@cratis/pi 7.97.1 → 7.97.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -645,6 +645,14 @@ the intended action and the permitted alternative; it does not loosen its own co
|
|
|
645
645
|
Supply credentials through the environment, never echo them or place them in committed files.
|
|
646
646
|
A missing or disabled hook is not evidence that a protected action is safe.
|
|
647
647
|
|
|
648
|
+
The shipped `permissions.ask` rules (`git push`, `gh pr`) are for a person at a terminal. In
|
|
649
|
+
`claude -p` an `ask` rule wins over `--dangerously-skip-permissions`, and with nobody to answer,
|
|
650
|
+
the call is denied. A runner whose work includes pushing or opening pull requests answers those
|
|
651
|
+
prompts with `--permission-prompt-tool` (an MCP tool that returns an allow decision); `deny` rules
|
|
652
|
+
and denying hooks are settled first and still refuse. Do not drop the project settings with
|
|
653
|
+
`--setting-sources user` instead: on Claude Code 2.1.280 that also stops the repository's
|
|
654
|
+
`CLAUDE.md`, skills and hooks from loading.
|
|
655
|
+
|
|
648
656
|
## Method lineage
|
|
649
657
|
|
|
650
658
|
| Idea | Used in | Credit |
|