Lockdown-denied bare commands should inject a .coily/coily.yaml hint #24
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Bare
npm/npx/uv/python/python3/cargo/dotnet/makeinvocations get denied by the per-repo Claude Code lockdown (thepermissions.denyblock written bycoily lockdown). The deny message is the vanilla harness "Permission to use Bash with command X has been denied" - no routing text, no pointer at.coily/coily.yaml, no mention of the "add new verbs to that file before invoking them" rule.Net effect: agent dead-ends on a deny that has a known recovery path (add the verb to
.coily/coily.yamland re-route throughcoily exec/coily make/ equivalent).Sister issue: coilysiren/agent-guard#23 (the wrapper-tier sweep). This issue is the second tier from that one's "Implementation sketch" - tracked separately so it can ship independently.
Ask
agent-guard's PreToolUse hook should catch these lockdown-shaped denies and inject a generic hint:
The hint does not need to know which specific verb to add - just pointing the agent at the config file plus
coily --treeis enough to break the dead-end.Detection
Probably easiest to enumerate the set of commonly-denied build/runtime tools (npm, npx, pnpm, yarn, bun, uv, python, python3, cargo, dotnet, make, just, task, go, rake, bundle, gem) and match against the bare-command head. Open question: whether to derive the list dynamically from the repo's own
.coily/coily.yamldeny block, or hardcode the common set. Hardcode probably wins on simplicity since the list is short and stable.Out of scope
The wrapper-tier
coilyRoutessweep (tracked in #23). This issue is specifically the generic "no wrapper exists, you need to edit the lockdown config" hint.