Use it now
Useful3 Signal3
Workflow scripts can restrict a spawned agent's shell to a fixed list of allowed commands.
What's wrong with this entry?
Anonymous. No account, no email.
bashCommandClamp
What
Workflow scripts can pass agent(prompt, {bashCommandClamp: [...]}), a list of Bash(<command or prefix>) rules that the spawned agent's shell use is restricted to. Any Bash call not matching every clamp group is denied with "bashCommandClamp: no clamp rule matches this command", and a command whose structure cannot be taken apart (command substitution, control flow) is denied as unverifiable.
Details
- The clamp becomes a permission layer of its own, merged into the tool permission context, on top of the usual allow and deny rules.
- Malformed or inert clamp entries refuse the spawn outright rather than quietly running the agent unclamped.
- None of this existed in 2.1.226.
Evidence
agent() opts.bashCommandClamp must be an array of non-empty strings
Strings lifted out of the shipped bundle, so the claim above can be checked against them.