golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

feat(#767): inject disallowedTools deny-list into Claude read-only agents (#1081)

Browse Source 
Install-time injection of a disallowedTools deny-list into Claude copies of read-only verifier/auditor agents (mirrors the #443 effort injection); source agents stay runtime-neutral so Gemini/Qwen/Hermes are unaffected. Closes #767.
This commit is contained in:
Tom Boucher
2026-06-11 22:25:43 -04:00
committed by GitHub
parent ce0ec808fb
commit e644819d59
4 changed files with 290 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/767-disallowed-tools-readonly-agents.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Changed
pr: 1081
---
**Read-only verifier/auditor agents now ship a Claude-Code `disallowedTools` deny-list** — the installer injects a framework-level write-tool deny-list into the Claude copies of the read-only verifier/auditor agents (gsd-verifier, gsd-plan-checker, gsd-integration-checker, gsd-doc-verifier, gsd-eval-auditor, gsd-ui-auditor, gsd-ui-checker) so write actions are blocked even if a tool grant is inherited. Injected for Claude only; other runtimes are unaffected. (#1081)