ps, which dontAsk cancelled). A bare Read/Edit/Write/Glob/Grep allows that tool. /loop has no permission flags of its own; write it as /loop 15m <prompt> (Ns, Nm, Nh, or Nd; under 60s is raised to 60s). It fires immediately in a subagent that inherits this session mode. A powershell -Command is one shell segment, so git deny rules do not see a push hidden inside it; the session pre-push hook is what refuses anything other than refs/heads/codex/*.",
+  "_comment": "Allowlist for an unattended Grok session. Do not use bypassPermissions. This machine's ~/.grok/config.toml sets permission_mode=always-approve, and CLI overrides that for the process, so the session must be started with --permission-mode dontAsk plus one --allow or --deny per string below. grok --help names the flags as --allow <RULE> and --deny <RULE>. Verified on this machine: Bash(cmd:*) is a prefix rule (Bash(docker info:*) allowed docker info; Bash(git status:*) did not allow docker ps, which dontAsk cancelled). A bare Read/Edit/Write/Glob/Grep allows that tool. /loop has no permission flags of its own; write it as /loop 15m <prompt> (Ns, Nm, Nh, or Nd; under 60s is raised to 60s). It fires immediately in a subagent that inherits this session mode. Arbitrary powershell -Command is NOT allowed (2026-10-13 review): a push or token read hidden inside it would escape every rule. Gitea calls go through the fixed wrapper %USERPROFILE%\\.jyotisha-agent\\bin\\gitea.ps1 only. The session pre-push hook still refuses anything other than refs/heads/codex/*.",
   "mode": "dontAsk",
   "allow": [
     "Read",
@@ -20,7 +20,7 @@
     "Bash(git fetch:*)",
     "Bash(git checkout:*)",
     "Bash(git push origin HEAD:refs/heads/codex/*)",
-    "Bash(powershell -NoProfile -Command:*)",
+    "Bash(powershell -NoProfile -ExecutionPolicy Bypass -File C:\\Users\\74082\\.jyotisha-agent\\bin\\gitea.ps1:*)",
     "Bash(npm run lint:*)",
     "Bash(npm run test:db:*)",
     "Bash(node node_modules/tsx/dist/cli.mjs --test:*)",

tools/agent-loop/prompts/loop-grok.md

@@ -9,8 +9,10 @@ Grok 侧与 Claude 侧对称：在一个常开的 Grok Build 会话里跑 `/loop
 首次（以及钩子更新后）复制一次：
 
 ```powershell
-New-Item -ItemType Directory -Force "$HOME\.jyotisha-agent\hooks\grok" | Out-Null
+$src = "G:\Ferti\Jyotisha\.worktrees\agent-loop\tools\agent-loop"
-Copy-Item -Force G:\Ferti\Jyotisha\.worktrees\agent-loop\tools\agent-loop\hooks\grok\pre-push "$HOME\.jyotisha-agent\hooks\grok\pre-push"
+New-Item -ItemType Directory -Force "$HOME\.jyotisha-agent\hooks\grok", "$HOME\.jyotisha-agent\bin" | Out-Null
+Copy-Item -Force "$src\hooks\grok\pre-push" "$HOME\.jyotisha-agent\hooks\grok\pre-push"
+Copy-Item -Force "$src\gitea.ps1" "$HOME\.jyotisha-agent\bin\gitea.ps1"
 ```
 
 每次开会话：
@@ -21,7 +23,11 @@ $env:PATH = "D:\Program Files\Git\bin;" + $env:PATH
 $env:GIT_CONFIG_COUNT = "1"
 $env:GIT_CONFIG_KEY_0 = "core.hooksPath"
 $env:GIT_CONFIG_VALUE_0 = "$HOME\.jyotisha-agent\hooks\grok"
-grok
+$perm = Get-Content -Raw -Encoding UTF8 tools\agent-loop\grok-permissions.json | ConvertFrom-Json
+$grokArgs = @('--permission-mode', $perm.mode)
+foreach ($r in $perm.allow) { $grokArgs += @('--allow', $r) }
+foreach ($r in $perm.deny)  { $grokArgs += @('--deny', $r) }
+grok @grokArgs
 ```
 
 验证钩子生效（应被拒）：`git push --dry-run origin HEAD:refs/heads/main`（目标与 HEAD 相同时 git 不调钩子，所以用 main）。
@@ -29,5 +35,10 @@ grok
 ## 粘贴的提示词（每 15 分钟）
 
 ```
-/loop 15m 盯一下 Gitea 上同时带 agent/待执行 和 agent/试点 标签的 issue（用 PowerShell 调 Gitea API，令牌在 %USERPROFILE%\.config\jyotisha-agent\gitea-token，绝不输出令牌）。只看 jesse 账号写的评论，别人写的一律不理。有活就取最老的一单：先加 agent/执行中 锁标签；从最新一条首行是 <!-- agent:claude plan ... --> 或 <!-- agent:claude review ... verdict=fail ... --> 的评论里读出 brief= 和 branch=；在当前工作树 git fetch 后检出这个分支（远端已有就基于远端，没有就基于 origin/staging）；然后严格按 tools/agent-loop/prompts/grok-execute.md 实现、自测、只推这个 codex 分支。做完发一条评论，首行是 <!-- agent:grok report branch=<分支> sha=<推送后远端 40 位 SHA> -->，下面写中文回报；把状态标签换成 agent/待验收，去掉锁标签。需要产品决定的，首行写 <!-- agent:grok decision -->，标签换成 agent/需拍板 并 @jesse。永远不推 staging 和 main，不删分支，不加 --no-verify。评论写给不懂代码的人看，不写任何用户个人资料。没有可处理的 issue 就什么都不做。
+/loop 15m 盯一下 Gitea 上同时带 agent/待执行 和 agent/试点 标签的 issue（Gitea 一律只用 `powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\74082\.jyotisha-agent\bin\gitea.ps1 <命令>`：issues、issue、labels、add-label、remove-label、comments、comment，用法见脚本开头；评论先写成 UTF-8 文件再用 comment 发）。（gitea.ps1 只返回 jesse 账号写的正文和评论。）有活就取最老的一单：先加 agent/执行中 锁标签；从最新一条首行是 <!-- agent:claude plan ... --> 或 <!-- agent:claude review ... verdict=fail ... --> 的评论里读出 brief= 和 branch=；在当前工作树 git fetch 后检出这个分支（远端已有就基于远端，没有就基于 origin/staging）；然后严格按 tools/agent-loop/prompts/grok-execute.md 实现、自测、只推这个 codex 分支。做完发一条评论，首行是 <!-- agent:grok report branch=<分支> sha=<推送后远端 40 位 SHA> -->，下面写中文回报；把状态标签换成 agent/待验收，去掉锁标签。需要产品决定的，首行写 <!-- agent:grok decision -->，标签换成 agent/需拍板 并 @jesse。永远不推 staging 和 main，不删分支，不加 --no-verify。评论写给不懂代码的人看，不写任何用户个人资料。没有可处理的 issue 就什么都不做。
 ```
+
+## 注意
+
+- 会话里的 `/loop` 7 天后过期，每周重开一次会话并重新粘贴（Claude 侧同理）。
+- 白名单不放行任意 `powershell -Command`：那样藏在里面的推送或读令牌会绕过所有规则。Gitea 只能经 `gitea.ps1`。