fix: fewer prompts — make tasks once checked, local git work, commands rules can read

[mauricios]

Why

Testing in an adopting project, agents asked the developer to approve commands all day, mostly make commands. Its session transcripts, about 2,200 commands, showed the project already allowed make *, so a plain make task never prompted. The prompts came from three places:

• Commands no rule can read (~650): a leading VAR= assignment, paths in $VARs, git -C <path>, shell loops, and heredoc scripts into python3 or node.
• make run cmd="yarn …" (~110): the project's own ask rule covers it. Agents used it because no task ran one test file, linted one file, formatted, or type-checked.
• git add and git commit (~65): the skeleton allowed neither, so every commit prompted.

Claude Code's behavior here was checked against its permissions docs: an ask rule beats an allow rule, an allow rule doesn't match past a leading assignment, and a redirect outside the project prompts.

What changed

• dev-env's specification:
  • C3: test takes t=<filter>, lint takes f=<files>, and each mode adds format and typecheck. The templates show both.
  • C9 — allow broadly, ask by name: every task runs without a prompt but the ones that delete data or run a command they're given, each of which gets an ask rule. No task waits for input or follows a log. (A first commit allowed each task by name after a make -n check, from the earlier fix/make-allow-rules work; the second commit replaces that with this simpler model.)
  • C10: a task that runs a command it's given is for people and asks. A command agents keep needing becomes a task of its own.
• Docker module: it allows docker * and make *. Its ask rules name what must still prompt, and an ask rule beats any allow rule:
  • deletes data: compose down -v or --rmi, rm, rmi, prune, make reset;
  • leaves the machine: docker push;
  • prints secrets: docker inspect, a bare docker compose config, an exec or compose run that names env;
  • make run.
• /dev-env: its audit flags missing filters, an unasked make run, a project task that deletes data under another name, and a task that follows a log. Set up proposes an ask rule for each such task. /adf:upgrade lists those tasks before it reruns the installer.
• The module permission check in the evals accepts exactly docker * and make * for this module, and only while their ask rules are there. Every other module and rule is held to read-only, as before.
• Skeleton:

  • .claude/settings.json allows git * and gh * in place of 24 narrow rules, and asks by name before what must still prompt:

    • switches off the hooks, or releases: git config (core.hooksPath), git push --tags;
    • changes a pull request's state or speaks for a reviewer: gh pr ready, merge, review;
    • can't be undone or exposes a credential: releases, gh repo delete, gh secret, gh auth, gh api writes.

    The list is short on purpose, chosen by the developer. Discarding local work (git reset --hard, clean, restore, branch -D) and issue writes run without a prompt; git-workflow.md gains "never discard work unless the developer asks", and AGENTS.md still says an agent posts only when asked. Rare commands that are easy to undo run too: gh pr close/reopen, labels, workflow runs, gists, extensions, docker stop/kill/login.

  • .claude/rules/claude-code.md gains § Commands that run without a prompt, and a guardrails row.

• The mode is the developer's (M10, decision 0034 amended). In the adopting project, agents ran make test/build/e2e with DEV_MODE=native though the developer runs only Docker, partly because the framework showed that override as an example. An agent now runs every task in the configured mode and never sets DEV_MODE or SERVICES unasked. The docker module asks before any make command that sets either one. The claude-code.md example becomes make logs s=web, and deployment.md and /dev-env say the override is for people.
• Docs: decision 0038 amends 0032 and 0033. The changelog entry carries the upgrade impact, and the onboarding guide's guardrails table gains a row.

For reviewers

• Bash(make *) trusts the project's Makefile. It matches the command, not what the task runs. A task that deletes data under a new name runs without a prompt until its ask rule goes in, so review a Makefile change as code that runs without one.
• docker compose run and exec run any command in the project's containers without a prompt (decided in conversation). The containers hold the project's code and data, not the host's.
• docker run runs without a prompt (the developer's choice): with a host mount or --privileged, a container reaches the host's files.
• A secret can still print through a form no ask rule names (docker compose config --format json). /dev-env's safety rules and the specification's V4 cover it; the rules catch the usual forms. The env rule is a little broad: an exec whose arguments contain env, such as a test file named environment.test.ts, asks too.
• git and gh run without a prompt but for the named exceptions. Staging everything and --amend run too. The guard-git hook still blocks --no-verify, commits or pushes on protected branches, and a pull request that isn't a draft. A gh write added in a later gh version runs until the skeleton names it.
• The command-writing section is instruction, not enforcement. A command no rule can read still prompts, which is the safe failure.

Verification

• ./evals/run-evals.sh: all suites pass. New and changed tests:
  • C9 on the templates: every task but reset exists in both modes and deletes nothing, and logs never follows.
  • The filter: make test t=<file> passes the file to the test command.
  • Docker rules: make up, make test t=…, make up DEV_MODE=native, docker compose up/down/build/run/exec, docker images, and docker stats run without a prompt. make run, make reset, make up DEV_MODE=native, make up SERVICES=none, docker push, docker inspect, a bare compose config, and exec … printenv ask, while docker run, stop, kill, and login run. A leading DEV_MODE=native make up still prompts. The test's rule simulator now applies the documented rule that a trailing * also matches the bare command.
  • The module permission check: shown failing when the make reset ask is removed or another broad allow is added.
  • Settings: the check simulates Claude Code's matching against the expected verdict of about 40 git and gh commands, both sides of the line — gh pr close, workflow run, label create, and git stash clear run. It failed on the old settings and passes on the new ones.
  • Static checks: C9 and C10 in the specification, /dev-env and /upgrade naming the check, and the new claude-code.md section.
• python3 scripts/build-committed.py --check: the round trip holds, with 65 files.
• Not verified: a real adopting project after /dev-env set up, to measure the prompts that remain.

🤖 Generated with Claude Code