public/galaxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add profile permission overrides and orchestration provider selection

Browse Source
This commit is contained in:
rkw6086
2026-10-05 15:48:01 -05:00
parent c5297066ef
commit 679306a103
24 changed files with 392 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+6 -2
View File
@@ -230,8 +230,8 @@ Key invariants:
### Profile Permissions
- Profiles expose exactly one `PermissionMode`: `ReadOnly`, `AskFirst`, or `GalaxyDecides`. Legacy per-tool fields are compatibility projections, not independent settings, and are omitted from persisted profile JSON. Existing profiles migrate from their command permission; unknown modes become Read Only. Command and MCP denylists remain effective.
- Read Only advertises and executes only file/skill/document inspection, code search, grep, and file discovery. Shell commands, mutations, MCP calls, computer use, and delegation are rejected at the action boundary, even if a stale client advertises them.
- Profiles expose exactly one `PermissionMode`: `ReadOnly`, `AskFirst`, `GalaxyDecides`, or `AllowAll`. Legacy per-tool fields are compatibility projections, not independent settings, and are omitted from persisted profile JSON. Existing profiles migrate from their command permission; unknown modes become Read Only. Command and MCP denylists remain effective.
- Read Only advertises and executes file/skill/document inspection, code search, grep, and file discovery. Explicitly allowlisted shell commands are an exception in every mode; shell tools are advertised in Read Only only when that profile has command approvals. All other commands, mutations, MCP calls, computer use, and delegation are rejected at the action boundary.
- Ask First confirms actions through the existing approval pane. Exact shell-command approvals are persisted as bounded digests scoped to the profile, working directory, host, session type, and shell. Changed command text or environment requires approval again. Explicit restrictions cannot be bypassed by remembered commands. Changing modes clears remembered approvals. Approval requests expire after 60 seconds with a correlated denial.
- `app/src/ai/blocklist/action_model/risk_review.rs` assesses Galaxy Decides actions using the terminal-use model in a separate, tool-free request, falling back to the base model when unconfigured. Risk 0–3 runs; risk 4–5 and denylist/protected-path/workspace restrictions deny automatically. Galaxy Decides never requests human permission. Denials return reasons so the agent can revise its scope/justification or choose a safer approach.
- Risk reviews carry chronological available recorded user requests, including intermediate restrictions; oversized review context denies rather than discarding revocations, separate from agent rationale/delegated scenarios. Worker reviews inherit root-conversation authorization; agent claims never establish permission. Later revocations take precedence. An explicitly requested ordinary non-force push within the stated/established remote and branch may be risk 3; external visibility alone is not risk 4. Force/deletion/out-of-scope pushes, secrets, and production changes remain stricter.
@@ -240,6 +240,10 @@ Key invariants:
- Galaxy Decides risk assessment appears only as a transient “Checking permissions…” status above the input, not a per-tool permission pane. Ask First keeps its actionable approval panes. `PermissionReviewChanged` refreshes the owning conversation’s status bar.
- Safe inspection and output polling do not add risk-review model calls. A narrow shell fast path accepts validated `pwd`, `ls`, Git version, and hardened Git status/diff forms; shell expansion, chaining, redirects, unknown flags and unhardened Git commands still require review. Explicit restrictions are checked before fast approval. Galaxy Decides skips user-question pauses. External ACP/CLI agents retain their own protocol permission flows; unstructured ACP requests must not grant Galaxy terminal mutations.
- Allow All bypasses independent model review and human approval for Galaxy-owned tools, while explicit command/MCP denylists, protected paths, workspace restrictions, command ownership, and child delegation boundaries remain enforced.
- Profiles persist `command_allowlist` regular expressions. A matching complete submitted command bypasses permission review in every mode, including Read Only, only after explicit restrictions are checked; denylist matching uses the shell command decomposition as well. Profile permission-mode changes preserve the explicit list but clear remembered command digests.
- Profiles persist `orchestration_providers`: absent/null includes all providers (including future additions); an explicit empty list permits none. Entries use configured provider names. Orchestration tool descriptions and pickers filter models, and RunAgents validates per-child/default model selection again at launch and recovery. Restricted profiles cannot use custom routers or external harnesses to bypass provider selection.
### Platform Setup
- `./script/bootstrap` - Platform-specific setup plus common agent skill installation from `skills-lock.json`; prompts for project/global when an install or update is needed unless a target flag or environment override is provided.
- `./script/bootstrap --skip-common-skills` - Platform setup without installing or updating common agent skills.