Lockdown-denied bare commands should inject a .coily/coily.yaml hint #24

Closed

opened 2026-05-27 22:19:00 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-27 22:19:00 +00:00

Owner

Problem

Bare npm / npx / uv / python / python3 / cargo / dotnet / make invocations get denied by the per-repo Claude Code lockdown (the permissions.deny block written by coily lockdown). The deny message is the vanilla harness "Permission to use Bash with command X has been denied" - no routing text, no pointer at .coily/coily.yaml, no mention of the "add new verbs to that file before invoking them" rule.

Net effect: agent dead-ends on a deny that has a known recovery path (add the verb to .coily/coily.yaml and re-route through coily exec / coily make / equivalent).

Sister issue: coilysiren/agent-guard#23 (the wrapper-tier sweep). This issue is the second tier from that one's "Implementation sketch" - tracked separately so it can ship independently.

Ask

agent-guard's PreToolUse hook should catch these lockdown-shaped denies and inject a generic hint:

<cmd> is denied by the repo's .coily/coily.yaml lockdown. Add the verb to that file (see agentic-os-kai/AGENTS.md "Commands" section) or invoke an existing wrapper. Run coily --tree to enumerate available wrappers in this repo.

The hint does not need to know which specific verb to add - just pointing the agent at the config file plus coily --tree is enough to break the dead-end.

Detection

Probably easiest to enumerate the set of commonly-denied build/runtime tools (npm, npx, pnpm, yarn, bun, uv, python, python3, cargo, dotnet, make, just, task, go, rake, bundle, gem) and match against the bare-command head. Open question: whether to derive the list dynamically from the repo's own .coily/coily.yaml deny block, or hardcode the common set. Hardcode probably wins on simplicity since the list is short and stable.

Out of scope

The wrapper-tier coilyRoutes sweep (tracked in #23). This issue is specifically the generic "no wrapper exists, you need to edit the lockdown config" hint.

**Problem** Bare `npm` / `npx` / `uv` / `python` / `python3` / `cargo` / `dotnet` / `make` invocations get denied by the per-repo Claude Code lockdown (the `permissions.deny` block written by `coily lockdown`). The deny message is the vanilla harness "Permission to use Bash with command X has been denied" - no routing text, no pointer at `.coily/coily.yaml`, no mention of the "add new verbs to that file before invoking them" rule. Net effect: agent dead-ends on a deny that has a known recovery path (add the verb to `.coily/coily.yaml` and re-route through `coily exec` / `coily make` / equivalent). Sister issue: coilysiren/agent-guard#23 (the wrapper-tier sweep). This issue is the second tier from that one's "Implementation sketch" - tracked separately so it can ship independently. **Ask** agent-guard's PreToolUse hook should catch these lockdown-shaped denies and inject a generic hint: > `<cmd>` is denied by the repo's `.coily/coily.yaml` lockdown. Add the verb to that file (see `agentic-os-kai/AGENTS.md` "Commands" section) or invoke an existing wrapper. Run `coily --tree` to enumerate available wrappers in this repo. The hint does not need to know which specific verb to add - just pointing the agent at the config file plus `coily --tree` is enough to break the dead-end. **Detection** Probably easiest to enumerate the set of commonly-denied build/runtime tools (npm, npx, pnpm, yarn, bun, uv, python, python3, cargo, dotnet, make, just, task, go, rake, bundle, gem) and match against the bare-command head. Open question: whether to derive the list dynamically from the repo's own `.coily/coily.yaml` deny block, or hardcode the common set. Hardcode probably wins on simplicity since the list is short and stable. **Out of scope** The wrapper-tier `coilyRoutes` sweep (tracked in #23). This issue is specifically the generic "no wrapper exists, you need to edit the lockdown config" hint.

coilysiren added the

priority

label

2026-05-31 01:54:03 +00:00

coilysiren closed this issue

2026-06-03 23:51:28 +00:00

coilysiren referenced this issue

2026-07-05 21:50:01 +00:00

warded director: grant a read-only eco / kai-server observe capability #547

Commenting is not possible because the repository is archived.