Sweep coilyRoutes: every bare-command deny should inject a routing hint #23

New issue

Open

opened 2026-05-27 22:17:18 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-27 22:17:18 +00:00

Owner

Problem

coilyRoutes in cmd/agent-guard/hook.go enumerates a fixed set of bare commands (aws, gh, kubectl, docker, tailscale, ssh, scp) that get a routing hint when an agent tries them. Every other bare invocation that has a coily wrapper falls through to a vanilla harness deny with no recovery text. Net effect: the agent sees Permission to use Bash with command X has been denied, no mention of coily ops X or coily exec X, no recovery path. Sister issue: coilysiren/agent-guard#22 (mcporter case).

Ask

Sweep coily's full verb surface and make sure every bare command that has a coily wrapper has a coilyRoutes entry with at least a one-sentence "use coily <verb> instead" hint. Source of truth is coily --tree and coily ops <subcommand>. Examples likely missing today (non-exhaustive, agent should walk the tree):

mcporter (filed: #22)
forgejo
lunchmoney
discord
openhue
chromecast (cast)
sonos
elevenlabs
obsidian
gws
trello
amplitude
terraform / tofu (if wrapper exists)
helm
npm / npx / uv / cargo / dotnet (these are denied by repo lockdown - the hint should point at the repo's .coily/coily.yaml instead of a global wrapper)

Implementation sketch

Two-tier hint:

Known wrapper: explicit entry in coilyRoutes naming coily ops <verb> and the wrapper's argv shape.
No wrapper but lockdown-denied (npm/uv/cargo/dotnet/etc.): generic hint pointing at the per-repo .coily/coily.yaml and the "Add new verbs to that file before invoking them" rule from agentic-os-kai/AGENTS.md.

Why now

System-improvement bias: "opaque errors are design smells - recovery messages should name the command Kai can dictate next" (agentic-os-kai AGENTS.md). Every uncovered deny is one of those opaque errors. The hook fires anyway, so adding routing text is near-zero cost per entry and saves an agent round-trip per miss.

Out of scope

The harness-level allowlist (settings.json). This is purely about agent-guard's PreToolUse routing-hint coverage.

**Problem** `coilyRoutes` in `cmd/agent-guard/hook.go` enumerates a fixed set of bare commands (aws, gh, kubectl, docker, tailscale, ssh, scp) that get a routing hint when an agent tries them. Every other bare invocation that has a coily wrapper falls through to a vanilla harness deny with no recovery text. Net effect: the agent sees `Permission to use Bash with command X has been denied`, no mention of `coily ops X` or `coily exec X`, no recovery path. Sister issue: coilysiren/agent-guard#22 (mcporter case). **Ask** Sweep coily's full verb surface and make sure every bare command that has a coily wrapper has a `coilyRoutes` entry with at least a one-sentence "use `coily <verb>` instead" hint. Source of truth is `coily --tree` and `coily ops <subcommand>`. Examples likely missing today (non-exhaustive, agent should walk the tree): - mcporter (filed: #22) - forgejo - lunchmoney - discord - openhue - chromecast (cast) - sonos - elevenlabs - obsidian - gws - trello - amplitude - terraform / tofu (if wrapper exists) - helm - npm / npx / uv / cargo / dotnet (these are denied by repo lockdown - the hint should point at the repo's `.coily/coily.yaml` instead of a global wrapper) **Implementation sketch** Two-tier hint: 1. Known wrapper: explicit entry in `coilyRoutes` naming `coily ops <verb>` and the wrapper's argv shape. 2. No wrapper but lockdown-denied (npm/uv/cargo/dotnet/etc.): generic hint pointing at the per-repo `.coily/coily.yaml` and the "Add new verbs to that file before invoking them" rule from `agentic-os-kai/AGENTS.md`. **Why now** System-improvement bias: "opaque errors are design smells - recovery messages should name the command Kai can dictate next" (agentic-os-kai AGENTS.md). Every uncovered deny is one of those opaque errors. The hook fires anyway, so adding routing text is near-zero cost per entry and saves an agent round-trip per miss. **Out of scope** The harness-level allowlist (settings.json). This is purely about agent-guard's PreToolUse routing-hint coverage.

coilysiren referenced this issue

2026-05-27 22:19:00 +00:00

Lockdown-denied bare commands should inject a .coily/coily.yaml hint #24

coilysiren added the

label

2026-05-31 01:54:03 +00:00

coilysiren added

and removed

labels

2026-05-31 07:01:25 +00:00