Skip to content

chore(posthog-ai): fix stale toolPolicy provenance comment #71582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
skoob13 wants to merge 1 commit into from
Closed

chore(posthog-ai): fix stale toolPolicy provenance comment #71582

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 9 additions & 7 deletions products/posthog_ai/frontend/policy/toolPolicy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,16 @@ import type { PermissionRequestRecord } from '../types/streamTypes'
export { isPostHogExecTool } from '../components/tool/posthogExecDisplay'

/**
* Default sandbox tool-permission policy, ported from Twig
* (`packages/agent/src/adapters/claude/permissions/posthog-exec-gate.ts`).
* Default sandbox tool-permission policy, mirroring the agent-server's exec gate
* (`packages/agent/src/adapters/claude/permissions/posthog-exec-gate.ts` in PostHog/code).
*
* The deployed agent-server runs in `default` mode and asks for approval on every PostHog `exec`
* call. We mirror Twig's policy on the client instead: auto-approve every built-in (default) tool
* and every PostHog `exec` operation EXCEPT the destructive ones (update/delete/destroy/
* partial-update), which still surface the approval card. Non-PostHog MCP tools fall outside the
* default-allow contract and also prompt.
* The web surface starts runs in `auto` mode (`INITIAL_PERMISSION_MODE`): the agent-server
* auto-runs built-ins (edits, shell) server-side and emits a `permission_request` for every
* PostHog `exec` call — including destructive sub-tools, which its gate deliberately does not
* skip in `auto` mode. This client policy decides those requests: auto-approve every `exec`
* operation EXCEPT the destructive ones (update/delete/destroy/partial-update), which surface
* the approval card. Built-ins are auto-approved too as a fallback for modes where the server
* does ask. Non-PostHog MCP tools fall outside the default-allow contract and also prompt.
*/

/** A sub-tool is destructive when one of these verbs appears as a whole `-`-bounded segment. */
Expand Down
Loading