HomerandClaude Opus 5.5
253ef4a8a0
Every tool says its `sessions` (chat, agent or both). The file tools read, write, edit, glob, grep and list are shared; mkdir, mv, rm, search, python and the forge verbs (commit, branch, pr, merge, tag, release) are the chat's; show and recall are new and shared. New fields: `requires` (page, display, forge) with the exact `unavailable` answer, and `confirm: always` for merge, tag and release. knowledge_*, notes_search, note_view and note_manage leave the chat. Default rules for the new tools; modes.json says what `confirm` does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
40 lines
2.4 KiB
JSON
40 lines
2.4 KiB
JSON
{
|
|
"about": "The four permission modes, as what each does with a call of each risk class once the hardline and the rules have spoken. `rules` means the permission rules decide (defaults.json, then the user's, then a trusted project's, then this session's approvals); anything the rules do not allow is asked. A deny from the rules or the hardline is final in every mode.",
|
|
"order": ["auto", "edit", "manual", "plan"],
|
|
"order_about": "Loosest first. A project or a subagent may make the mode stricter, never looser; switching to a looser mode is always asked.",
|
|
"aliases": { "unrestricted": "auto" },
|
|
"floor": "The hardline (hardline.json) and the protected paths are refused in every mode, auto included.",
|
|
"confirm": "Spec 3.0.0: a tool with `confirm: always` (merge, tag, release) is put to the person before it runs, in every mode, auto included, as an approval card naming the call and what it reaches; it runs on a yes only. No rule allows it and no approval is remembered (an approval card offers once, never always). With nobody to answer, it is refused, as unattended says.",
|
|
"modes": {
|
|
"manual": {
|
|
"summary": "Everything not already allowed is asked.",
|
|
"read": "rules",
|
|
"write": "rules",
|
|
"execute": "rules",
|
|
"interact": "rules"
|
|
},
|
|
"edit": {
|
|
"summary": "Reading and changing files inside the project runs without asking; commands, and anything outside the project, follow the rules.",
|
|
"read": "allow inside the project, unless a rule written for that tool says ask (reading .env still asks); outside the project: rules",
|
|
"write": "allow inside the project, except git's own files (.git/) and the agent's own configuration in the project (config, agents, commands, skills); outside: rules",
|
|
"execute": "rules",
|
|
"interact": "rules"
|
|
},
|
|
"auto": {
|
|
"summary": "Nothing is asked. The hardline still refuses.",
|
|
"read": "allow",
|
|
"write": "allow",
|
|
"execute": "allow",
|
|
"interact": "allow"
|
|
},
|
|
"plan": {
|
|
"summary": "Investigate and write a plan; change nothing else.",
|
|
"read": "rules",
|
|
"write": "allow only for files under the plans directory; anything else is refused",
|
|
"execute": "only what the rules already allow; anything else is refused",
|
|
"interact": "rules"
|
|
}
|
|
},
|
|
"unattended": "With nobody to answer, whatever a mode would ask is refused instead, and the model is told so up front (prompts/modes/unattended.md)."
|
|
}
|