Repository navigation
feat(rules): block or ask first before Claude Code and Cursor run a tool - #76
Merged
Merged
Conversation
Rules can now stop a tool call instead of only recording it. A rule whose
action is "deny" (Block) or "ask" (Ask first) is checked from the agent's
pre-tool hook, and the agent either refuses the call or asks the person,
showing the rule's reason.
Collector
- ENFORCEMENT_ENABLED is on. Blocking rules must be match rules over
details known before the tool runs, scoped to an agent that can block
(Claude Code and Cursor for now, ENFORCEMENT_SUPPORT).
- POST /v1/decide/{source} answers from the in-memory rule cache and never
waits on a DB write. Blocks and asks go to the audit log off-thread.
- PUT /v1/enforcement pauses every blocking rule at once.
- cot's own bridge commands are never blocked.
Bridge
- Pre-tool hooks (Claude PreToolUse, Cursor preToolUse) ask /v1/decide with
a 0.5s timeout and allow the call on any failure. The check ignores the
collector-down backoff: one slow ingest post used to mark the collector
down and let blocked calls through for ten seconds.
- The decision maps onto Claude's permissionDecision and Cursor's
{permission, user_message, agent_message} replies, and is recorded on
the stored event as cot_decision.
Dashboard
- The rule sentence opens with "Tell me when / Ask me first when / Block it
when"; blocking hides what can't be decided before a run (spend, "and it
fails", repeat limits, agents that can't block).
- The rules list shows block / ask first chips and a Blocking on switch;
previews read "Would have blocked".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rules can now stop a tool call instead of only recording it. A rule set to Block or Ask first is checked from the agent's pre-tool hook, and the agent either refuses the call or asks the person, showing the rule's reason.
Collector
ENFORCEMENT_ENABLED). A blocking rule must use only details known before the tool runs, and its agent scope must include one that can block: Claude Code and Cursor for now (ENFORCEMENT_SUPPORT).POST /v1/decide/{source}answers from the in-memory rule cache and never waits on a DB write (p50 about 2 ms on a fresh DB, 12 ms on the live one). Blocks and asks are written to the audit log off-thread.PUT /v1/enforcementpauses every blocking rule at once.Bridge
PreToolUseand CursorpreToolUseask/v1/decidewith a 0.5 s timeout and allow the call on any failure.permissionDecisionand Cursor's{permission, user_message, agent_message}. Cursor's shape was confirmed from its bundledpreToolUseResponsevalidator. The stored event recordscot_decision.Dashboard
Testing
Not in this PR: Codex, OpenCode and Hermes blocking, and the per-agent "Blocked actions" panel (phase 2).
🤖 Generated with Claude Code