Repository navigation
Nag-free defaults: record approved commands and suggest allow rules #73
Description
Why
Every ask the hook produces for routine work is a prompt the user will eventually click through without reading. The defaults must be quiet on ordinary work and loud only on the incident classes.
Scope
- Register a
PostToolUsehook alongsidePreToolUseso Nomos can record which asked commands the user then approved and ran (the pre-hook never learns the outcome on its own). nomos hook claude-code --suggest: read the audit log and print candidate allow rules, as a YAML snippet, for the most frequent asked-then-approved commands. Suggestions are printed for a human to review and commit; nothing edits a policy automatically.- Tune the
safe-devprofile using the corpus from the replay work so build, test, lint, package-install, and read-only git commands inside the workspace do not prompt, while every incident case still denies or asks. Document that allowing a test runner or package script allows the project code it runs.
Acceptance
- The corpus ask rate for
safe-devdrops and is recorded in the release notes. - The incident suites in
examples/incidents/and the bypass regression tests stay green. - Suggestions never apply themselves; the guide says so.
Roadmap: milestone 2 in docs/roadmap.md.
Activity
safe-agentic-world commentedon Sep 26, 2026
Shipped across v0.15.0 (PR #80) and v0.16.0 (PR #81):
PostToolUsehook that records which asked-about calls actually ran (hook.completedevents in the same audit chain), andnomos hook claude-code --suggestproposes allow rules from the calls that were asked about and then approved. It prints a YAML snippet; nothing is written to a policy.safe-devwas tuned against the corpus: precise catastrophic-delete rules instead of every absolute path, the everyday git workflow, the project toolchain, and workspace file operations allowed inside the workspace,rmand secret-file writes asked about, and inline interpreter code and bare interpreters asked about. On the corpus,safe-devallows went from 157 to 669 of 1,526 commands and denies from 13 to 2; every incident case still denies or asks.Remaining asks on the corpus are mostly
$VARIABLES, substitutions, and pipes intobash(refused by design), plus a tail of project scripts (./scripts/x.sh),pixi/cross-env/tsxwrappers, andgit config. Those are the next tuning round and will get their own issue; the noisy-decision template is the way to report a benign command that prompts.Generated by Claude Code