auto-mode classifier flags 'coily ops gh' as gh:* deny circumvention #43

New issue

Open

opened 2026-05-23 20:54:01 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-23 20:54:01 +00:00

Owner

Originally filed by @coilysiren on 2026-05-14T09:03:55Z - https://github.com/coilysiren/coily/issues/159

The Claude Code auto-mode classifier blocks coily ops gh ... with:

Permission for this action was denied by the Claude Code auto mode classifier. Reason: User deny rule blocks `gh:*`; the agent is routing through `coily ops gh` with env-var prefix to circumvent the deny rule.

That's exactly backwards. coily ops gh is the sanctioned route. The bare gh:* deny exists because coily ops gh is what we want agents to use. The classifier treats the audited wrapper as evasion of the rule the wrapper was designed to enforce.

Repro today (2026-05-14):

Bare `gh issue create ...` denied by user deny rule (expected).
`COILY_COMMIT_SCOPE=... coily ops gh issue create ...` denied by auto-mode classifier as circumvention.
After explicit user re-authorization in chat, the same command ran fine.

#99 persistent issue with `coily ops gh issue create` specifically
#126 Denial messages should carry the reason, not just the recovery
#61 Claude Code denies raw gh 113 times in 35d while `coily ops gh` exists; permission denial doesn't name the wrapper
#115 lockdown template: pair every coily-wrapped verb with a Bash(coily :*) allow rule

Possible fixes:

Lockdown template should ship a positive allow rule for `coily ops gh:*` so the classifier sees an explicit allow, not just absence of deny (this is the #115 shape).
Classifier prompt / heuristic needs an exception: a wrapper binary whose stated purpose is to enforce the deny rule is not circumvention. Could be a signal coily emits in its lockdown profile.
Denial message could name the sanctioned wrapper (#126), reducing the temptation to retry with prefixes that look like evasion.

The cost is real: every issue-first commit hits this, and the workaround is asking Kai to re-authorize in chat, which is exactly the kind of prompt-noise the lockdown was supposed to eliminate.

_Originally filed by @coilysiren on 2026-05-14T09:03:55Z - [https://github.com/coilysiren/coily/issues/159](https://github.com/coilysiren/coily/issues/159)_ The Claude Code auto-mode classifier blocks `coily ops gh ...` with: > Permission for this action was denied by the Claude Code auto mode classifier. Reason: User deny rule blocks \`gh:*\`; the agent is routing through \`coily ops gh\` with env-var prefix to circumvent the deny rule. That's exactly backwards. `coily ops gh` is the sanctioned route. The bare `gh:*` deny exists *because* coily ops gh is what we want agents to use. The classifier treats the audited wrapper as evasion of the rule the wrapper was designed to enforce. Repro today (2026-05-14): 1. Bare \`gh issue create ...\` denied by user deny rule (expected). 2. \`COILY_COMMIT_SCOPE=... coily ops gh issue create ...\` denied by auto-mode classifier as circumvention. 3. After explicit user re-authorization in chat, the same command ran fine. Related: - #99 persistent issue with \`coily ops gh issue create\` specifically - #126 Denial messages should carry the reason, not just the recovery - #61 Claude Code denies raw gh 113 times in 35d while \`coily ops gh\` exists; permission denial doesn't name the wrapper - #115 lockdown template: pair every coily-wrapped verb with a Bash(coily <verb>:*) allow rule Possible fixes: - Lockdown template should ship a positive allow rule for \`coily ops gh:*\` so the classifier sees an explicit allow, not just absence of deny (this is the #115 shape). - Classifier prompt / heuristic needs an exception: a wrapper binary whose stated purpose is to enforce the deny rule is not circumvention. Could be a signal coily emits in its lockdown profile. - Denial message could name the sanctioned wrapper (#126), reducing the temptation to retry with prefixes that look like evasion. The cost is real: every issue-first commit hits this, and the workaround is asking Kai to re-authorize in chat, which is exactly the kind of prompt-noise the lockdown was supposed to eliminate.

coilysiren referenced this issue

2026-05-23 20:54:04 +00:00

YAML source-of-truth for Factorio mod-list / player-data / *.json server config #60

coilysiren added the

label

2026-05-31 01:52:46 +00:00

coilysiren added

and removed

labels

2026-05-31 06:59:50 +00:00