[PR] fix(agent-isolation): list gh write subcommands in ask instead of a catch-all that prompted on every read [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1290:
URL: https://github.com/apache/magpie/pull/1290

   <!-- SPDX-License-Identifier: Apache-2.0
        https://www.apache.org/licenses/LICENSE-2.0 -->
   
   ## Summary
   
   - Every `gh` call prompted, reads included, because the reference `.claude/settings.json` kept `Bash(gh *)` in `permissions.ask` on the assumption that the more specific read-only `allow` rules would exempt `gh pr view` and friends. They cannot: Claude Code evaluates deny, then ask, then allow, and per its permissions docs "a matching ask rule prompts even when a more specific allow rule also matches the same call". Ask rules also merge from every settings source, so a user-scope file could not undo the project's catch-all.
   - The catch-all becomes an explicit list of 94 `gh` write subcommands (`gh api` included, since GET and POST look identical to a prefix rule). Read-only subcommands now reach the `allow` list; a subcommand in neither list falls through to the mode's default (prompt in default mode, classifier in auto).
   - The mistake is now caught mechanically: a `sandbox-lint` invariant rejects `Bash(gh *)` in `ask`, verify check 11b fails on it in any scope, and the doctor's `gh` probe warns on it. Docs, specs and RFC-AI-0002 § Layer 3a state the real rule.
   
   ## Type of change
   
   - [x] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   - [x] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [ ] Groovy reference impl
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   - [x] `prek run --files <all changed files>` passes every hook, including `sandbox-lint` against the updated baseline
   - [x] `uv run --project tools/sandbox-lint --group dev python -m pytest tools/sandbox-lint` — all pass; the new invariant test injects `Bash(gh *)` into the baseline and expects the error
   - [x] Precedence claim verified against the Claude Code permissions documentation (deny → ask → allow, specificity does not reorder) before changing anything
   - [x] Skill evals: no step-config heading changed; the verify and doctor edits are additive text inside existing sections
   - [ ] For skill *behaviour* changes: a new or updated eval fixture — **not added**: the doctor's new ⚠ line maps onto the existing `gh_sandbox_status: "warn"` value, which fixtures already cover as a schema value
   - [x] Token table regenerated (`skill-token-count --write`)
   
   ## RFC-AI-0004 compliance
   
   - [x] **HITL** — every gh write subcommand still prompts; only reads stop prompting
   - [x] **Sandbox** — no new host access
   - [x] **Vendor neutrality** — no project-specific values introduced
   - [ ] **Conversational + correctable** — n/a
   - [x] **Write-access discipline** — `gh api` stays on ask because a pattern cannot separate its reads from its writes; the vetted-ops dispatcher remains the bounded read path
   - [ ] **Privacy LLM** — n/a
   
   ## Linked issues
   
   Refs #1289 (the `gh`-in-sandbox catalog entry this builds on).
   
   ## Notes for reviewers (optional)
   
   - The explicit list was built from `gh <group> --help` on gh 2.x. `gh codespace *` is kept whole on ask (every subcommand acts on a remote resource); `gh project` lists its write subcommands individually so `gh project view` / `item-list` stay read-only.
   - RFC-AI-0002's example ask block carried `Bash(gh api * -X *)` / `* -f *` / `* -F *`. Prefix rules do not support a wildcard in the middle, so those never matched; they are replaced by `Bash(gh api *)` with the rationale inline. The Layer 3a paragraph keeps its prompt-fatigue argument, now attributed to `gh api` rather than to a wildcard the reference no longer carries.
   - Adopters who copied the reference config carry the same catch-all; their next `/magpie-setup verify` will flag it (11b) and the doctor will warn.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(agent-isolation): list gh write subcommands in ask instead of a catch-all that prompted on every read [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1290:
URL: https://github.com/apache/magpie/pull/1290


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org