Permissions overhaul: agents run on their own by default
- Autonomous by default. A new setup step lets you pick how much agents do on their own: Autonomous (the default), Permissive, Standard or Secure, each described by what it actually does. Existing settings carry over: Lenient becomes Permissive, Balanced becomes Standard, Strict becomes Secure.
- No built-in rules. Every rule, including the old
git pushand.envdenies, can be edited or removed in Settings → Permissions. Autonomous still blocks reading credential files and destructive commands such as force pushes, and asks before pushes into your default branch orrelease/*. - One question instead of many. Similar requests are grouped in the Inbox and offered in their general form, such as every push into your default branch, everything under
src/, ornpm test *. One answer covers them all, and you can narrow it to the exact request first. - Saved actions. Allows and denies you save from the Inbox keep their scope and expiry, and you can edit or delete them in Settings → Permissions. They only apply within the current rules' limits.
- Stall notice. The Inbox shows which workers are paused and why, with Allow all, Always allow, and a one-click fix for requests a deny rule blocks.
- Fewer stalls on read-only commands.
grep,cat,ls,git logand similar run once brindle has checked them, including with pipes, quotes and escapes. - Every tool is checked, not only shell commands.
- One switch.
permission_policyis the only on/off setting;permission_essentialsis gone, and an old config that sets it still loads.
Saved actions and the grouped Inbox are in the desktop app for now; CLI commands for them are tracked in #285.