@yunuseon/kayra 0.13.0 → 0.13.1

package/agent/skills/kayra-release/SKILL.md

@@ -62,7 +62,9 @@ shell.
 
 `main` is protected: it changes only through a PR with green `checks`, for
 admins too. Merging and pushing a tag both ask the operator (kayra's guard);
-that is expected, say what you are doing.
+that is expected, say what you are doing. In auto mode the guard refuses
+them instead: stop, give the operator the exact command, and continue once
+they ran it (or switched the session to Manual and said so).
 
 ```bash
 gh pr merge <n> --repo yunuseon/kayra --merge --delete-branch

package/agent/skills/kayra-rollout/SKILL.md

@@ -58,7 +58,9 @@ Commit (the message names the release and anything the fleet changed),
 push, open the PR the fleet's way, wait for its checks (GitHub:
 `gh pr checks --watch`; Forgejo: `tea api /repos/<owner>/<repo>/commits/<sha>/status`
 until `success`), then merge. Merges ask the operator (kayra's guard); that
-is expected. Remove the worktree and the local branch.
+is expected. In auto mode the guard refuses them, and every non-multipass
+deploy below, instead: stop, give the operator the exact command, continue
+once they ran it. Remove the worktree and the local branch.
 
 ## 3. Deploy, server by server
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunuseon/kayra",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "A self-hosted app platform and the CLI that runs it: Traefik, Authelia, a registry, rootless BuildKit and a small deployer per server, set up with OpenTofu and Ansible.",
   "license": "MIT",
   "author": "Yunus Öztürk",

package/scripts/agent/guard.sh

@@ -5,8 +5,12 @@
 # command that changes something real waits for the operator to approve it,
 # in that moment.
 #
-# Reads the hook's JSON on stdin; prints a permissionDecision "ask" with the
-# reason for:
+# Reads the hook's JSON on stdin; prints a permissionDecision with the reason
+# for the commands below: "ask" in a mode that shows the operator a prompt
+# (default, acceptEdits, plan), "deny" in one that approves by itself (auto,
+# dontAsk, bypassPermissions) or an unknown one, where an "ask" would let the
+# command through unseen. Denied, the agent stops and says so; the operator
+# runs the command, or switches the session to Manual for it.
 #   - kayra commands that change a server (up, provision, setup, deploy,
 #     apps, adopt, down, app purge|deploy|rollback, job) unless --dry-run or
 #     the server is a multipass one (its server.yml under the project)
@@ -25,13 +29,19 @@
 # =============================================================================
 set -uo pipefail
 
-command="$(jq -r '.tool_input.command // empty' 2>/dev/null)"
+input="$(cat)"
+command="$(jq -r '.tool_input.command // empty' <<< "$input" 2>/dev/null)"
 [ -n "$command" ] || exit 0
+mode="$(jq -r '.permission_mode // empty' <<< "$input" 2>/dev/null)"
 project="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 ask() {
-    jq -n --arg reason "$1" \
-        '{hookSpecificOutput: {hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: ("guard: " + $reason)}}'
+    case "$mode" in
+        default|acceptEdits|plan) decision=ask reason="guard: $1" ;;
+        *) decision=deny reason="guard: $1. This session approves by itself (${mode:-no permission mode}), so the guard refuses instead of asking: tell the operator, who runs it or switches the session to Manual for it." ;;
+    esac
+    jq -n --arg decision "$decision" --arg reason "$reason" \
+        '{hookSpecificOutput: {hookEventName: "PreToolUse", permissionDecision: $decision, permissionDecisionReason: $reason}}'
     exit 0
 }
 has() { grep -qE -- "$1" <<< "$command"; }