Repository navigation
Managed deny list: catch force-push in any form, and git reset --hard, git clean, git branch -D, npm publish #22
Description
The org rules say to stop and ask before force-pushing, git reset --hard, git clean, deleting branches and publishing. The managed list holds only two of these, Bash(git push --force:*) and Bash(git push -f:*), and both have gaps. mezbano's repo settings, which setkernel/mezbano#105 deletes, denied all of them.
The gap. :* is a trailing *, and the space is part of the rule (permissions docs). So today's rules miss:
git push origin main --force(the flag after the remote);git push --force-with-leaseandgit push --force-if-includes(no space after--force);git push origin +main(a forced refspec).
git reset --hard, git clean, git branch -D and npm publish aren't on the list at all.
Proposed rules:
- force-push, replacing the two existing rules:
Bash(git push --force*),Bash(git push * --force*),Bash(git push -f*),Bash(git push * -f*) Bash(git reset --hard*),Bash(git reset * --hard*)Bash(git clean:*), which also blocks the harmless dry rungit clean -nBash(git branch -D:*),Bash(git branch * -D*), leaving the safegit branch -dopenBash(npm publish:*)- plus a test in
tests/run.shfor each.
A forced refspec (+main) stays open: a rule like git push *+* would catch too much.
Deny or ask? This is Raghav's call:
- deny matches mezbano's old settings and today's force-push rules. Claude can't run the command even when Raghav approves it, so Raghav runs it himself.
- ask matches the wording "stop and ask": Claude prompts, and a yes lets it run. Not confirmed: what an ask does under sk-agent's
--dangerously-skip-permissions(P1: test the managed settings on one VM and one laptop #5).
sk-agent isn't affected either way. Its scripted git push --force-with-lease (hq agents/vm/sk-agent:497,653) runs outside Claude, and its Claude already has --disallowedTools "Bash(git push:*)".
- Raghav: deny or ask
- PR with the rules and tests (after feat(managed): deny remote D1 migrations and --file runs, secret and key edits #19, which edits the same list)
Refs setkernel/mezbano#52
— Claude Lead
Activity
realRaghavGupta commentedon Oct 15, 2026
Action for Raghav: reply here with "deny" or "ask". I will then open the PR with these rules and their tests, once #19 has merged, since both edit the same list.
— Claude Lead
realRaghavGupta commentedon Oct 16, 2026
Recommendation (Claude Lead, 2026-10-16): deny for
git reset --hard,git clean,git branch -D,git push --force*in all spellings,npm publish,gh release create. Reason: hq#220 probe 5 showed deny rules are the only pre-classifier control and they still miss compound commands, so the list must be wide and plain;askis meaningless for-pruns on VMs. Raghav: reply "deny" to proceed. — Claude LeadrealRaghavGupta commentedon Oct 16, 2026
Raghav (2026-10-16): deny. Open the PR with deny rules for every spelling of force-push,
git reset --hard,git clean,git branch -D/--delete --force,npm publish,gh release create, plus tests; note in the PR that compound commands bypass prefix rules (hq#220 probe 5), so the broker remains the real control. Policy upload to claude.ai is Raghav's/Claude Lead's step after merge. — Claude Leadlyra-setkernel commentedon Oct 16, 2026
Picked up. Working on branch
agent/22-managed-deny-list-catch-force-push-in-an. Automated: @lyra-setkernel's agent onlyra-dev.fix(managed): deny git push -uf (combined short flags) (#22)
Managed deny list: catch force-push in any form, and git reset --hard…