Repository navigation
feat(runner): scoped autonomy — Board sessions on a paired machine without YOLO - #228
Merged
Merged
Conversation
…thout YOLO A "Run on my machine" session dispatched to a prompt-mode runner could not even clone: every tool needs an approval nobody can give non-interactively (found by dogfooding the lab on DeltaByteLab/VNChessAcademy #7). The only alternative was REMOTE_AGENT_YOLO (--dangerously-skip-permissions). REMOTE_AGENT_AUTONOMY=scoped (lab: `lab.ps1 pair -Scoped`) is the middle ground: - every CLI run starts in its own empty directory under %LOCALAPPDATA%/AgentOS.NET/runs (deleted afterwards; REMOTE_AGENT_KEEP_RUNS keeps it), never the runner's current directory; - claude runs with --permission-mode acceptEdits (edits inside that directory only) and a shell allowlist of git / gh pr / dotnet / npm commands; - denied: force push, branch deletion, pushes onto main/master/refs, git config / remote / credential, gh auth / secret / api, web tools, and reads of credential stores (~/.ssh, ~/AppData/Roaming, browser profiles, ...). The issue-work CLI prompt now clones into that directory (`git clone … .`). Verified with live claude -p smoke runs against a local bare repo: clone, edit, commit and push of the issue branch succeed; force push, push to main, git config, a write outside the run directory, cat/node and a read of ~/.gitconfig are all denied. Two of those runs caught real gaps that the unit tests now guard (a bare Write allow rule applies to any path; a Read deny on ~/AppData locked the agent out of its own checkout). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB
…ndows command paths on any OS Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB
…nguage hint
A non-technical member should never have to set REMOTE_AGENT_AUTONOMY. The
server now asks per request: LlmRequest.Autonomy / RemoteExecRequest.Autonomy =
"scoped" is set only by the issue-work CLI run (Board "Run on my machine", the
member's own click); every other remote call (spec generation, the pipeline
agents) stays answer-only. The runner honours scoped requests by default; its
owner can refuse them with REMOTE_AGENT_AUTONOMY=off ("scoped" still grants
every request, for scripts). `lab.ps1 pair -Scoped` is gone — no longer needed.
The Board's "Work on this" and "Start from idea" dialogs now explain under the
CLI picker, in plain words, what the agent may do on the member's computer.
Codex scoped runs enable network inside the workspace-write sandbox (clone/push).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB
…repos start clean Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change description
Dogfooding the lab on a real project (DeltaByteLab/VNChessAcademy, ticket #7) showed that a "Run on my machine" Board session can't work on a prompt-mode runner: the CLI has to clone, edit, build and push, every one of those tools needs an approval nobody can give non-interactively, and the agent stopped with "this session needs approval to clone". The only other option was
REMOTE_AGENT_YOLO(--dangerously-skip-permissions).New
REMOTE_AGENT_AUTONOMY=scoped(lab:pwsh infra/lab/lab.ps1 pair -Scoped):%LOCALAPPDATA%/AgentOS.NET/runs(deleted afterwards), never the runner's cwd (which was a checkout of AgentOS.NET itself);claude -p --permission-mode acceptEdits+ a shell allowlist (git / gh pr / dotnet / npm, read-only basics);git config|remote|credential,gh auth|secret|api, WebFetch/WebSearch, reads of credential stores (~/.ssh,~/AppData/Roaming, browser profiles,.env, …);git clone … .).It's honest about its limit (LAB.md + code comment): it scopes the agent, not the repo's own build scripts.
Type of change
Related issues
Found while running DeltaByteLab/VNChessAcademy#7 on the lab.
Checklist
dotnet buildpasses locally in Release modedotnet testpasses — 1349 total, 0 failed (newScopedAutonomyTests)claude -psmoke against a local bare repo — 6/6 legit steps OK (clone, edit, branch, add, commit, push issue branch); 7/7 attacks denied (force push, push to main, git config, write outside,cat ~/.gitconfig,node -e, Read~/.gitconfig). Two earlier smoke runs caught real gaps now guarded by tests (bareWriteallow = any path;Read(~/AppData/**)blocked the run's own checkout).🤖 Generated with Claude Code
https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB