HomerandClaude Opus 5.5
8e06590d57
ci / check (push) Canceled after 0s
The system prompt is made once per session (start, compaction, model switch), kept in session_meta and resent byte for byte; it holds no date. What changes mid-session -- the date, a mode the person chose, a plan or memory or instruction file they edited, a personality, MCP instructions that arrived later -- is a <session-note> on the next user message, stored with it. The tool list is fixed for the session: plan_submit is always offered and answers unavailable outside plan mode, the wrap-up keeps the tools and runs no call, a withdrawn tool stays listed and answers its refusal; the first request waits up to mcp_wait_ms for MCP servers. Compaction asks for its summary as the next turn of the same conversation. Cached input tokens are parsed (incl. llama.cpp timings), stored per request and shown in /context. Spec: context.md §7/§10, loop.json context.note (+ plan_ended, plan_own, personal, empty, mcp_wait_ms), modes.json plan.refused, compact.md without the transcript heading. Conformance area prefix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
2.6 KiB
JSON
41 lines
2.6 KiB
JSON
{
|
|
"about": "The four permission modes, as what each does with a call of each risk class once the hardline and the rules have spoken. `rules` means the permission rules decide (defaults.json, then the user's, then a trusted project's, then this session's approvals); anything the rules do not allow is asked. A deny from the rules or the hardline is final in every mode.",
|
|
"order": ["auto", "edit", "manual", "plan"],
|
|
"order_about": "Loosest first. A project or a subagent may make the mode stricter, never looser; switching to a looser mode is always asked.",
|
|
"aliases": { "unrestricted": "auto" },
|
|
"floor": "The hardline (hardline.json) and the protected paths are refused in every mode, auto included.",
|
|
"confirm": "Spec 3.0.0: a tool with `confirm: always` (merge, tag, release) is put to the person before it runs, in every mode, auto included, as an approval card naming the call and what it reaches; it runs on a yes only. No rule allows it and no approval is remembered (an approval card offers once, never always). With nobody to answer, it is refused, as unattended says.",
|
|
"modes": {
|
|
"manual": {
|
|
"summary": "Everything not already allowed is asked.",
|
|
"read": "rules",
|
|
"write": "rules",
|
|
"execute": "rules",
|
|
"interact": "rules"
|
|
},
|
|
"edit": {
|
|
"summary": "Reading and changing files inside the project runs without asking; commands, and anything outside the project, follow the rules.",
|
|
"read": "allow inside the project, unless a rule written for that tool says ask (reading .env still asks); outside the project: rules",
|
|
"write": "allow inside the project, except git's own files (.git/) and the agent's own configuration in the project (config, agents, commands, skills); outside: rules",
|
|
"execute": "rules",
|
|
"interact": "rules"
|
|
},
|
|
"auto": {
|
|
"summary": "Nothing is asked. The hardline still refuses.",
|
|
"read": "allow",
|
|
"write": "allow",
|
|
"execute": "allow",
|
|
"interact": "allow"
|
|
},
|
|
"plan": {
|
|
"summary": "Investigate and write a plan; change nothing else.",
|
|
"read": "rules",
|
|
"write": "allow only for files under the plans directory; anything else is refused",
|
|
"execute": "only what the rules already allow; anything else is refused",
|
|
"interact": "rules",
|
|
"refused": "Plan mode: nothing changes but the plan. Put what this would do into the plan with plan_write or plan_update; it can be done once the person approves the plan."
|
|
}
|
|
},
|
|
"unattended": "With nobody to answer, whatever a mode would ask is refused instead, and the model is told so up front (prompts/modes/unattended.md)."
|
|
}
|