fix(settings): retire the fleet allow wildcard the harness never accepted #1263

Merged

coilyco-ops merged 2 commits from aos/claude/yq86 into main

2026-08-26 03:14:44 +00:00

coilyco-ops commented

2026-08-26 03:11:21 +00:00

Owner

Every session on every host opens with this banner:

permissions.allow: Invalid permission rule "*" was skipped:
Wildcard tool name "*" is not supported in allow rules. An allow pattern
must name the scope it widens.

BASE_ALLOWED_PERMISSIONS = ["*"] landed fleet-wide in agentic-os#1165 to drop the prompt on everything the deny list leaves open. Claude Code has never accepted it, in 2.1.221 or 2.1.246, so the rule has been inert since the day it landed and the banner is the only thing it produced.

What changes

BASE_ALLOWED_PERMISSIONS goes empty, and a new RETIRED_ALLOWED_PERMISSIONS prunes the stamped * back off converged hosts. That mirrors the deny-side retirement mechanism already in the file for exactly this case: without the prune, the dead rule sits in every ~/.claude/settings.json forever.

What does not change

Effective permissions. A --dry-run against this host resolves to the same allow, deny, and defaultMode it enforces today, minus the skipped rule:

allow: Edit(/tmp/**), Bash(*), Agent
deny:  the seven live-infra CLIs + the memory dir
defaultMode: auto

Nothing replaces the wildcard. An allow rule cannot express "everything" by design, and suppressing prompts is defaultMode's job, which stays operator-local like effortLevel.

Verification

just test tests/test_apply_base_claude_settings.py - 8 passed, including new allow-retirement and live/retired-disjoint coverage.
pre-commit run --all-files - clean. docs/native-claude-credentials.md stays at 120/120 lines.

Repo-local half in coilyco-flight-deck/infrastructure, whose .claude/settings.json carried the same dead rule.

Every session on every host opens with this banner: ``` permissions.allow: Invalid permission rule "*" was skipped: Wildcard tool name "*" is not supported in allow rules. An allow pattern must name the scope it widens. ``` `BASE_ALLOWED_PERMISSIONS = ["*"]` landed fleet-wide in agentic-os#1165 to drop the prompt on everything the deny list leaves open. Claude Code has never accepted it, in 2.1.221 or 2.1.246, so the rule has been inert since the day it landed and the banner is the only thing it produced. ## What changes `BASE_ALLOWED_PERMISSIONS` goes empty, and a new `RETIRED_ALLOWED_PERMISSIONS` prunes the stamped `*` back off converged hosts. That mirrors the deny-side retirement mechanism already in the file for exactly this case: without the prune, the dead rule sits in every `~/.claude/settings.json` forever. ## What does not change Effective permissions. A `--dry-run` against this host resolves to the same allow, deny, and `defaultMode` it enforces today, minus the skipped rule: ``` allow: Edit(/tmp/**), Bash(*), Agent deny: the seven live-infra CLIs + the memory dir defaultMode: auto ``` Nothing replaces the wildcard. An allow rule cannot express "everything" by design, and suppressing prompts is `defaultMode`'s job, which stays operator-local like `effortLevel`. ## Verification * `just test tests/test_apply_base_claude_settings.py` - 8 passed, including new allow-retirement and live/retired-disjoint coverage. * `pre-commit run --all-files` - clean. `docs/native-claude-credentials.md` stays at 120/120 lines. Repo-local half in coilyco-flight-deck/infrastructure, whose `.claude/settings.json` carried the same dead rule.

coilyco-ops added 1 commit

2026-08-26 03:11:21 +00:00

fix(settings): retire the fleet allow wildcard the harness never accepted

ci / aos-eval-tests (pull_request) Successful in 8s

Details

ci / ward-doctor (pull_request) Successful in 9s

Details

ci / aos-cli-tests (pull_request) Successful in 24s

Details

ci / gate (pull_request) Successful in 51s

Details

2a60987a0b

`BASE_ALLOWED_PERMISSIONS = ["*"]` landed fleet-wide in agentic-os#1165 to
drop the prompt on everything the deny list leaves open. Claude Code has
never accepted it. An allow rule must name the tool it widens, so the
harness skips the rule and prints a warning at every session start:

    permissions.allow: Invalid permission rule "*" was skipped:
    Wildcard tool name "*" is not supported in allow rules.

So the rule has been inert since the day it landed, and the only thing it
produced was that banner on every host.

`BASE_ALLOWED_PERMISSIONS` goes empty and `RETIRED_ALLOWED_PERMISSIONS`
prunes the stamped `*` back off converged hosts, mirroring the deny-side
retirement mechanism that already exists for exactly this case. Without
the prune the dead rule sits in every `~/.claude/settings.json` forever.

Effective permissions do not move. A dry run against this host resolves to
the same allow, deny, and defaultMode it enforces today, minus the skipped
rule. Nothing is replaced: an allow rule cannot express "everything", and
suppressing prompts is `defaultMode`'s job, which stays operator-local like
`effortLevel`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops referenced this pull request from coilyco-flight-deck/infrastructure

2026-08-26 03:11:39 +00:00

fix(claude): drop the repo-local allow wildcard the harness never accepted #944

coilyco-ops added 1 commit

2026-08-26 03:13:06 +00:00

Merge branch 'main' into aos/claude/yq86

ci / aos-eval-tests (pull_request) Successful in 7s

Details

ci / ward-doctor (pull_request) Successful in 8s

Details

ci / aos-cli-tests (pull_request) Successful in 25s

Details