I use `--dangerously-skip-permissions` and have yet to have it wipe my drive :shrug:. I don't know how I'm supposed to be running dozens of parallel agents each with their own sub-agents while trying to approve commands from each of them, it's just won't scale to the amount of work I need to get done.

▲

eru 2 hours ago | parent | next [-]

The permissions system seems to be mostly finegrained to help you from problems that backups and sandboxes already solve.

The more dangerous activities I find are sending messages to the outside world: I can't undo a dumb slack message to my boss.

▲

jawiggins an hour ago | parent [-]

That's fair, I have sent a, "Sorry claude sent that and I didn't tell him to", message before.

	▲	eru an hour ago \| parent [-]
		The big problem is that in general I want slack to be able to send some messages (otherwise I would ban that). But the difference between good and bad messages is something that's hard to judge mechanically.

▲

energy123 an hour ago | parent | prev [-]

Why not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?

▲

jawiggins an hour ago | parent [-]

Because I often want it to write and execute scripts in it's thinking loop in order to test assumptions or fetch data to come up with better solutions.

	▲	energy123 19 minutes ago \| parent [-]
		Can't it write `/tmp/test.sh` or `./test.sh` and execute it under my approach? This is what I've been doing as my status quo workflow with Codex, and I make sure I run Codex from a place where `.` happens to be a folder I'm okay with it messing up in.