Hacker News Reader

Have you consider asking your agent to set up basic permission deny rules to block dangerous commands? Just ask it and request that it shows you the config before applying it.

View on HN

I can add some basic configs, but it seems kinda provider dependent, so I'm gonna need to do this differently for Claude, Cursor, and Codex. It will also require a custom pre-tool use plugin to allow something like "AI can generate DB migrations via CLI but cannot handwrite them", which is pretty annoying when I need a separate one per model

Some of the configs are fairly similar, and if you bundle in a plugin they can be distributed without much ceremony. Something you can do for forcing cli migration generation is to write a pretool hook.

Here’s an example of shared hooks.

https://frontmatter.news/kinds/hook

This website also has markdown versions of pages and references source docs so you can point your agent to the page and ask it to crawl to the docs pages to reference the hook json definition.

Reply on news.ycombinator.com