Hacker News Reader

Comment by jawiggins | Hacker News Reader

I use `--dangerously-skip-permissions` and have yet to have it wipe my drive :shrug:. I don't know how I'm supposed to be running dozens of parallel agents each with their own sub-agents while trying to approve commands from each of them, it's just won't scale to the amount of work I need to get done.

View on HN

The permissions system seems to be mostly finegrained to help you from problems that backups and sandboxes already solve.

The more dangerous activities I find are sending messages to the outside world: I can't undo a dumb slack message to my boss.

That's fair, I have sent a, "Sorry claude sent that and I didn't tell him to", message before.

The big problem is that in general I want slack to be able to send some messages (otherwise I would ban that). But the difference between good and bad messages is something that's hard to judge mechanically.

I never want Claude or any AI to post messages as myself..., if I'd wanted Claude to send a message to Slack, I'd want him to identify as Claude, or use some bot token, where it's clearly visible I'm not the one posting it (while I can still instruct Claude to say that the message was prompted by me).

There may have been a miscommunication about the ask. I don’t think any software user ordered “run dozens of parallel agents each with their own sub-agents.”

Why not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?

Because I often want it to write and execute scripts in it's thinking loop in order to test assumptions or fetch data to come up with better solutions.

Can't it write `/tmp/test.sh` or `./test.sh` and execute it under my approach? This is what I've been doing as my status quo workflow with Codex, and I make sure I run Codex from a place where `.` happens to be a folder I'm okay with it messing up in.

That's how codex already works so you're not suggesting anything new, but it doesn't give write access at all of you set it to read only.

And when "it" is an arbitrary bash/python/javascript command, what then?

Reply on news.ycombinator.com