vikingowl ea4996c663 feat: add permission system with 6 modes and compound command parsing ...

6 permission modes:
- default: prompt for every tool invocation
- accept_edits: auto-allow file ops, prompt for bash/destructive
- bypass: allow everything (deny rules still enforced)
- deny: deny all unless explicit allow rule
- plan: read-only tools only
- auto: auto-allow read-only, prompt for writes

7-step decision flow: deny rules (bypass-immune) → safety checks
(.env, .git, credentials, ssh keys) → bypass → allow rules →
mode-specific → prompt.

Compound bash command decomposition via mvdan.cc/sh AST parser.
Splits on && and || but preserves pipes as single units.
Deny from any subcommand denies the entire compound.

15 permission tests.

2026-04-03 14:58:14 +02:00

1.3 KiB

Raw Blame History

View Raw