Jesse_ChenandClaude Opus 5.5
941b06c193
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Ad9rqAB8pXXvyzh7f4X8v
49 lines
2.4 KiB
JSON
49 lines
2.4 KiB
JSON
{
|
|
"_comment": "Allowlist for an unattended Grok session. Do not use bypassPermissions. This machine's ~/.grok/config.toml sets permission_mode=always-approve, and CLI overrides that for the process, so the session must be started with --permission-mode dontAsk plus one --allow or --deny per string below. grok --help names the flags as --allow <RULE> and --deny <RULE>. Verified on this machine: Bash(cmd:*) is a prefix rule (Bash(docker info:*) allowed docker info; Bash(git status:*) did not allow docker ps, which dontAsk cancelled). A bare Read/Edit/Write/Glob/Grep allows that tool. /loop has no permission flags of its own; write it as /loop 15m <prompt> (Ns, Nm, Nh, or Nd; under 60s is raised to 60s). It fires immediately in a subagent that inherits this session mode. Arbitrary powershell -Command is NOT allowed (2026-10-13 review): a push or token read hidden inside it would escape every rule. Gitea calls go through the fixed wrapper %USERPROFILE%\\.jyotisha-agent\\bin\\gitea.ps1 only. The session pre-push hook still refuses anything other than refs/heads/codex/*.",
|
|
"mode": "dontAsk",
|
|
"allow": [
|
|
"Read",
|
|
"Edit",
|
|
"Write",
|
|
"Glob",
|
|
"Grep",
|
|
"Bash(git status:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git show:*)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git add:*)",
|
|
"Bash(git commit:*)",
|
|
"Bash(git rev-parse:*)",
|
|
"Bash(git ls-remote:*)",
|
|
"Bash(git ls-files:*)",
|
|
"Bash(git grep:*)",
|
|
"Bash(git fetch:*)",
|
|
"Bash(git checkout:*)",
|
|
"Bash(git push origin HEAD:refs/heads/codex/*)",
|
|
"Bash(powershell -NoProfile -ExecutionPolicy Bypass -File C:\\Users\\74082\\.jyotisha-agent\\bin\\gitea.ps1:*)",
|
|
"Bash(npm run lint:*)",
|
|
"Bash(npm run test:db:*)",
|
|
"Bash(node node_modules/tsx/dist/cli.mjs --test:*)",
|
|
"Bash(frontend\\node_modules\\.bin\\tsc:*)",
|
|
"Bash(.venv\\Scripts\\python -m pytest:*)",
|
|
"Bash(docker info:*)"
|
|
],
|
|
"deny": [
|
|
"Bash(git push --force:*)",
|
|
"Bash(git push -f:*)",
|
|
"Bash(git push --no-verify:*)",
|
|
"Bash(git push origin HEAD:main:*)",
|
|
"Bash(git push origin HEAD:refs/heads/main:*)",
|
|
"Bash(git push origin HEAD:staging:*)",
|
|
"Bash(git push origin HEAD:refs/heads/staging:*)",
|
|
"Bash(git push origin main:*)",
|
|
"Bash(git push origin staging:*)",
|
|
"Bash(git push origin --delete:*)",
|
|
"Bash(git config:*)",
|
|
"Bash(git reset --hard:*)",
|
|
"Bash(git stash:*)",
|
|
"Read(~/.config/jyotisha-agent/**)",
|
|
"Read(~/.git-credentials)"
|
|
]
|
|
}
|