toga-ai 1.0.263 → 1.0.264

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.263",
+  "version": "1.0.264",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/skills/kickoff/SKILL.md

@@ -33,6 +33,52 @@ description: Start-of-session context loader for TOGA Technology projects. Run t
 > block message is never to fight it: run Steps 0–3, and the moment preflight executes you
 > are free to read docs and work. (Emergency override only: `KICKOFF_GATE_DISABLED=1`.)
 
+## Session permission policy — auto-accept local file I/O, ALWAYS confirm dangerous execution
+
+> **This policy is in force for the ENTIRE session, from the moment `/kickoff` runs until it
+> ends. It is a standing, team-wide default — apply it without being reminded.**
+>
+> The intent: keep the developer in flow for safe, reversible, local work, while never letting
+> an irreversible or environment-touching action happen without an explicit human "go ahead".
+
+**Auto-accept (proceed without a permission prompt) — safe, local, reversible:**
+
+- **Reading files** — `Read`, `Grep`, `Glob`, and any read-only inspection of the local
+  working tree. Never pause to ask "may I read this?".
+- **Writing/editing files** in the local working tree — `Write`, `Edit`, `NotebookEdit`, and
+  creating new local files. Proceed as long as the target is inside the developer's local
+  checkout(s). (Standard write discipline still applies — see the stub-first rule in Step 6.)
+
+**ALWAYS ask for explicit permission first (never auto-run) — anything that executes, leaves
+the machine, or touches a shared/remote/production environment:**
+
+- **Shell execution** — every `Bash` / PowerShell command runner invocation. Before running
+  one, state what it does and why, and wait for the developer's "go ahead". (The kickoff gate
+  already blocks shell during priming; this extends the caution to the whole session.)
+- **Deploys, AWS / DevOps, and infrastructure** — `/ship`, `/land-and-deploy`, `/canary`, the
+  `devops` agent's AWS CLI/console actions, Elastic Beanstalk / EC2 / RDS / S3 / IAM changes,
+  and any command that mutates infrastructure. Confirm the target environment explicitly.
+- **Remote database access** — the `toga-db` MCP tools (`toga_query`, etc.) and any query run
+  against **production or any non-local environment**. Name the cluster/environment and get a
+  yes before executing. Treat production as require-confirmation on every call.
+- **Network, browser, and remote git** — `WebFetch`/`WebSearch`, the `/browse` browser
+  automation, `git push`, PR creation/merge, and any call that sends data off the machine or
+  writes to a remote. Confirm before each.
+
+**Rules of application:**
+
+1. When in doubt about whether an action executes something or reaches outside the local
+   environment, **treat it as dangerous and ask.** The default for the unknown is *confirm*.
+2. "Auto-accept file I/O" does **not** mean "act without judgment" — still respect
+   `/freeze`, `/guard`, and any directory scoping the developer set.
+3. A blanket "go ahead", "just do it", or "you have full access" from the developer covers the
+   current task's expected actions, but you must **still flag** any dangerous action that falls
+   outside the scope they approved (a different environment, a production write, a deploy).
+4. This is a **directive, not an enforcement mechanism.** For hard, mechanical enforcement the
+   team should also encode these as `permissions` allow/ask rules in the checked-in
+   `.claude/settings.json` (allow `Read`/`Edit`/`Write`; `ask` for `Bash` and the remote/DB/
+   deploy tools). Until that exists, follow this policy by discipline on every session.
+
 ## Arguments — text passed after `/kickoff` never skips any step
 
 Trailing text (e.g. `/kickoff worker2 backend fix for Compass`, even a detailed paragraph
@@ -253,6 +299,10 @@ Tell the developer concisely:
   summaries" list — the developer must see that the core is loaded and which app pulled it in.
 - Which knowledge docs you loaded (by title). Where a repo/standard has **no knowledge yet**,
   say so explicitly: "No knowledge captured yet for X — `capture` will build it as you work."
+- **State the session permission policy in one line** so the developer knows the rules for
+  this session: "File reads and local edits run automatically; anything that executes, deploys,
+  hits a remote/production environment, or leaves this machine, I'll confirm with you first."
+  (See *Session permission policy* near the top of this skill.)
 - Confirm you're primed and ready for their first task.
 
 **Heavy-load check (from preflight `estimate`).** Preflight returns