Conversation
…Edits bypassPermissions silently ignores --allowed-tools, making the tool allowlist ineffective as a security boundary. acceptEdits still supports headless CI execution (auto-approves file edits) while enforcing MCP tool restrictions via --allowed-tools. Recompile all 57 affected lock files." Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f2a224d7-4a44-458e-96eb-62aedb6621d8 Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix allowed-tools flag ineffectiveness in bypassPermissions mode
fix(claude): replace bypassPermissions with acceptEdits to enforce --allowed-tools
Apr 23, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR closes a security gap in the Claude engine where --permission-mode bypassPermissions causes --allowed-tools to be ignored, making all MCP gateway tools reachable regardless of workflow configuration.
Changes:
- Switch Claude CLI permission mode from
bypassPermissionstoacceptEditsso--allowed-toolsremains enforced. - Update Claude engine test to assert the new permission mode.
- Regenerate workflow lock files to reflect the updated Claude CLI invocation.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/claude_engine.go | Uses --permission-mode acceptEdits to ensure --allowed-tools is honored as the effective tool boundary. |
| pkg/workflow/claude_engine_test.go | Updates test expectation to match acceptEdits. |
| .github/workflows/api-consumption-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/approach-validator.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/audit-workflows.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/aw-failure-investigator.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/blog-auditor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/ci-doctor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/claude-code-user-docs-review.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/cli-version-checker.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/cloclo.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/commit-changes-analyzer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/copilot-agent-analysis.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/copilot-session-insights.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-aw-cross-repo-compile-check.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-choice-test.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-code-metrics.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-doc-healer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-doc-updater.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-function-namer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-multi-device-docs-tester.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-otel-instrumentation-advisor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-rendering-scripts-verifier.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-safe-output-optimizer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-safe-outputs-conformance.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-security-red-team.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-team-evolution-insights.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-token-consumption-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/deep-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/design-decision-gate.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/developer-docs-consolidator.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/example-workflow-analyzer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/github-mcp-structural-analysis.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/github-mcp-tools-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/go-fan.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/go-logger.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/go-pattern-detector.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/hourly-ci-cleaner.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/instructions-janitor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/lockfile-stats.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/prompt-clustering-analysis.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/safe-output-health.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/schema-consistency-checker.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/scout.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/semantic-function-refactor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/sergo.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-all-merged.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-all-none.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-public-approved.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-public-none.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-scoped-approved.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-claude.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/spec-enforcer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/static-analysis-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/step-name-alignment.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/test-create-pr-error-handling.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/typist.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/unbloat-docs.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 59/59 changed files
- Comments generated: 0
Contributor
🧪 Test Quality Sentinel ReportTest Quality Score: 90/100✅ Excellent test quality
Test Classification Details
Test Analysis✅
|
Collaborator
|
@copilot review all comments |
Contributor
Author
Reviewed all comments. The automated reviewer examined all 59 changed files and raised 0 issues. The Test Quality Sentinel approved at 90/100. No action needed. |
Contributor
|
🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥 |
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
|
Contributor
|
|
Contributor
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
Contributor
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Contributor
|
Smoke test
Warning The following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
Contributor
Author
Root cause: Switching Fix (commit
57 lock files recompiled to reflect the updated Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix(claude): replace bypassPermissions with acceptEdits to enforce --allowed-tools
fix(claude): replace bypassPermissions with acceptEdits and fix missing MCP server tools in --allowed-tools
Apr 23, 2026
Collaborator
|
@copilot also make sure that when mount-as-clis is enabled, the proper allowed commands are added |
Contributor
Author
Already investigated and fixed in commit |
Collaborator
|
@copilot when bash: "*" is used, you can use bypassPermissions |
…mount-as-clis CLI allowlist Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5926ddff-01b7-47e2-a8d5-25d9e494cf63 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
When
Done in commit Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
❌ Smoke CI failed. Please review the logs for details. |
Contributor
|
|
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
|
|
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
Contributor
|
📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident... |
Contributor
|
🔥 Smoke Test Results — Run 24845823251
Overall: PARTIAL — Test #10 (Agentic Workflows MCP) failed:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal! This PR correctly fixes the bypassPermissions → acceptEdits security issue and adds proper system MCP server entries to --allowed-tools. The test coverage is solid.
💥 [THE END] — Illustrated by Smoke Claude · ● 241.1K
| @@ -12,6 +12,35 @@ import ( | |||
|
|
|||
| var claudeToolsLog = logger.New("workflow:claude_tools") | |||
|
|
|||
Contributor
There was a problem hiding this comment.
Smoke test review comment #1 — The new hasBashWildcardInTools helper is a clean, focused function. The documentation clearly explains the security rationale: when bash is unrestricted, the agent can reach any tool via the shell anyway, so bypassPermissions is the right choice. Consider adding a note about the :* pattern meaning "all subcommands" for future readers who may not be familiar with that convention.
| assert.Contains(t, stepContent, "--permission-mode acceptEdits", "Expected acceptEdits with restricted bash") | ||
| } | ||
|
|
||
| func TestClaudeEnginePermissionMode(t *testing.T) { |
Contributor
There was a problem hiding this comment.
Smoke test review comment #2 — The TestClaudeEnginePermissionMode table-driven test provides excellent coverage for all the bash access combinations. The pattern of asserting both expectedMode and notExpectedMode is a nice defensive approach that prevents false positives. Well done!
Contributor
|
Hey
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--permission-mode bypassPermissionssilently ignores--allowed-tools, meaning every tool the MCP gateway exposes is reachable regardless of the workflow's declared tool configuration. This nullifies the primary tool-restriction security control for the Claude engine.Switching to
acceptEditsproperly enforces--allowed-tools, but exposed a secondary issue: several system and implicit MCP servers were never added to the allowlist, so their tools were silently blocked underacceptEdits.Changes
pkg/workflow/claude_engine.go: Conditionally select--permission-modebased on bash access:acceptEdits(default) — properly enforces--allowed-toolsas the MCP tool security boundary, supports headless CI execution via auto-approval of file edits.bypassPermissions— used when the workflow grants unrestricted bash access (bash: "*"). With full bash access the agent can reach any tool via the shell regardless, so--allowed-toolsprovides no meaningful security boundary andbypassPermissionsproduces a smoother headless experience. The threat detection step always usesbash: ["*"]by design and also getsbypassPermissions.pkg/workflow/claude_tools.go: AddhasBashWildcardInToolshelper that detects unrestricted bash (bash: "*",bash: ":*", or non-list bash value). FixcomputeAllowedClaudeToolsStringto include all system/implicit MCP servers in--allowed-tools:mcp__safeoutputs— added whensafe-outputsis configured (was the direct cause of no safe outputs being created)mcp__mcpscripts— added when mcp-scripts is configured (addsmcpScripts *MCPScriptsConfigparameter)mcp__agenticworkflows— theagentic-workflowstool has a bool value, not a map, so it was silently dropped by the type assertion; now handled explicitlyallowed:key (e.g.serena) — previously produced nomcp__*entry; now default to amcp__<serverName>wildcardpkg/workflow/claude_engine_test.go: AddTestClaudeEnginePermissionModetable tests assertingbypassPermissionsforbash: "*"andacceptEditsfor restricted/absent bash. EnhanceTestClaudeEngineAllowsMountedMCPCLICommandsInRestrictedBashto assertacceptEditsis used (notbypassPermissions) when bash is restricted andmount-as-clisis enabled.pkg/workflow/claude_engine_tools_test.go: AddTestHasBashWildcardInToolsunit tests and update assertions to reflect the new tools added to the allowlist.--permission-modeand--allowed-toolsflags. Workflows withbash: "*"now emitbypassPermissions; all others emitacceptEdits.✨ PR Review Safe Output Test - Run 24845823251