Headless node host: allowlist patterns not matching
Hey everyone! Running into an issue with exec-approvals on a headless node host.
Setup:
Headless node host on macOS connecting to a remote gateway
Want to restrict system.run to only allow commands targeting a specific project folder
Config (exec-approvals.json):
"myagent": {
"security": "allowlist",
"ask": "off",
"askFallback": "deny",
"allowlist": [
{"pattern": "/usr/bin/touch myproject"},
{"pattern": "myproject"}
]
}
"myagent": { "security": "allowlist", "ask": "off", "askFallback": "deny", "allowlist": [ {"pattern": "/usr/bin/touch myproject"}, {"pattern": "myproject"} ]}
Expected: Commands like touch /path/to/myproject/file.txt should match myproject and execute.
Actual: All commands return SYSTEM_RUN_DENIED: allowlist miss
What works: Setting "security": "full" allows commands to execute, confirming the node is connected and working.
What I've tried:
Full binary paths (/usr/bin/touch myproject)
Catch-all patterns (myproject)
Various glob syntaxes
Anyone know the correct pattern syntax for headless node allowlists? Or is there a way to debug what's being matched?
Thanks!
Setup:
Headless node host on macOS connecting to a remote gateway
Want to restrict system.run to only allow commands targeting a specific project folder
Config (exec-approvals.json):
"myagent": {
"security": "allowlist",
"ask": "off",
"askFallback": "deny",
"allowlist": [
{"pattern": "/usr/bin/touch myproject"},
{"pattern": "myproject"}
]
}
"myagent": { "security": "allowlist", "ask": "off", "askFallback": "deny", "allowlist": [ {"pattern": "/usr/bin/touch myproject"}, {"pattern": "myproject"} ]}
Expected: Commands like touch /path/to/myproject/file.txt should match myproject and execute.
Actual: All commands return SYSTEM_RUN_DENIED: allowlist miss
What works: Setting "security": "full" allows commands to execute, confirming the node is connected and working.
What I've tried:
Full binary paths (/usr/bin/touch myproject)
Catch-all patterns (myproject)
Various glob syntaxes
Anyone know the correct pattern syntax for headless node allowlists? Or is there a way to debug what's being matched?
Thanks!
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
83,815Members
Resources
Similar Threads
Was this page helpful?
