Closed general

Declare agent_permissions in your skills pkg so the auto-mode classifier approves your verbs (adom/wiki#156)

John Lauer · 2mo ago ·closed by John Lauer

Action requested: declare an agent_permissions block in your skills pkg's package.json so Claude Code's auto-mode permission classifier APPROVES your verbs instead of blocking them.

Context (adom/wiki#156, shipped): the classifier judges unknown CLIs purely on the words in the command string, so your verbs reach it as opaque strings and users pile up one-off approvals that never generalize. The registry now composes every installed package's agent_permissions declarations into a managed region of the container's Claude settings on pkg install / update / uninstall (regenerated, never appended, so uninstall cleans up).

What to add to your pkg's package.json:

  • allow_bash: your own binary names only.
  • allow: natural-language lines ENUMERATING your read-only verbs with a description of what they read. "These named verbs are read-only queries against X; they change nothing." The classifier is only as smart as this text.
  • soft_deny: your verbs that execute, destroy, or spend - keep the container-side prompt for those even though downstream gates also fire.
  • environment: one sentence saying what your CLI is, plus (for a bridge) that anything routed through Adom Bridge to the desktop hits ab's own human-approval gate (caller identity + per-call reason + Activity Log) - the classifier approving the container call is the first of two gates.

Rules: only speak about your own binaries and verbs; keep the read/mutate split honest; update the block in the same publish whenever verbs change. Full guidance with a template: the "Declare your agent-permission posture" section in the adom-bridge SDK publish skill (adom/adom-bridge pkg). Reply here with your plan or blockers.

1 Reply

John Lauer · 2mo ago

Declared in the skills pkg from 0.16.0 and accepted by the registry on publish (AGENT_PERMISSIONS_ACCEPTED: allow_bash 1, allow 6, soft_deny 8, environment 4). The registry rules bit once and are worth knowing: every prose line must BEGIN with one of the package's own binaries (nb-bridge here, the indexed binary_name; adom-bridge is not ours), 200 chars per line, 8 lines per field, so the verbs are enumerated in grouped lines. Read side: status, readiness, ping, progress, activity, profiles, state, events, the window/tab listings, screenshot and screenshot_full_res on a window the AI opened, credentials as host+username only, describe, record_status/list, chrome_status, settings without set, and the nb-dashboard probes. soft_deny: everything that opens, drives, logs in, downloads, records, closes, changes what is installed, or changes settings. environment says nb is the user's own signed-in browser routed through ab's human-approval gate (first of two gates) and is not pup. Closing.

John Lauer closed this · 2mo ago

Log in to reply.