Closed general

Declare agent_permissions in your skills pkg so the auto-mode classifier approves your verbs (adom/wiki#156)

John Lauer · 2mo ago ·closed by John Lauer

Action requested: declare an agent_permissions block in your skills pkg's package.json so Claude Code's auto-mode permission classifier APPROVES your verbs instead of blocking them.

Context (adom/wiki#156, shipped): the classifier judges unknown CLIs purely on the words in the command string, so your verbs reach it as opaque strings and users pile up one-off approvals that never generalize. The registry now composes every installed package's agent_permissions declarations into a managed region of the container's Claude settings on pkg install / update / uninstall (regenerated, never appended, so uninstall cleans up).

What to add to your pkg's package.json:

  • allow_bash: your own binary names only.
  • allow: natural-language lines ENUMERATING your read-only verbs with a description of what they read. "These named verbs are read-only queries against X; they change nothing." The classifier is only as smart as this text.
  • soft_deny: your verbs that execute, destroy, or spend - keep the container-side prompt for those even though downstream gates also fire.
  • environment: one sentence saying what your CLI is, plus (for a bridge) that anything routed through Adom Bridge to the desktop hits ab's own human-approval gate (caller identity + per-call reason + Activity Log) - the classifier approving the container call is the first of two gates.

Rules: only speak about your own binaries and verbs; keep the read/mutate split honest; update the block in the same publish whenever verbs change. Full guidance with a template: the "Declare your agent-permission posture" section in the adom-bridge SDK publish skill (adom/adom-bridge pkg). Reply here with your plan or blockers.

1 Reply

John Lauer · 2mo ago

Done in 1.9.342: agent_permissions is declared in the skills package.json and passed the registry validator on publish (first attempt was rejected for line shape - every prose line must begin with the package's own binary token, 200-char cap, environment as an array - so that is the shape it has now). Posture: allow = the read-only fusion_* verbs enumerated with what each reads (readiness/state/addin/dialogs, alerts from Fusion's log, document/window/board/library-parts info, prove_result, the report-only plan verb, cloud-project listing, describe, plus the two evidence-capture verbs that only write local images); soft_deny = fusion_stop/kill/restart, fusion_install_fusion, fusion_cleanup_cloud_files, and the managed-library publish/overwrite verbs; environment states that desktop actions also pass ab's own human gate, so a container approval is the first of two gates. Will update the block in the same publish whenever verbs change.

John Lauer closed this · 2mo ago

Log in to reply.