From e2d2321201cb255d9026c8e1f04173cb2290d248 Mon Sep 17 00:00:00 2001 From: Josh Nichols Date: Wed, 16 Sep 2026 14:22:48 -0400 Subject: [PATCH] claude: always ask before gh repo create gh repo create had no allow/ask/deny rule anywhere, so it fell through to the default ask outside auto mode -- but auto mode routes uncovered commands to a per-action classifier instead of the static list, and that classifier let a `gh repo create ... --public` through without a prompt. Creating a repo is visible-to-others and not meaningfully undone by deleting it afterward, the same class already covered by git push --force/reset --hard in base.jsonc's ask list, so give it an explicit ask rule to guarantee the prompt in every mode. Co-Authored-By: Claude Sonnet 5 --- claude/stacks/github.jsonc | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/claude/stacks/github.jsonc b/claude/stacks/github.jsonc index d442b25..1fcc217 100644 --- a/claude/stacks/github.jsonc +++ b/claude/stacks/github.jsonc @@ -36,6 +36,17 @@ "WebFetch(domain:github.com)", "WebFetch(domain:raw.githubusercontent.com)", ], + // Creating a repo (especially --public) is visible-to-others and not + // meaningfully undone by deleting it after the fact, same class as + // git push --force/reset --hard in base.jsonc's ask list. It had no + // allow/deny/ask rule anywhere else, so outside auto mode it already + // prompted by falling through to the default "ask" -- this entry exists + // so it also prompts *in* auto mode, where an uncovered command is + // instead handed to a per-action classifier that decides whether to + // interrupt, and isn't guaranteed to flag repo creation as needing a + // human. Confirmed once: a `gh repo create ... --public` ran under + // auto mode with no prompt at all before this rule existed. + "ask": ["Bash(gh repo create:*)"], }, // source: agent-safehouse