Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A context-aware permission guard for Claude Code

github.com

Post reply on HN
Print view View original

61–70 of 109 posts

Re: Show HN: A context-aware permission guard for Claude Code

#61

Post by schipperai »

bryanlarsen wrote: post #33
binwiederhier wrote: post #22

I love how everyone is trying to solve the same problems, and how different the solutions are. I made this little Dockerfile and script that lets me run Claude in a Docker container. It only has access to the workspace that I'm in, as well as the GitHub and JIRA CLI tool. It can do whatever it wants in the workspace (it's in git and backed up), so I can run it with --dangerously-skip-permissions. It works well for me…

> as well as the GitHub and JIRA CLI tool That's a pretty powerful escape hatch. Even just running with read-only keys, that likely has access to a lot of sensitive data....

100% - lots of commands with server side effects out there

Re: Show HN: A context-aware permission guard for Claude Code

#62

Post by MadsRC »

Very interesting!

I’ve got an internal tool that we use. It doesn’t do the deterministic classifier, but purely offloads to an LLM. Certain models achieve a 100% coverage with adversarial input which is very cool.

I’m gonna have a look at that deterministic engine of yours, that could potentially speed things up!

Re: Show HN: A context-aware permission guard for Claude Code

#64

Post by schipperai »

robertkarljr wrote: post #37

This is pretty rad, just installed it. Ironically I'm not sure it handles the initial use case in the github: `git push`. I don't see a control for that (force push has a control). The way it works, since I don't see it here, is if the agent tries something you marked as 'nah?' in the config, accessing sensitive_paths:~/.aws/ then you get this: Hook PreToolUse:Bash requires confirmation for this command: nah? Bash: t…

thx! yeah git push is intentionally allowed, it's normal dev workflow operation. but git push --force on the other hand gets flagged as 'git_history_rewrite = ask'.

if you want regular push to also require approval you can set that in your config with nah deny git_write and you get other 'git_writes = ask' for free.

Re: Show HN: A context-aware permission guard for Claude Code

#65

Post by schipperai »

MadsRC wrote: post #62

Very interesting! I’ve got an internal tool that we use. It doesn’t do the deterministic classifier, but purely offloads to an LLM. Certain models achieve a 100% coverage with adversarial input which is very cool. I’m gonna have a look at that deterministic engine of yours, that could potentially speed things up!

cool - which models are you seeing 100% on adversarial input? I'd love to see the benchmark if you published it somewhere. In my recent sessions while building nah, the deterministic layer handled about 95% of inputs with zero latency/tokens over 13.5k tool calls, 1.5 days of coding, 84% allowed, 12% asked, 5% blocked. All decision logged to ~/.config/nah/nah.log - so you can audit its efficiency

Re: Show HN: A context-aware permission guard for Claude Code

#66

Post by shanjai_raj7 »

been running with dangerously-skip-permissions for months and the thing that actually makes me nervous isn't the big obvious stuff, it's when claude makes small quiet edits to things you didn't ask it to touch and you only notice hours later when something breaks. does this catch that kind of thing or is it mostly focused on the bigger destructive actions?

Re: Show HN: A context-aware permission guard for Claude Code

#67

Post by schipperai »

shanjai_raj7 wrote: post #66

been running with dangerously-skip-permissions for months and the thing that actually makes me nervous isn't the big obvious stuff, it's when claude makes small quiet edits to things you didn't ask it to touch and you only notice hours later when something breaks. does this catch that kind of thing or is it mostly focused on the bigger destructive actions?

Every single tool call goes thru nah, including Write and Edit. nah checks the paths: is it outside your project? flags it as ask. nah log shows every decision so you can audit yourself...

However, in terms of code quality and regressions - I also wrote about my workflow for keeping agents controlled: https://schipper.ai/posts/parallel-coding-agents/ basically no code changes until the plan is signed off, if big enough, a task gets its own worktree to avoid conflicts between agents.

nah was built with this method and I am very happy with the code quality. I personally only do "accept edits on" when the plan is fully signed off and ready to implement. Every edit goes thru me otherwise.

Between nah and FDs, things stay pretty tight even with 5+ agents in parallel.

Re: Show HN: A context-aware permission guard for Claude Code

#68

Post by felix9527 »

Interesting approach to the PreToolUse side. I've been building on the other end — PostToolUse hooks that commit every tool call to an append-only Merkle tree (RFC 6962 transparency log style).

  The two concerns are complementary: "nah" answers "should this action be allowed?" while a transparency log answers "can we prove what actually happened, after the fact?"

  For the adversarial cases people are raising (obfuscated commands, indirect execution) — even if a classifier misses something at pre-execution time, an append-only log with inclusion proofs means the action is still
  cryptographically recorded. You can't quietly delete the embarrassing entries later.

  The hooks ecosystem is becoming genuinely useful. PreToolUse for policy enforcement, PostToolUse for audit trail, SessionStart/End for lifecycle tracking. Would be great to see these compose — a guard that also commits
  its allow/deny decisions to a verifiable log.

Re: Show HN: A context-aware permission guard for Claude Code

#69

Post by schipperai »

felix9527 wrote: post #68

Interesting approach to the PreToolUse side. I've been building on the other end — PostToolUse hooks that commit every tool call to an append-only Merkle tree (RFC 6962 transparency log style). The two concerns are complementary: "nah" answers "should this action be allowed?" while a transparency log answers "can we prove what actually happened, after the fact?" For the adversarial cases people are raising (obfuscate…

Very cool approach! the immutable log file fits well with nah. I'll take it into account for richer audit trail capabilities. Would be curious to see your hook implementation if its public anywhere

Re: Show HN: A context-aware permission guard for Claude Code

#70

Post by schipperai »

binwiederhier wrote: post #22

I love how everyone is trying to solve the same problems, and how different the solutions are. I made this little Dockerfile and script that lets me run Claude in a Docker container. It only has access to the workspace that I'm in, as well as the GitHub and JIRA CLI tool. It can do whatever it wants in the workspace (it's in git and backed up), so I can run it with --dangerously-skip-permissions. It works well for me…

hey - ntfy is very cool! kudos and thanks :)
Post reply on HN