aid: start every agent in full auto, not just claude - #585
Conversation
`aid --claude` has run with `--dangerously-skip-permissions` since the Python build. `aid --codex` and `aid --gemini` ran their CLIs bare, so codex stopped at its first approval prompt and gemini at its first tool call, and an `aid owner/repo fix the bug` on either opened a workspace, printed a question and waited for somebody who had already walked away. The reason for claude's flag was never claude-specific. It is that the agent is already inside a disposable container holding only this repo, so the per-tool prompts buy nothing, and that is true of every row in the table. So the table now carries a full-auto flag per agent: `--dangerously-skip-permissions` for claude, `--dangerously-bypass-approvals-and-sandbox` for codex, `--yolo` for gemini. **codex gets the bypass and not `--full-auto`.** That is the trap here, because `--full-auto` reads like the answer: it approves every action, and it keeps codex's own sandbox, which is workspace-write with the network off. `gh`, `cargo fetch` and `pip install` would fail inside a container that has a network and a checkout the agent is meant to be able to push from. The container is already the sandbox, so a second one nested inside it removes exactly the capabilities `dl` provisioned. Held as a rule, not as three assertions. `every_agent_starts_in_full_auto` reads `AGENTS` and asserts its own length against the list of spellings it expects, so an agent added without a flag fails there rather than in somebody's unattended run. The spellings are named rather than pattern-matched, because `--full-auto` matches any pattern loose enough to cover three CLIs and picking it would be a silent regression. The full-auto table added to docs/cli.md is a second hand-maintained copy of that fact, so it gets the guard this repository requires beside one: `the_full_auto_section_names_the_flags_each_agent_is_actually_started_with` parses the table under the heading and diffs each row against the command the devpod shim receives, which is a launch rather than another copy of the list. Verified to bite by rewriting the codex row to `--full-auto` and watching it fail. The README paragraph that said the trade applied "to `aid` starting `claude` and nothing else" is now wrong and says so. Closes #584
Reviewer's Guide
Sequence diagram for full-auto aid agent launchsequenceDiagram
participant User
participant Aid
participant Devpod
participant Agent
User->>Aid: aid --agent owner/repo prompt
Aid->>Aid: build_agent_command()
Aid->>Devpod: launch workspace with agent command
Devpod->>Agent: start CLI in full-auto mode
Note over Agent: claude --dangerously-skip-permissions<br/>codex --dangerously-bypass-approvals-and-sandbox<br/>gemini --yolo
Agent-->>User: run unattended without approval prompts
Flow diagram for managed versus manual agent commandsflowchart LR
A[aid agent launch] --> B[CLI-specific full-auto flag]
B --> C[Disposable container workspace]
C --> D[Unattended agent run]
E[dl workspace -- command] --> F[Run command exactly as typed]
F --> G[No flags or environment changes]
File-Level Changes
Assessment against linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="rust/aid/tests/rewrite.rs" line_range="586-590" />
<code_context>
fn gemini_gets_its_interactive_flag_only_beside_a_prompt() {
assert_eq!(
build_agent_command("gemini", "hi", None).as_deref(),
- Some("gemini --prompt-interactive hi")
</code_context>
<issue_to_address>
**issue (testing):** The documentation guard checks only that the parsed table has three rows and that each parsed agent name is recognized; it does not require the three names to be distinct or to cover `claude`, `codex`, and `gemini`. Replacing one row with a duplicate recognized agent while omitting another therefore makes the test pass despite the table being incomplete.
**Triggers:** When the hand-maintained table is edited with a duplicated agent row and a different agent is omitted.
**Suggested fix:** Collect the parsed agent names into a set and assert equality with the expected agent set, while also rejecting duplicate rows.
</issue_to_address>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Four findings from Sourcery and a fresh-context review of 6b18b3e, none in the behaviour and all in what was written to hold it. **Both guards counted rows where they had to compare names.** `every_agent_starts_in_full_auto` asserted `expected.len()` against `AGENTS.len()`, which never checks that `expected` *covers* the table: dropping claude's flag and duplicating codex's row is still three rows beside a three-row table, and the review demonstrated it passing with claude launching bare. The docs guard had the same shape, and Sourcery broke it on sight. Both now diff the sorted set of names, which subsumes the count. **Both compared flags by substring.** Every truncation of a flag is a substring of it and so is every flag that merely starts with one, so a docs table reflowed down to `--d` passed, and `command: &["gemini", "--yolo-dry-run"]` passed a `contains("--yolo")` while asking gemini for the opposite of full auto. Both now compare whole argv words. This is the trap `the_force_placement_section_quotes_the_refusals_it_says_it_does` already recorded for the same reason, and the comments now cite each other. `full_auto_rows`'s `["claude", "codex", "gemini"]` allow-list was itself a fourth copy of the agent list, and worse than a copy: it *skipped* any row naming a fourth agent, so that row's flag went unchecked. Rows are now recognised by shape, a single backticked word in the first cell, and an unknown name reaches the caller and fails at the launch. The backticks are what separate a row from the `| --- |` separator, whose cells begin `--` and parsed as an agent named `---`. **`--full-auto` does not approve every action, and saying it did conceded the argument.** It is an approval policy plus a sandbox, not an absence of approvals, so it still escalates to a person (openai/codex#6522, openai/codex#4847). That is the *strongest* reason not to use it here, because stopping to ask is the whole of what #584 is about, and the prose had thrown it away and kept only the sandbox half. Corrected in the table's doc comment, docs/cli.md, the changelog and the README. Only `--dangerously-bypass-approvals-and-sandbox` sets the policy to never ask. **The README was a third hand-maintained copy of the flags with no guard on it.** The review made all three wrong and both suites stayed green, which is fair: the PR invoked the standing rule to justify a guard for docs/cli.md and then left the same fact next door unguarded. Rather than add a fourth guard, the README now states the rule and links the docs table for the spellings, keeping claude's flag because the `IS_SANDBOX=1` paragraph is about it. That is what "README orients, docs explains" asks for anyway, and the new anchor is checked by test_docs_links. Also: the docs table was headed "What `aid` runs" while showing less than a launch does, since a default claude line also carries `CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1` and `--remote-control=<workspace>`. It is headed "Full-auto flag" now and says what it omits. docs/cli.md's opening paragraph enumerates the page's sections and had not been extended for the new one. Not verifiable here and stated rather than claimed: neither codex nor gemini is installed in this container, so `gemini --yolo --prompt-interactive <prompt>` is checked as a string the fake devpod records and not as a process that ran.
|
Review round on Both guards counted rows where they had to compare names. Both compared flags by substring. Every truncation of a flag is a substring of
The README was a third hand-maintained copy of the flags with no guard. All three Also swept and clear, per that review: Both hardened guards were re-verified to bite on the exact inputs the review used. One claim no test in this repo can reach, stated rather than implied: neither |
1 participant
Closes #584.
aid --claudehas run with--dangerously-skip-permissionssince the Python build.aid --codexandaid --geminiran their CLIs bare, so codex stopped at its firstapproval prompt and gemini at its first tool call. An
aid owner/repo fix the bugon either of them opened a workspace, printed a question, and waited for somebody
who had already walked away.
The reason for claude's flag was never claude-specific: the agent is already inside
a disposable container holding only this repo, so the per-tool prompts buy nothing.
That is true of every row in the table, so every row now carries a flag.
aidrunsclaudeclaude --dangerously-skip-permissions, withIS_SANDBOX=1beside itcodexcodex --dangerously-bypass-approvals-and-sandboxgeminigemini --yolocodex gets the bypass and not
--full-autoThis is the one decision in the change worth arguing with.
--full-autoreads likethe answer: it approves every action. It also keeps codex's own sandbox, which is
workspace-write with the network off, so
gh,cargo fetchandpip installwouldfail inside a container that has a network and a checkout the agent is meant to be
able to push from. The container is already the sandbox; nesting a second one inside
it subtracts exactly the capabilities
dlwent to the trouble of provisioning.Guards
Two, and they promise different things.
every_agent_starts_in_full_autoholds the rule against the table rather thanagainst one row: it asserts its expected list against
AGENTS.len(), so an agentadded later without a flag fails there instead of in somebody's unattended run. The
spellings are named rather than pattern-matched, because
--full-automatches anypattern loose enough to cover three CLIs.
The full-auto table added to
docs/cli.mdis a second hand-maintained copy of afact
rewrite.rsowns, so it gets the diff test this repository requires besideone.
the_full_auto_section_names_the_flags_each_agent_is_actually_started_withparses the rows under the heading and diffs each against the command the devpod shim
actually receives, which is a launch rather than another copy of the list. Verified
to bite: rewriting the codex row to
--full-autofails it with the page and thelaunch printed side by side.
What is unchanged
A command you typed yourself.
dl <ws> -- codexruns codex, exactly as written,with no flags added and no variables set. The README paragraph that said the trade
applied "to
aidstartingclaudeand nothing else" was the sentence this changefalsifies, and it is rewritten rather than left standing.
Checks
cargo test --workspace(32 suites),cargo clippy --locked --all-targets -D warnings,cargo fmt --checkandpixi run test(717) all pass in the container.🤖 Generated with Claude Code
Summary by Sourcery
Start every agent launched by
aidin its CLI-specific full-auto mode to support unattended workspace runs.Bug Fixes:
aidruns no longer stop at approval or tool prompts.Enhancements:
dlcommands unchanged while applying agent-specific full-auto flags only to agents launched byaid.Documentation:
Tests:
aid.