From 298899fcf10a44ca0fc4383c2910b01a801da6fe Mon Sep 17 00:00:00 2001 From: Georgiy Tarasov Date: Thu, 16 Jul 2026 14:58:29 +0000 Subject: [PATCH] chore(posthog-ai): fix stale toolPolicy provenance comment The header claimed the deployed agent-server runs in default permission mode and asks on every PostHog exec call. The web surface actually starts runs in auto mode, where the agent-server auto-runs built-ins and (as of PostHog/code#3514) emits permission requests for PostHog exec calls including destructive sub-tools. Describe the actual contract. Co-Authored-By: Claude Opus 4.8 --- .../posthog_ai/frontend/policy/toolPolicy.ts | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/products/posthog_ai/frontend/policy/toolPolicy.ts b/products/posthog_ai/frontend/policy/toolPolicy.ts index 5f1cd45172cd..266fcef18c8c 100644 --- a/products/posthog_ai/frontend/policy/toolPolicy.ts +++ b/products/posthog_ai/frontend/policy/toolPolicy.ts @@ -6,14 +6,16 @@ import type { PermissionRequestRecord } from '../types/streamTypes' export { isPostHogExecTool } from '../components/tool/posthogExecDisplay' /** - * Default sandbox tool-permission policy, ported from Twig - * (`packages/agent/src/adapters/claude/permissions/posthog-exec-gate.ts`). + * Default sandbox tool-permission policy, mirroring the agent-server's exec gate + * (`packages/agent/src/adapters/claude/permissions/posthog-exec-gate.ts` in PostHog/code). * - * The deployed agent-server runs in `default` mode and asks for approval on every PostHog `exec` - * call. We mirror Twig's policy on the client instead: auto-approve every built-in (default) tool - * and every PostHog `exec` operation EXCEPT the destructive ones (update/delete/destroy/ - * partial-update), which still surface the approval card. Non-PostHog MCP tools fall outside the - * default-allow contract and also prompt. + * The web surface starts runs in `auto` mode (`INITIAL_PERMISSION_MODE`): the agent-server + * auto-runs built-ins (edits, shell) server-side and emits a `permission_request` for every + * PostHog `exec` call — including destructive sub-tools, which its gate deliberately does not + * skip in `auto` mode. This client policy decides those requests: auto-approve every `exec` + * operation EXCEPT the destructive ones (update/delete/destroy/partial-update), which surface + * the approval card. Built-ins are auto-approved too as a fallback for modes where the server + * does ask. Non-PostHog MCP tools fall outside the default-allow contract and also prompt. */ /** A sub-tool is destructive when one of these verbs appears as a whole `-`-bounded segment. */