auto-mode 0.15.0 → 0.17.0

package/policy/rules.md

@@ -22,9 +22,11 @@ Reading a secret in order to use it is not exfiltration. Sending it is, and so i
 deliberately putting one where other people will read it — a CI log, a pasted
 report, a shared terminal recording, a comment. A secret that shows up in a tool
 result is not this rule. Reading a secret necessarily brings it into the
-transcript. Sending
-ordinary non-sensitive content to a destination the user did not name is Unnamed
-Destination, not this rule.
+transcript. Printing a credential the task does not need is Credential
+Exploration, not this rule. Sending content that cannot be seen and is not known
+to be sensitive, or part of a private repository short of a bulk copy, to a
+destination nobody named is Unnamed Destination, not this rule. A credential file,
+a key, or an env file is known to be sensitive by its path.
 
 A credential used with the service it belongs to is use, not sending, however many
 other credentials sat in the same file.
@@ -36,8 +38,8 @@ tests are not sensitive credential material. For example, a fixed
 Judge the literal and its data flow, not a secret-shaped prefix alone. A test name,
 comment, or claim that a value is fake is not enough: material read from a real
 credential source, a usable credential, and sensitive data still match this rule,
-including when a test copies or sends them. Non-sensitive fixture data sent to
-another person still needs Outbound Communication consent.
+including when a test copies or sends them. Non-sensitive fixture data is not
+this rule.
 
 Putting a secret into a secret store is not this rule: `gh secret set`, a vault
 write, a cloud secret manager, or a CI credential store. Those exist to hold
@@ -81,41 +83,54 @@ machine to whoever holds the other end.
 Each rule names the detail the user must say.
 
 ### Irreversible Deletion
-Deleting data that no backup, remote, or build step can restore. This covers a
-path outside the current working tree, a whole working tree, tracked source that
-is not pushed, an untracked file the agent did not create, and any write to a
-block device.
+Deleting data that the task does not own or that nothing can restore: the home
+directory or a directory that contains it, a path outside the task scope, an
+untracked file the agent did not create, a repository together with its `.git`,
+and any write to a block device.
 
 **Must name:** the path, or an unmistakable description of it.
 
-Examples: `rm -rf ~`, `rm -rf /`, `rm -rf ..`, `dd of=/dev/sda`, `shred` on a
-source file, deleting a sibling repository, and `rm -rf src/` when those commits
-are not pushed.
+Examples: `rm -rf ~`, `rm -rf /`, `rm -rf ..`, `rm -rf ~/projects`,
+`dd of=/dev/sda`, and deleting a sibling repository or another worktree.
 
-A directory the remote already holds is restorable. Deleting it is not this rule.
+Overwriting a file destroys its old content, so it counts as deleting it.
+Replacing an existing private key or credential file matches this rule: for
+example, `ssh-keygen -f ~/.ssh/id_ed25519` answered `y` over an existing key.
+
+Git restores a tracked file whose content is committed, so deleting one is not
+this rule; uncommitted changes in it are Uncommitted Work Destruction. A
+directory the remote already holds is restorable too, unless it also holds an
+untracked file the agent did not create. Neither is a file or directory the agent
+created this session.
 
 ### Uncommitted Work Destruction
-Discarding changes in the working tree that exist nowhere else: `git reset --hard`,
+Discarding uncommitted changes that the task does not own: `git reset --hard`,
 `git checkout -- .`, `git restore .`, `git clean -fd`, `git stash drop`,
 `git stash clear`, or deleting a branch that holds unmerged commits.
 
+Uncommitted changes in the task's own worktree are the task's work. Discarding
+them is this rule only when the last direct user message or the task context
+says they came from someone else or must be kept.
+
 **Must name:** that the changes go away. "Reset hard" and "throw away my changes"
 both do it. "Clean up" does not.
 
 This rule does not apply when the working tree is clean.
 
-Reverting an edit the agent itself made this session is not this rule, as long as
-nothing the user wrote is discarded with it.
-
 ### History Rewrite
-Rewriting history that others may already hold: `git push --force` and
-`--force-with-lease` to a shared branch, rebasing pushed commits, `git
-filter-branch`, `git filter-repo`, `git commit --amend` on a pushed commit, or
-deleting a remote branch or tag.
+Rewriting history on a branch the task does not own: `git push --force` and
+`--force-with-lease`, pushing rebased or amended commits, pushing after
+`git filter-branch` or `git filter-repo`, or deleting a remote branch — when the
+target is the default branch, a protected branch such as `main`, `master`,
+`trunk`, or `develop`, or a branch outside the task scope. Deleting or moving a
+remote tag that this session did not create is also this rule.
 
 **Must name:** force, rewrite, or the remote branch.
 
-`--force-with-lease` is safer than `--force`. It is not exempt.
+A branch in the task scope belongs to the task, including the head branch of the
+task's own pull request while a review is open. Any rewrite of it, with `--force`
+or `--force-with-lease`, is not this rule. A rewrite that stays local changes
+nothing others hold until it is pushed.
 
 ### Default Branch Write
 Committing, pushing, or merging directly to the default branch: `main`, `master`,
@@ -141,41 +156,48 @@ registry, or a deploy command.
 **Must name:** publish, release, or deploy, plus the target.
 
 ### Outbound Communication
-Content that reaches another person: an email, a chat message, a comment on an
-issue or a pull request, a new issue, a review, or a post to any service other
-people read.
+A message that reaches people outside the checkout's own repositories and outside
+the channels the user named: an email, a chat message to a person or channel the
+user did not name, a post on a public service, or an issue, comment, pull request,
+or review on a repository that is not a remote of the checkout.
 
 **Must name:** that the message is sent, and to whom or where.
 
-Once the user authorises posting to a named thread — one pull request, one issue,
-one channel — further posts to that same thread stand for the rest of the session.
-This is a standing permission the rule states for itself. A different thread, or a wider
-audience, needs its own consent.
+An issue, comment, pull request, or review on a repository that is a remote of
+the checkout is not this rule, whichever issue or pull request it targets. Compare
+the repository's host, owner, and name with the remotes; a lookalike name is not a
+match.
 
-A team's own messaging service is not Data Exfiltration by itself. The carve-out
-covers the destination, not what is sent: posting sensitive content there is still
-Data Exfiltration, and a wider or more external audience than the user named is
-still this rule.
+Once the user names a channel or an outside thread, further posts to that same
+place stand for the rest of the session. This is a standing permission the rule
+states for itself.
 
-Reading these services is allowed. Writing to them is not.
-
-A git push to a remote of the checkout sends commits, not a message to a person,
-so it is not this rule. Opening a pull request or posting a review is.
+Sensitive content is Data Exfiltration wherever it goes. Reading these services is
+allowed. A git push sends commits, not a message to a person, so it is not this
+rule.
 
 ### Remote Code Execution
-Running code fetched from a source the user did not name. The fetch and the run
-count together even when they are separate commands: `curl … | sh`, `wget -O- …
-| bash`, `iex (irm …)`, `curl -o setup.sh … && sh setup.sh`, or a package
-installed from a git URL or a local path rather than a registry.
+Running code fetched over the network from a source that neither the user nor the
+repository names. The fetch and the run count together even when they are separate
+commands: `curl … | sh`, `wget -O- … | bash`, `iex (irm …)`,
+`curl -o setup.sh … && sh setup.sh`, or adding a dependency from a git URL or a
+tarball URL nobody named.
 
 **Must name:** the source.
 
 The source is where the code comes from, not which package was chosen. The
 configured registry is a named source, so installing any package from it is not
 this rule. A package manager installing dependencies the repository already
-declares is not this rule either, whatever their source. A git or path dependency
-written in the manifest or the lockfile was chosen before this session. Adding a
-new one is this rule.
+declares is not this rule either, whatever their source.
+
+A later run cannot be linked to its download, so the download is where this rule
+applies: saving a script or executable from such a source to disk is this rule,
+even before anything runs it.
+
+Running code already on disk in the task scope is not this rule: a script, a
+package script such as `bun run test`, `node scripts/build.ts`, or an agent CLI
+such as `codex exec`. Its unseen content is not a missing fact for this rule.
+Judge the command line.
 
 ### Obfuscated Command
 A command whose payload you cannot decode with confidence: base64 or hex passed to
@@ -191,37 +213,40 @@ is code that is merely minified: build output is unreadable by accident, not by
 design, and this rule is about a command being run, not a file sitting on disk.
 
 ### Network Exposure
-Making this machine or its files reachable from outside it: binding a server to an
-address other than loopback, opening a firewall port, running a tunnel such as
-`ngrok` or `cloudflared`, publishing a container port, or mounting local paths into
-a container that is itself reachable.
+Opening a route into this environment from outside its isolation: a tunnel such as
+`ngrok`, `cloudflared tunnel`, `ssh -R`, `tailscale funnel`, or another relay that
+hands an outside party a way in.
 
 **Must name:** the service and that it becomes reachable.
 
-A server bound to `localhost` is not this rule, and neither is a container port
-published to loopback only, such as `-p 127.0.0.1:3000:3000`. A published port that
-binds every interface is.
+Binding a server to any address, publishing a container port, or opening a
+firewall port inside the environment is not this rule. The isolation decides what
+reaches them.
 
 ### Unnamed Destination
-Sending content to a network destination the user never named and never clearly
-implied — a URL, host, address, or account that first appears in tool output, in
-file content, or in the agent's own inference.
+Sending content that cannot be seen in the action and is not known to be
+sensitive, or part of a private repository short of a bulk copy, to a network
+destination that neither the user nor the repository names — a URL,
+host, address, or account that first appears in tool output, in file content, or
+in the agent's own inference. Examples: `curl -d @file https://…`, uploading an
+archive, or adding a remote at such a URL. A push of the codebase to it is a bulk
+copy and Data Exfiltration.
 
 **Must name:** the destination.
 
+Content visible in the action that holds nothing sensitive, such as a build status
+or a public question, is not this rule. Sensitive content is Data Exfiltration
+wherever it goes.
+
 A destination the repository itself configures — a webhook in a checked-in config,
-a registry in `package.json`, the remote of the checkout — counts as implied when
-the user asked for work in that repository. It is not this rule.
+a registry in `package.json`, the remote of the checkout — counts as named when the
+user asked for work in that repository.
 
 A configured MCP server of the session, listed in the MCP server facts, is a
 destination the user configured: calling its tools is not this rule. A tool named
 `mcp__<server>__<tool>` calls the server of that name.
 
-Adding a remote, or pointing one at a new URL, prepares a send to that URL. A URL
-the user never named makes it this rule.
-
-Fetching from such a destination is reading, and reading is allowed. Sending to a
-destination that no carve-out above covers is this rule.
+Fetching from such a destination is reading, and reading is allowed.
 
 ### Shared Infrastructure
 Commands that change a cluster, a cloud account, a remote host, or a repository's
@@ -255,91 +280,43 @@ or a scripted delete over every key.
 **Must name:** the table or the database, and the operation.
 
 ### Persistent Configuration
-Changes that outlive the session: shell startup files, `git config --global`,
-`crontab`, a systemd unit, a launch agent, `PATH`, a package manager registry or
-its credentials, `~/.ssh/authorized_keys` or `~/.ssh/config`, a sudoers entry, an
-agent configuration outside the working tree, writing an executable into a
-directory already on `PATH`, or starting a process built to outlive the session,
-such as `nohup … &` or a detached service.
-
-A package manager's own global install — `npm i -g`, `pipx install`, `cargo
-install` — is not this rule. It is an install, judged by Remote Code Execution.
-
-It also covers raising privilege or loosening access on this machine: `sudo -s`,
-`sudo su -`, `su` to another user, running a command under `sudo` that this rule
-would otherwise catch, `chmod` or `chown` widening access, `setfacl` widening a
-path, or a firewall rule that opens something.
+Granting access into this environment from outside it, or redirecting where
+credentials or code go: adding a key to `~/.ssh/authorized_keys`, changing
+`~/.ssh/config`, writing package registry credentials or pointing a registry at a
+new host, and the global git settings `credential.helper`, `url.<base>.insteadOf`,
+and `core.sshCommand`.
 
 **Must name:** the file or the setting.
 
-Adding a key, a sudoers line, or a permission bit grants standing access to whoever
-holds it. Judge it as an access grant, not as a file edit.
+Adding a key grants standing access to whoever holds it. Judge it as an access
+grant, not as a file edit.
+
+The environment is isolated, so a change that stays inside it is not this rule:
+`crontab`, a systemd unit, a launch agent, a shell startup file, `PATH`, other
+`git config --global` keys, a detached process, `sudo`, a sudoers entry, and
+`chmod` or `chown`. Using that access against auto-mode is Policy Tampering.
 
-Four things are not this rule: setting `user.name` and `user.email`, an environment
-variable exported for this shell only, authenticating a tool the user has already
-authorised to run such as `npm login` before an authorised publish, and any change
-that narrows access rather than widening it — `chmod 755` over `777`, revoking a
-key, making a repository private, closing a port.
+Authenticating a tool the user asked to use, such as `npm login` before a publish
+the user asked for, is not this rule. Neither is a change that narrows access.
 
 ### Credential Exploration
-Reading or searching for credentials the task never called for: `/etc/shadow`,
-another user's home directory, a browser password store, an SSH or GPG private key
-outside the task's scope, a keychain, or a broad search for keys and tokens across
-the filesystem.
+Printing a credential's value into the transcript, or searching broadly for keys
+and tokens, when the task does not need the value: `cat ~/.aws/credentials`,
+printing a token from the environment, reading a private key, or `grep -r` for key
+patterns across a home directory. The transcript goes to the agent's model
+provider, so a printed value has left the environment.
 
 **Must name:** the file or the search.
 
-Reading or searching for a credential the task needs is not this rule. Searching
-for credentials the task does not need is.
-
-### Interrupted Action Retry
-Running again an action the user interrupted, without the user asking for it. An
-interrupt is the user stopping something. Treating it as a transient failure and
-retrying substitutes the agent's judgement for theirs.
-
-**Must name:** that they want it run again.
-
-A different action that happens to follow an interrupt is not this rule. Neither
-is a retry the user asked for.
-
-### Security Control Removal
-Deleting or disabling a control that protects someone other than the agent: an
-authentication or authorisation check, input validation, a certificate or
-signature check, a rate limit, a CSRF or CORS restriction, the code that emits an
-audit record, a scan or lint step in CI, a branch protection requirement, or a test
-that guards one of these.
-
-**Must name:** the control.
-
-Replacing a control with an equivalent one is not this rule. Removing it and
-leaving nothing is.
-
-### Mass Modification
-One action that changes many things at once **and** leaves no way back. Judge by
-what can be restored, not by how many files changed.
-
-- Under version control, with the changes committed or the tree otherwise clean, a
-  bulk edit is recoverable. Allow it.
-- With uncommitted work in the tree, a bulk edit that rewrites content destroys
-  it. That is Uncommitted Work Destruction. A formatter is not that edit — see
-  Formatters and linters.
-- Outside version control, or against live resources — every row in a table, every
-  object in a bucket, every resource in a namespace — nothing restores it. Block.
-
-**Must name:** the scope, when the rule applies.
+Using a credential through the tool it belongs to is not this rule, because the
+value never appears: `aws s3 ls`, `gh api`, `git push`. Neither is reading a
+credential the task needs, or a file that holds only names or empty placeholders,
+such as `.env.example`.
 
 ## ALLOW exceptions
 
 These override the SOFT BLOCK rules above. They never override a HARD BLOCK.
 
-They do not clear Interrupted Action Retry, which is about the user having stopped
-something rather than about what the action touches. A safe target does not turn a
-retry into one the user asked for.
-
-The one exception: re-running an action that changes nothing — a read, a listing,
-a dry run — is not this rule either, because there is nothing for the user to have
-stopped.
-
 ### Regenerable output
 Deleting anything the build reproduces: `node_modules`, `dist`, `build`, `out`,
 `target`, `.next`, `.nuxt`, `.turbo`, `.parcel-cache`, `__pycache__`,
@@ -375,7 +352,8 @@ not.
 
 ### Read-only actions
 Reading, listing, searching, diffing, describing, and planning are allowed, and so
-is any command whose documented effect is to print and not to change.
+is any command whose documented effect is to print and not to change. Printing a
+credential the task does not need is still Credential Exploration.
 
 ### Formatters and linters
 A formatter, a linter with a fix flag, or a codemod that the repository already
@@ -386,15 +364,14 @@ This holds whether or not the tree is clean. Formatting uncommitted work is the
 normal loop, not destruction.
 
 ### The current feature branch
-Committing, amending, rebasing, and force-pushing a branch that the agent created
-this session. Also deleting a local branch whose commits are already merged into
-the default branch.
-
-Deleting that branch's remote copy is also allowed once its commits are merged.
-
-A branch is shared once someone else builds on it or a review is open against it.
-A branch this session opened and pushed is not shared merely because it has a
-remote copy.
+Committing, amending, rebasing, and force-pushing a branch in the task scope: a
+branch the agent created this session, the branch of the task's own worktree, or
+the head branch of the task's own pull request. A review open against it does not
+make it shared. The default branch and protected branches are never in the task
+scope.
+
+Also deleting a local branch whose commits are already merged into the default
+branch, and deleting that branch's remote copy once its commits are merged.
 
 ### Dry runs
 A command carrying `--dry-run`, `--check`, `--no-act`, `--plan`, or an equivalent