[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7CBDAASTPD6MD2TSZPBYGQ5":3,"skill-same:01M7CBDAASTPD6MD2TSZPBYGQ5":46},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":14,"repositoryHtmlUrl":27,"repositoryHomepageUrl":6,"ownerHtmlUrl":28,"ownerBlogUrl":29,"ownerDescription":30,"updatedAt":31,"install":32,"resources":45},"01M7CBDAASTPD6MD2TSZPBYGQ5","setup",null,"This skill should be used when the user asks to set up or configure Claude Code permissions, autonomous mode, and\u002For deno sandbox for a project.","shenyimings\u002Fskillet","shenyimings","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F89332218?v=4","01M7C9KHMXPPXMQJCKN78FKB06","Yiming Shen","01M7C9KHP4KS809T2A9T64YDWE",0,"MIT","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fbenchmark\u002Fwild\u002Fdev\u002Fsuspicious\u002FCrazytieguy__alignment-hive__plugins__autopilot__skills__setup\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: setup\ndescription: This skill should be used when the user asks to set up or configure Claude Code permissions, autonomous mode, and\u002For deno sandbox for a project.\n---\n\n# Autopilot Setup\n\nConfigure permissions, autonomous mode, and deno sandbox so Claude can accomplish tasks end-to-end.\n\n## Purpose\n\nWithout proper permissions, Claude either blocks on every command (waiting for approval) or requires `--dangerously-skip-permissions`. This setup provides a secure middle ground: Claude gets the permissions it needs to work autonomously, with appropriate guardrails.\n\nSettings files are hot-reloaded (no restart needed) and `settings.local.json` is already gitignored by Claude Code via `.git\u002Finfo\u002Fexclude`.\n\n## Key Principle: Ask vs Deny\n\n**Deny** is for commands that are **never useful in this project** - steering toward correct alternatives.\n\n**Ask** is safer than deny for **sometimes dangerous** commands. With ask, the session stops until the user provides attention. With deny, a potentially compromised model might try variations autonomously. Use ask for commands that are sometimes legitimate but could be misused.\n\n## Re-run Behavior\n\nIf existing permissions are already configured (settings files exist with non-trivial content), treat this as a re-run. For each step, check whether the existing configuration already matches one of the options (or a close variation). If it does, skip the step silently. Only ask about things that don't seem set up yet.\n\nThis means a user running `:setup` for the second time will only see questions for newly added features or unconfigured areas, not a repeat of everything they already decided.\n\nException: if the user explicitly asks to reconfigure from scratch or change previous choices, ask all steps regardless of existing configuration.\n\n## Workflow Overview\n\n1. Detect project type and audit existing permissions (automatic)\n2. Ask initial preferences (batch of 3) + edit universally safe commands\n3. Ask web access + project script preferences (batch of 2) + edit\n4. Ask MCP server permissions + edit (if applicable)\n5. Confirm secrets\u002Fgit\u002Fmode\u002Fcleanup + edit\n6. Autopilot features (autonomous mode, then deno sandbox — separate questions, shared action)\n\n---\n\n## Step 1: Project Detection and Audit\n\nDetect the project type and audit existing permissions automatically before asking questions.\n\n### What to Detect\n\n**Package manager:** Check for lock files (bun.lockb, pnpm-lock.yaml, yarn.lock, package-lock.json, uv.lock, Cargo.lock). If ambiguous, ask the user.\n\n**Scripts:** Look for project scripts that might be needed mid-session (linting, testing, building, data processing). Extract from `package.json` scripts, `pyproject.toml` scripts, or similar config. Also look for standalone scripts in the project (e.g., `scripts\u002Ftrain.py`, `tools\u002Fanalyze.sh`, `bin\u002Fsetup`). These will be allowed individually as \"project scripts\". For monorepos, scripts may only exist in specific workspaces - identify the correct invocation pattern (e.g., `bun run --filter \u003Cworkspace> \u003Cscript>`).\n\n**MCP servers:** Check `.mcp.json` for configured servers.\n\n**Secret files:** Look for `.env`, `.env.local`, `.envrc`, credentials files, API keys. Note which ones exist for the secrets confirmation later.\n\n**hive-mind plugin:** If the `hive-mind:retrieval` subagent is available, include hive-mind commands in the universally safe commands.\n\n**Existing permissions:** Read `.claude\u002Fsettings.json` and `.claude\u002Fsettings.local.json` if they exist. Note any issues found for the cleanup question later.\n\n### Audit: Check for Issues in Existing Permissions\n\n**Bypass vectors** - Commands that can execute arbitrary code should never be in allow lists:\n\n```\nBash(env *)           # env VAR=val COMMAND runs any command\nBash(xargs *)         # pipes input to any command\nBash(bash -c *)       # executes string as bash\nBash(sh -c *)         # executes string as shell\nBash(eval *)          # evaluates arbitrary code\nBash(time *)          # time COMMAND runs any command\nBash(timeout *)       # timeout N COMMAND runs any command\nBash(exec *)          # replaces shell with command\nBash(nohup *)         # nohup COMMAND runs any command\nBash(nice *)          # nice COMMAND runs any command\nBash(python -c *)     # executes Python string\nBash(python3 -c *)    # executes Python string\nBash(node -e *)       # executes JavaScript string\nBash(perl -e *)       # executes Perl string\nBash(ruby -e *)       # executes Ruby string\nBash(bun run *)       # runs arbitrary scripts (allow specific scripts instead)\nBash(npm run *)       # runs arbitrary scripts (allow specific scripts instead)\n```\n\nThe general pattern: any command that takes another command or code string as an argument is a bypass vector.\n\n**Legacy tmp script pattern** - Look for `\u002Ftmp\u002Fclaude-execution-allowed` rules in settings files and an \"Ad-hoc Scripts\" section in CLAUDE.md. This was an earlier approach to script execution that has been replaced by the deno sandbox. Remove both the settings rules (e.g., `Bash(bun \u002Ftmp\u002Fclaude-execution-allowed\u002F...)`) and the CLAUDE.md section if found.\n\n**Deprecated syntax** - Look for rules using `:*` instead of ` *` (space-star). The colon syntax is deprecated **except** for commands that use heredoc arguments (e.g., `git commit:*`). The ` *` pattern fails to match heredoc syntax, so `:*` is required there. For all other commands, replace `:*` with `cmd` + `cmd *` patterns (not `cmd*`).\n\n**Redundancy** - Check for duplicate rules, overly broad rules that subsume specific ones, or rules that conflict with the new configuration. Fix each issue individually - the user might have niche permissions they want to keep.\n\nIf it's unclear how to run commands in this project (e.g., Python project without pyproject.toml, unusual monorepo structure), ask the user about their preferred toolchain and the correct way to run scripts.\n\n---\n\n## Step 2: Initial Preferences + Universally Safe Commands\n\nUse AskUserQuestion to ask all three questions in a single batch.\n\n### Q1: Settings Strategy\n\n> \"Where should permissions be stored?\"\n\n- **Split (Recommended)** - Shared file for universally safe commands, personal file for preferences. Collaborators get safe defaults.\n- **Shared only** - All permissions in settings.json. Works across collaborators and environments.\n- **Personal only** - All permissions in settings.local.json. For projects where collaborators have existing preferences.\n\n### Q2: Skills\n\nDetect available skills from the system prompt (which lists all available skills).\n\n> \"Allow all skills without permission requests?\"\n\n- **Yes (Recommended)** - All skills can be used freely\n- **Specific skills only** - Only allow specific skills: [list detected skills]\n\n### Q3: Universally Safe Commands\n\n> \"Add universally safe commands? (read-only inspection, safe utilities, git status\u002Fdiff\u002Flog)\"\n\n- **Yes (Recommended)** - Standard set of read-only commands that are safe in any project\n- **No** - Start from scratch, I'll configure manually\n\n### Edit: Skills\n\n**Determine target file based on settings strategy:**\n- Split: → settings.local.json (skills may vary per collaborator)\n- Shared only: → settings.json\n- Personal only: → settings.local.json\n\nIf user chose \"Yes\" (all skills):\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Skill\"\n    ]\n  }\n}\n```\n\nIf user chose \"Specific skills only\", list individual skills:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Skill(plugin-name:skill-name)\",\n      \"Skill(plugin-name:other-skill)\",\n      \"Skill(local-skill)\"\n    ]\n  }\n}\n```\n\n### Edit: Universally Safe Commands (if user confirmed)\n\n**Determine target file based on settings strategy:**\n- Split or Shared only: → settings.json\n- Personal only: → settings.local.json\n\nCopy verbatim. Note the wildcard patterns - always use `cmd` + `cmd *` (never `cmd*`). Exception: use `cmd:*` for commands that receive heredoc arguments (e.g., `git commit:*`), since ` *` fails to match heredoc syntax.\n\nIf hive-mind plugin is detected, also include:\n- `Bash(hive-mind)`\n- `Bash(hive-mind read)`\n- `Bash(hive-mind read *)`\n- `Bash(hive-mind search)`\n- `Bash(hive-mind search *)`\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(ls)\",\n      \"Bash(ls *)\",\n      \"Bash(find *)\",\n      \"Bash(cat *)\",\n      \"Bash(head *)\",\n      \"Bash(tail *)\",\n      \"Bash(wc)\",\n      \"Bash(wc *)\",\n      \"Bash(file *)\",\n      \"Bash(stat *)\",\n      \"Bash(du)\",\n      \"Bash(du *)\",\n      \"Bash(df)\",\n      \"Bash(df *)\",\n      \"Bash(diff *)\",\n      \"Bash(tree)\",\n      \"Bash(tree *)\",\n      \"Bash(realpath *)\",\n      \"Bash(basename *)\",\n      \"Bash(dirname *)\",\n      \"Bash(mkdir *)\",\n      \"Bash(grep *)\",\n      \"Bash(rg *)\",\n      \"Bash(jq *)\",\n      \"Bash(yq *)\",\n      \"Bash(sort)\",\n      \"Bash(sort *)\",\n      \"Bash(uniq)\",\n      \"Bash(uniq *)\",\n      \"Bash(cut *)\",\n      \"Bash(tr *)\",\n      \"Bash(printf *)\",\n      \"Bash(md5sum *)\",\n      \"Bash(sha256sum *)\",\n      \"Bash(base64 *)\",\n      \"Bash(echo *)\",\n      \"Bash(pwd)\",\n      \"Bash(which *)\",\n      \"Bash(type *)\",\n      \"Bash(command -v *)\",\n      \"Bash(uname)\",\n      \"Bash(uname *)\",\n      \"Bash(whoami)\",\n      \"Bash(date)\",\n      \"Bash(date *)\",\n      \"Bash(ps)\",\n      \"Bash(ps *)\",\n      \"Bash(pgrep *)\",\n      \"Bash(nvidia-smi)\",\n      \"Bash(nvidia-smi *)\",\n      \"Bash(id)\",\n      \"Bash(hostname)\",\n      \"Bash(uptime)\",\n      \"Bash(sleep *)\",\n      \"Bash(export *)\",\n      \"Bash(test *)\",\n      \"Bash(git status)\",\n      \"Bash(git status *)\",\n      \"Bash(git diff)\",\n      \"Bash(git diff *)\",\n      \"Bash(git log)\",\n      \"Bash(git log *)\",\n      \"Bash(git show *)\",\n      \"Bash(git branch)\",\n      \"Bash(git remote)\",\n      \"Bash(git remote -v)\",\n      \"Bash(git stash list)\",\n      \"Bash(git rev-parse *)\",\n      \"Bash(git ls-files)\",\n      \"Bash(git ls-files *)\",\n      \"Bash(xargs cat)\",\n      \"Bash(xargs cat *)\",\n      \"Bash(xargs file)\",\n      \"Bash(xargs file *)\",\n      \"Bash(xargs head)\",\n      \"Bash(xargs head *)\",\n      \"Bash(xargs tail)\",\n      \"Bash(xargs tail *)\",\n      \"Bash(xargs wc)\",\n      \"Bash(xargs wc *)\",\n      \"Bash(xargs stat)\",\n      \"Bash(xargs stat *)\",\n      \"Bash(xargs sort)\",\n      \"Bash(xargs sort *)\",\n      \"Bash(xargs du)\",\n      \"Bash(xargs du *)\",\n      \"Bash(xargs diff)\",\n      \"Bash(xargs diff *)\",\n      \"Bash(xargs basename)\",\n      \"Bash(xargs basename *)\",\n      \"Bash(xargs dirname)\",\n      \"Bash(xargs dirname *)\",\n      \"Bash(xargs grep *)\",\n      \"Bash(xargs cut *)\",\n      \"Bash(xargs -I{} cat *)\",\n      \"Bash(xargs -I{} file *)\",\n      \"Bash(xargs -I{} head *)\",\n      \"Bash(xargs -I{} tail *)\",\n      \"Bash(xargs -I{} wc *)\",\n      \"Bash(xargs -I{} stat *)\",\n      \"Bash(xargs -I{} sort *)\",\n      \"Bash(xargs -I{} du *)\",\n      \"Bash(xargs -I{} diff *)\",\n      \"Bash(xargs -I{} basename *)\",\n      \"Bash(xargs -I{} dirname *)\",\n      \"Bash(xargs -I{} grep *)\",\n      \"Bash(xargs -I{} cut *)\"\n    ],\n    \"ask\": [\n      \"Bash(find * -exec *)\",\n      \"Bash(find * -execdir *)\"\n    ],\n    \"deny\": [\n      \"Bash(timeout *)\",\n      \"Bash(env *)\",\n      \"Bash(bash -c *)\",\n      \"Bash(sh -c *)\",\n      \"Bash(zsh -c *)\",\n      \"Bash(xargs sh *)\",\n      \"Bash(xargs -I{} sh *)\",\n      \"Bash(xargs bash *)\",\n      \"Bash(xargs -I{} bash *)\",\n      \"Bash(git -C *)\"\n    ]\n  }\n}\n```\n\n---\n\n## Step 3: Web Access + Project Scripts Questions + Edit\n\nUse AskUserQuestion to ask both questions in a single batch.\n\n### Web Access Question\n\n> \"What level of web access do you want?\"\n\n**Options:**\n\n- **WebFetch + WebSearch (Recommended)** - All domains via built-in tools. Built-in prompt injection protections.\n\n- **Specific domains only** - Only documentation sites relevant to the project. For when prompt injection protection must be absolute.\n\n### Project Scripts Question\n\n> \"Which project scripts should Claude be allowed to run?\"\n\nNot all tiers apply to all projects — only show options that make a meaningful difference given the detected scripts. No recommendation.\n\n**Options:**\n\n- **Lint\u002Fformat\u002Ftypecheck only** - Safe, deterministic tools only. Tell the user exactly which commands this includes based on what was detected.\n\n- **Tests + lint\u002Fformat\u002Ftypecheck** - Also allow test commands.\n\n- **All project scripts** - All detected project scripts (dev, build, test, lint, format, etc.).\n\n### Edit Immediately After\n\nBased on the user's choice, edit the appropriate settings file(s).\n\n**Determine target file based on settings strategy:**\n- Split or Shared only: → settings.json\n- Personal only: → settings.local.json\n\n**Web access edit:** — Pick option; specific domains requires judgment.\n\n**For \"WebFetch + WebSearch\":**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"WebFetch\",\n      \"WebSearch\"\n    ]\n  }\n}\n```\n\n**For \"Specific domains only\":**\n\nGenerate 10+ relevant documentation domains based on project type:\n\nExample for a TypeScript\u002FReact project:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"WebFetch(domain:react.dev)\",\n      \"WebFetch(domain:typescriptlang.org)\",\n      \"WebFetch(domain:developer.mozilla.org)\",\n      \"WebFetch(domain:nodejs.org)\",\n      \"WebFetch(domain:bun.sh)\",\n      \"WebFetch(domain:vitejs.dev)\",\n      \"WebFetch(domain:tailwindcss.com)\",\n      \"WebFetch(domain:ui.shadcn.com)\",\n      \"WebFetch(domain:tanstack.com)\",\n      \"WebFetch(domain:zod.dev)\",\n      \"WebFetch(domain:trpc.io)\",\n      \"WebFetch(domain:nextjs.org)\",\n      \"WebSearch\"\n    ]\n  }\n}\n```\n\nExample for a Python ML project:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"WebFetch(domain:docs.python.org)\",\n      \"WebFetch(domain:pytorch.org)\",\n      \"WebFetch(domain:numpy.org)\",\n      \"WebFetch(domain:pandas.pydata.org)\",\n      \"WebFetch(domain:scikit-learn.org)\",\n      \"WebFetch(domain:huggingface.co)\",\n      \"WebFetch(domain:wandb.ai)\",\n      \"WebFetch(domain:docs.ray.io)\",\n      \"WebFetch(domain:jax.readthedocs.io)\",\n      \"WebFetch(domain:einops.rocks)\",\n      \"WebSearch\"\n    ]\n  }\n}\n```\n\n**Project scripts edit:** Based on detected package manager and the user's chosen tier, add allow rules for the applicable scripts. These are **examples** — adapt to the actual project structure, scripts, and invocation patterns.\n\n**Pattern note:** For each script, use two patterns: exact match (`bun run dev`) and with-arguments (`bun run dev *`). This allows passing flags like `--port 3000` without accidentally matching other scripts (e.g., `bun run dev*` would also match `bun run devscript.js`).\n\nWhich scripts to include depends on the user's chosen tier:\n- **Lint\u002Fformat\u002Ftypecheck only** → only lint, format, typecheck commands\n- **Tests + lint\u002Fformat\u002Ftypecheck** → test commands + lint, format, typecheck\n- **All project scripts** → all detected scripts (dev, build, test, lint, format, typecheck, etc.)\n\nAlways include deny rules for bypass vectors regardless of tier.\n\n**Example for bun project — \"All project scripts\" tier:**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(bun run dev)\",\n      \"Bash(bun run dev *)\",\n      \"Bash(bun run build)\",\n      \"Bash(bun run build *)\",\n      \"Bash(bun run test)\",\n      \"Bash(bun run test *)\",\n      \"Bash(bun run lint)\",\n      \"Bash(bun run lint *)\",\n      \"Bash(bun run format)\",\n      \"Bash(bun run format *)\",\n      \"Bash(bun run typecheck)\",\n      \"Bash(bun run typecheck *)\",\n      \"Bash(bun --version)\"\n    ],\n    \"deny\": [\n      \"Bash(eslint *)\",\n      \"Bash(prettier *)\",\n      \"Bash(tsc *)\",\n      \"Bash(jest *)\",\n      \"Bash(vitest *)\",\n      \"Bash(node *)\",\n      \"Bash(npx *)\",\n      \"Bash(npm *)\",\n      \"Bash(pnpm *)\",\n      \"Bash(yarn *)\"\n    ]\n  }\n}\n```\n\nFor \"Tests + lint\u002Fformat\u002Ftypecheck\", the allow list would include only `bun run test`, `bun run lint`, `bun run format`, `bun run typecheck` (and their `*` variants). For \"Lint\u002Fformat\u002Ftypecheck only\", it would include only `bun run lint`, `bun run format`, `bun run typecheck`.\n\nNote: `bun install`, `bun add`, `bun remove` are left on default ask - rarely needed mid-session and users often want control.\n\n**Example for uv\u002FPython project with scripts in scripts\u002F directory — \"All project scripts\" tier:**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(uv run pytest)\",\n      \"Bash(uv run pytest *)\",\n      \"Bash(uv run mypy)\",\n      \"Bash(uv run mypy *)\",\n      \"Bash(uv run ruff)\",\n      \"Bash(uv run ruff *)\",\n      \"Bash(uv run scripts\u002Ftrain.py)\",\n      \"Bash(uv run scripts\u002Ftrain.py *)\",\n      \"Bash(uv run scripts\u002Feval.py)\",\n      \"Bash(uv run scripts\u002Feval.py *)\",\n      \"Bash(uv run scripts\u002Fanalyze.py)\",\n      \"Bash(uv run scripts\u002Fanalyze.py *)\",\n      \"Bash(uv --version)\"\n    ],\n    \"deny\": [\n      \"Bash(pytest *)\",\n      \"Bash(mypy *)\",\n      \"Bash(ruff *)\",\n      \"Bash(python *)\",\n      \"Bash(python3 *)\",\n      \"Bash(pip *)\",\n      \"Bash(pip3 *)\",\n      \"Bash(poetry *)\",\n      \"Bash(pipenv *)\"\n    ]\n  }\n}\n```\n\nFor \"Tests + lint\u002Fformat\u002Ftypecheck\", allow `uv run pytest`, `uv run mypy`, `uv run ruff` only. For \"Lint\u002Fformat\u002Ftypecheck only\", allow `uv run mypy`, `uv run ruff` only.\n\nNote: `uv sync`, `uv add`, `uv remove` are left on default ask - rarely needed mid-session and users often want control.\n\n**Example for Cargo\u002FRust project — \"All project scripts\" tier:**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(cargo build)\",\n      \"Bash(cargo build *)\",\n      \"Bash(cargo test)\",\n      \"Bash(cargo test *)\",\n      \"Bash(cargo run)\",\n      \"Bash(cargo run *)\",\n      \"Bash(cargo check)\",\n      \"Bash(cargo check *)\",\n      \"Bash(cargo clippy)\",\n      \"Bash(cargo clippy *)\",\n      \"Bash(cargo fmt)\",\n      \"Bash(cargo fmt *)\",\n      \"Bash(cargo --version)\"\n    ],\n    \"deny\": [\n      \"Bash(rustc *)\"\n    ]\n  }\n}\n```\n\nFor \"Tests + lint\u002Fformat\u002Ftypecheck\", allow `cargo test`, `cargo check`, `cargo clippy`, `cargo fmt`. For \"Lint\u002Fformat\u002Ftypecheck only\", allow `cargo check`, `cargo clippy`, `cargo fmt`.\n\nNote: `cargo add`, `cargo remove` are left on default ask.\n\n---\n\n## Step 4: MCP Server Permissions (if detected)\n\nFor each MCP server found in `.mcp.json`, ask in a **question batch** (one question per server) whether to allow all tools or leave on default (permission request per tool).\n\nUse judgment for recommendations:\n- **Needed for autonomous operation** (playwright, remote-kernels) → recommend allow\n- **Only needed with user oversight** (database, Airtable, email) → recommend default (permission request per use, auto-denied in autonomous mode)\n\n### Edit Immediately After\n\nFor servers the user approved for full access:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"mcp__playwright__*\",\n      \"mcp__remote-kernels__*\"\n    ]\n  }\n}\n```\n\nServers left on default ask don't need any configuration.\n\n---\n\n## Step 5: Final Batch - Secrets + Git + Mode + Cleanup\n\nAsk these questions in a single batch, then make a single edit.\n\n### Secrets (only if secret files were detected in Step 1)\n\n> \"Block Claude from reading these sensitive files? [list detected files]\"\n\n- **Yes (Recommended)** - Deny access to .env, credentials, etc.\n- **No** - Allow access (you trust the project boundaries)\n\n### Git\n\n> \"Allow Claude to stage and commit without permission requests?\"\n\n- **Yes** - Commits can always be reverted, this isn't push permission\n- **No** - Permission request for each commit\n\n### Default Mode\n\n> \"Start sessions in plan mode by default? (Recommended)\"\n\n- **Yes (Recommended)** - Claude researches and plans before making changes. Users often find plan mode useful in situations they didn't anticipate.\n- **No** - Standard mode where Claude acts immediately.\n\n### Cleanup (only if issues were found in Step 1 audit)\n\n> \"Clean up existing permission issues? [describe issues found: bypass vectors, deprecated syntax, redundant rules]\"\n\n- **Yes** - Fix the issues found\n- **No** - Leave existing permissions as-is\n\n### Edit for All\n\n**Secret protection (if user confirmed):** — Requires judgment, check what files actually exist.\n\nCheck what secret files actually exist - don't use a generic list:\n\n```json\n{\n  \"permissions\": {\n    \"deny\": [\n      \"Read(**\u002F.env)\",\n      \"Read(**\u002F.env.local)\",\n      \"Read(**\u002F.envrc)\"\n    ]\n  }\n}\n```\n\nNote: `.env.example` and `.env.test` are typically safe to read.\n\n**Git permissions (if user allows commits):** — Copy verbatim.\n\nNote: `git commit` uses `:*` instead of ` *` because commit messages use heredoc syntax, which ` *` fails to match.\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(git add *)\",\n      \"Bash(git commit:*)\"\n    ]\n  }\n}\n```\n\n**Default mode (if user chose plan mode):** — Copy verbatim.\n\n```json\n{\n  \"permissions\": {\n    \"defaultMode\": \"plan\"\n  }\n}\n```\n\n---\n\n## Step 6: Autopilot Features\n\nAsk about autonomous mode and the deno sandbox in separate question batches — each question must be its own AskUserQuestion call so the user reads the explanation before answering. For each, first give the explanation, then ask the question. Then execute both together after.\n\n### Q1: Autonomous Mode\n\nOutput the following explanation, then ask the question:\n\n**Explanation:**\n\nThe autopilot plugin includes an autonomous mode that changes how Claude handles permission requests when you're in `acceptEdits` mode:\n\n- **Without autonomous mode:** Claude blocks on every unpermitted command, waiting for you to approve or deny each one.\n- **With autonomous mode:** Unpermitted commands are automatically denied. Claude will try alternatives or propose adding a permission instead of blocking.\n\nThis means you can leave Claude running unattended in `acceptEdits` mode. If you need to approve a one-off command that isn't in your allow list, switch out of `acceptEdits` mode first (toggle with Shift+Tab).\n\n**Question:**\n\n\"Enable autonomous mode?\"\n\n- **Yes** - Enable autonomous mode\n- **No** - Keep standard behavior (block on unpermitted commands)\n\n### Q2: Deno Sandbox\n\nOutput the following explanation, then ask the question:\n\n**Explanation:**\n\nThe deno sandbox gives Claude a secure way to run JavaScript\u002FTypeScript code. By default, scripts can only read files in the project directory — network, writes, env, and subprocess execution are all blocked.\n\nWhen Claude needs additional capabilities, it will run `deno-sandbox-grant` to request a scoped permission. Each grant requires your approval and looks like this:\n\n```\ndeno-sandbox-grant --allow-net=api.example.com\ndeno-sandbox-grant --allow-write=.\u002Foutput\ndeno-sandbox-grant --allow-run=python3\n```\n\nReview grants before approving — especially `--allow-run`, which gives unsandboxed subprocess execution. Grants persist for the session only.\n\n**Question:**\n\n\"Enable deno sandbox? (Recommended)\"\n\n- **Yes (Recommended)** - Enable the deno sandbox\n- **No** - Disable the deno sandbox\n\n### Action\n\nCreate the state directory and write the state file:\n\n```bash\nmkdir -p .claude\u002Fautopilot\n```\n\nWrite `.claude\u002Fautopilot\u002Fstate.json` with both keys:\n```json\n{\n  \"autonomous_mode\": true|false,\n  \"deno_sandbox\": true|false\n}\n```\n\nIf the user enabled the deno sandbox, also add sandbox permissions to the settings file (use the same target file as Step 3):\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(deno-sandbox)\",\n      \"Bash(deno-sandbox *)\"\n    ]\n  }\n}\n```\n\nWrite a `.claude\u002Fautopilot\u002F.gitignore` file with content `*` to keep the directory out of version control.\n","# Autopilot Setup\n\nConfigure permissions, autonomous mode, and deno sandbox so Claude can accomplish tasks end-to-end.\n\n## Purpose\n\nWithout proper permissions, Claude either blocks on every command (waiting for approval) or requires `--dangerously-skip-permissions`. This setup provides a secure middle ground: Claude gets the permissions it needs to work autonomously, with appropriate guardrails.\n\nSettings files are hot-reloaded (no restart needed) and `settings.local.json` is already gitignored by Claude Code via `.git\u002Finfo\u002Fexclude`.\n\n## Key Principle: Ask vs Deny\n\n**Deny** is for commands that are **never useful in this project** - steering toward correct alternatives.\n\n**Ask** is safer than deny for **sometimes dangerous** commands. With ask, the session stops until the user provides attention. With deny, a potentially compromised model might try variations autonomously. Use ask for commands that are sometimes legitimate but could be misused.\n\n## Re-run Behavior\n\nIf existing permissions are already configured (settings files exist with non-trivial content), treat this as a re-run. For each step, check whether the existing configuration already matches one of the options (or a close variation). If it does, skip the step silently. Only ask about things that don't seem set up yet.\n\nThis means a user running `:setup` for the second time will only see questions for newly added features or unconfigured areas, not a repeat of everything they already decided.\n\nException: if the user explicitly asks to reconfigure from scratch or change previous choices, ask all steps regardless of existing configuration.\n\n## Workflow Overview\n\n1. Detect project type and audit existing permissions (automatic)\n2. Ask initial preferences (batch of 3) + edit universally safe commands\n3. Ask web access + project script preferences (batch of 2) + edit\n4. Ask MCP server permissions + edit (if applicable)\n5. Confirm secrets\u002Fgit\u002Fmode\u002Fcleanup + edit\n6. Autopilot features (autonomous mode, then deno sandbox — separate questions, shared action)\n\n---\n\n## Step 1: Project Detection and Audit\n\nDetect the project type and audit existing permissions automatically before asking questions.\n\n### What to Detect\n\n**Package manager:** Check for lock files (bun.lockb, pnpm-lock.yaml, yarn.lock, package-lock.json, uv.lock, Cargo.lock). If ambiguous, ask the user.\n\n**Scripts:** Look for project scripts that might be needed mid-session (linting, testing, building, data processing). Extract from `package.json` scripts, `pyproject.toml` scripts, or similar config. Also look for standalone scripts in the project (e.g., `scripts\u002Ftrain.py`, `tools\u002Fanalyze.sh`, `bin\u002Fsetup`). These will be allowed individually as \"project scripts\". For monorepos, scripts may only exist in specific workspaces - identify the correct invocation pattern (e.g., `bun run --filter \u003Cworkspace> \u003Cscript>`).\n\n**MCP servers:** Check `.mcp.json` for configured servers.\n\n**Secret files:** Look for `.env`, `.env.local`, `.envrc`, credentials files, API keys. Note which ones exist for the secrets confirmation later.\n\n**hive-mind plugin:** If the `hive-mind:retrieval` subagent is available, include hive-mind commands in the universally safe commands.\n\n**Existing permissions:** Read `.claude\u002Fsettings.json` and `.claude\u002Fsettings.local.json` if they exist. Note any issues found for the cleanup question later.\n\n### Audit: Check for Issues in Existing Permissions\n\n**Bypass vectors** - Commands that can execute arbitrary code should never be in allow lists:\n\n```\nBash(env *)           # env VAR=val COMMAND runs any command\nBash(xargs *)         # pipes input to any command\nBash(bash -c *)       # executes string as bash\nBash(sh -c *)         # executes string as shell\nBash(eval *)          # evaluates arbitrary code\nBash(time *)          # time COMMAND runs any command\nBash(timeout *)       # timeout N COMMAND runs any command\nBash(exec *)          # replaces shell with command\nBash(nohup *)         # nohup COMMAND runs any command\nBash(nice *)          # nice COMMAND runs any command\nBash(python -c *)     # executes Python string\nBash(python3 -c *)    # executes Python string\nBash(node -e *)       # executes JavaScript string\nBash(perl -e *)       # executes Perl string\nBash(ruby -e *)       # executes Ruby string\nBash(bun run *)       # runs arbitrary scripts (allow specific scripts instead)\nBash(npm run *)       # runs arbitrary scripts (allow specific scripts instead)\n```\n\nThe general pattern: any command that takes another command or code string as an argument is a bypass vector.\n\n**Legacy tmp script pattern** - Look for `\u002Ftmp\u002Fclaude-execution-allowed` rules in settings files and an \"Ad-hoc Scripts\" section in CLAUDE.md. This was an earlier approach to script execution that has been replaced by the deno sandbox. Remove both the settings rules (e.g., `Bash(bun \u002Ftmp\u002Fclaude-execution-allowed\u002F...)`) and the CLAUDE.md section if found.\n\n**Deprecated syntax** - Look for rules using `:*` instead of ` *` (space-star). The colon syntax is deprecated **except** for commands that use heredoc arguments (e.g., `git commit:*`). The ` *` pattern fails to match heredoc syntax, so `:*` is required there. For all other commands, replace `:*` with `cmd` + `cmd *` patterns (not `cmd*`).\n\n**Redundancy** - Check for duplicate rules, overly broad rules that subsume specific ones, or rules that conflict with the new configuration. Fix each issue individually - the user might have niche permissions they want to keep.\n\nIf it's unclear how to run commands in this project (e.g., Python project without pyproject.toml, unusual monorepo structure), ask the user about their preferred toolchain and the correct way to run scripts.\n\n---\n\n## Step 2: Initial Preferences + Universally Safe Commands\n\nUse AskUserQuestion to ask all three questions in a single batch.\n\n### Q1: Settings Strategy\n\n> \"Where should permissions be stored?\"\n\n- **Split (Recommended)** - Shared file for universally safe commands, personal file for preferences. Collaborators get safe defaults.\n- **Shared only** - All permissions in settings.json. Works across collaborators and environments.\n- **Personal only** - All permissions in settings.local.json. For projects where collaborators have existing preferences.\n\n### Q2: Skills\n\nDetect available skills from the system prompt (which lists all available skills).\n\n> \"Allow all skills without permission requests?\"\n\n- **Yes (Recommended)** - All skills can be used freely\n- **Specific skills only** - Only allow specific skills: [list detected skills]\n\n### Q3: Universally Safe Commands\n\n> \"Add universally safe commands? (read-only inspection, safe utilities, git status\u002Fdiff\u002Flog)\"\n\n- **Yes (Recommended)** - Standard set of read-only commands that are safe in any project\n- **No** - Start from scratch, I'll configure manually\n\n### Edit: Skills\n\n**Determine target file based on settings strategy:**\n- Split: → settings.local.json (skills may vary per collaborator)\n- Shared only: → settings.json\n- Personal only: → settings.local.json\n\nIf user chose \"Yes\" (all skills):\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Skill\"\n    ]\n  }\n}\n```\n\nIf user chose \"Specific skills only\", list individual skills:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Skill(plugin-name:skill-name)\",\n      \"Skill(plugin-name:other-skill)\",\n      \"Skill(local-skill)\"\n    ]\n  }\n}\n```\n\n### Edit: Universally Safe Commands (if user confirmed)\n\n**Determine target file based on settings strategy:**\n- Split or Shared only: → settings.json\n- Personal only: → settings.local.json\n\nCopy verbatim. Note the wildcard patterns - always use `cmd` + `cmd *` (never `cmd*`). Exception: use `cmd:*` for commands that receive heredoc arguments (e.g., `git commit:*`), since ` *` fails to match heredoc syntax.\n\nIf hive-mind plugin is detected, also include:\n- `Bash(hive-mind)`\n- `Bash(hive-mind read)`\n- `Bash(hive-mind read *)`\n- `Bash(hive-mind search)`\n- `Bash(hive-mind search *)`\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(ls)\",\n      \"Bash(ls *)\",\n      \"Bash(find *)\",\n      \"Bash(cat *)\",\n      \"Bash(head *)\",\n      \"Bash(tail *)\",\n      \"Bash(wc)\",\n      \"Bash(wc *)\",\n      \"Bash(file *)\",\n      \"Bash(stat *)\",\n      \"Bash(du)\",\n      \"Bash(du *)\",\n      \"Bash(df)\",\n      \"Bash(df *)\",\n      \"Bash(diff *)\",\n      \"Bash(tree)\",\n      \"Bash(tree *)\",\n      \"Bash(realpath *)\",\n      \"Bash(basename *)\",\n      \"Bash(dirname *)\",\n      \"Bash(mkdir *)\",\n      \"Bash(grep *)\",\n      \"Bash(rg *)\",\n      \"Bash(jq *)\",\n      \"Bash(yq *)\",\n      \"Bash(sort)\",\n      \"Bash(sort *)\",\n      \"Bash(uniq)\",\n      \"Bash(uniq *)\",\n      \"Bash(cut *)\",\n      \"Bash(tr *)\",\n      \"Bash(printf *)\",\n      \"Bash(md5sum *)\",\n      \"Bash(sha256sum *)\",\n      \"Bash(base64 *)\",\n      \"Bash(echo *)\",\n      \"Bash(pwd)\",\n      \"Bash(which *)\",\n      \"Bash(type *)\",\n      \"Bash(command -v *)\",\n      \"Bash(uname)\",\n      \"Bash(uname *)\",\n      \"Bash(whoami)\",\n      \"Bash(date)\",\n      \"Bash(date *)\",\n      \"Bash(ps)\",\n      \"Bash(ps *)\",\n      \"Bash(pgrep *)\",\n      \"Bash(nvidia-smi)\",\n      \"Bash(nvidia-smi *)\",\n      \"Bash(id)\",\n      \"Bash(hostname)\",\n      \"Bash(uptime)\",\n      \"Bash(sleep *)\",\n      \"Bash(export *)\",\n      \"Bash(test *)\",\n      \"Bash(git status)\",\n      \"Bash(git status *)\",\n      \"Bash(git diff)\",\n      \"Bash(git diff *)\",\n      \"Bash(git log)\",\n      \"Bash(git log *)\",\n      \"Bash(git show *)\",\n      \"Bash(git branch)\",\n      \"Bash(git remote)\",\n      \"Bash(git remote -v)\",\n      \"Bash(git stash list)\",\n      \"Bash(git rev-parse *)\",\n      \"Bash(git ls-files)\",\n      \"Bash(git ls-files *)\",\n      \"Bash(xargs cat)\",\n      \"Bash(xargs cat *)\",\n      \"Bash(xargs file)\",\n      \"Bash(xargs file *)\",\n      \"Bash(xargs head)\",\n      \"Bash(xargs head *)\",\n      \"Bash(xargs tail)\",\n      \"Bash(xargs tail *)\",\n      \"Bash(xargs wc)\",\n      \"Bash(xargs wc *)\",\n      \"Bash(xargs stat)\",\n      \"Bash(xargs stat *)\",\n      \"Bash(xargs sort)\",\n      \"Bash(xargs sort *)\",\n      \"Bash(xargs du)\",\n      \"Bash(xargs du *)\",\n      \"Bash(xargs diff)\",\n      \"Bash(xargs diff *)\",\n      \"Bash(xargs basename)\",\n      \"Bash(xargs basename *)\",\n      \"Bash(xargs dirname)\",\n      \"Bash(xargs dirname *)\",\n      \"Bash(xargs grep *)\",\n      \"Bash(xargs cut *)\",\n      \"Bash(xargs -I{} cat *)\",\n      \"Bash(xargs -I{} file *)\",\n      \"Bash(xargs -I{} head *)\",\n      \"Bash(xargs -I{} tail *)\",\n      \"Bash(xargs -I{} wc *)\",\n      \"Bash(xargs -I{} stat *)\",\n      \"Bash(xargs -I{} sort *)\",\n      \"Bash(xargs -I{} du *)\",\n      \"Bash(xargs -I{} diff *)\",\n      \"Bash(xargs -I{} basename *)\",\n      \"Bash(xargs -I{} dirname *)\",\n      \"Bash(xargs -I{} grep *)\",\n      \"Bash(xargs -I{} cut *)\"\n    ],\n    \"ask\": [\n      \"Bash(find * -exec *)\",\n      \"Bash(find * -execdir *)\"\n    ],\n    \"deny\": [\n      \"Bash(timeout *)\",\n      \"Bash(env *)\",\n      \"Bash(bash -c *)\",\n      \"Bash(sh -c *)\",\n      \"Bash(zsh -c *)\",\n      \"Bash(xargs sh *)\",\n      \"Bash(xargs -I{} sh *)\",\n      \"Bash(xargs bash *)\",\n      \"Bash(xargs -I{} bash *)\",\n      \"Bash(git -C *)\"\n    ]\n  }\n}\n```\n\n---\n\n## Step 3: Web Access + Project Scripts Questions + Edit\n\nUse AskUserQuestion to ask both questions in a single batch.\n\n### Web Access Question\n\n> \"What level of web access do you want?\"\n\n**Options:**\n\n- **WebFetch + WebSearch (Recommended)** - All domains via built-in tools. Built-in prompt injection protections.\n\n- **Specific domains only** - Only documentation sites relevant to the project. For when prompt injection protection must be absolute.\n\n### Project Scripts Question\n\n> \"Which project scripts should Claude be allowed to run?\"\n\nNot all tiers apply to all projects — only show options that make a meaningful difference given the detected scripts. No recommendation.\n\n**Options:**\n\n- **Lint\u002Fformat\u002Ftypecheck only** - Safe, deterministic tools only. Tell the user exactly which commands this includes based on what was detected.\n\n- **Tests + lint\u002Fformat\u002Ftypecheck** - Also allow test commands.\n\n- **All project scripts** - All detected project scripts (dev, build, test, lint, format, etc.).\n\n### Edit Immediately After\n\nBased on the user's choice, edit the appropriate settings file(s).\n\n**Determine target file based on settings strategy:**\n- Split or Shared only: → settings.json\n- Personal only: → settings.local.json\n\n**Web access edit:** — Pick option; specific domains requires judgment.\n\n**For \"WebFetch + WebSearch\":**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"WebFetch\",\n      \"WebSearch\"\n    ]\n  }\n}\n```\n\n**For \"Specific domains only\":**\n\nGenerate 10+ relevant documentation domains based on project type:\n\nExample for a TypeScript\u002FReact project:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"WebFetch(domain:react.dev)\",\n      \"WebFetch(domain:typescriptlang.org)\",\n      \"WebFetch(domain:developer.mozilla.org)\",\n      \"WebFetch(domain:nodejs.org)\",\n      \"WebFetch(domain:bun.sh)\",\n      \"WebFetch(domain:vitejs.dev)\",\n      \"WebFetch(domain:tailwindcss.com)\",\n      \"WebFetch(domain:ui.shadcn.com)\",\n      \"WebFetch(domain:tanstack.com)\",\n      \"WebFetch(domain:zod.dev)\",\n      \"WebFetch(domain:trpc.io)\",\n      \"WebFetch(domain:nextjs.org)\",\n      \"WebSearch\"\n    ]\n  }\n}\n```\n\nExample for a Python ML project:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"WebFetch(domain:docs.python.org)\",\n      \"WebFetch(domain:pytorch.org)\",\n      \"WebFetch(domain:numpy.org)\",\n      \"WebFetch(domain:pandas.pydata.org)\",\n      \"WebFetch(domain:scikit-learn.org)\",\n      \"WebFetch(domain:huggingface.co)\",\n      \"WebFetch(domain:wandb.ai)\",\n      \"WebFetch(domain:docs.ray.io)\",\n      \"WebFetch(domain:jax.readthedocs.io)\",\n      \"WebFetch(domain:einops.rocks)\",\n      \"WebSearch\"\n    ]\n  }\n}\n```\n\n**Project scripts edit:** Based on detected package manager and the user's chosen tier, add allow rules for the applicable scripts. These are **examples** — adapt to the actual project structure, scripts, and invocation patterns.\n\n**Pattern note:** For each script, use two patterns: exact match (`bun run dev`) and with-arguments (`bun run dev *`). This allows passing flags like `--port 3000` without accidentally matching other scripts (e.g., `bun run dev*` would also match `bun run devscript.js`).\n\nWhich scripts to include depends on the user's chosen tier:\n- **Lint\u002Fformat\u002Ftypecheck only** → only lint, format, typecheck commands\n- **Tests + lint\u002Fformat\u002Ftypecheck** → test commands + lint, format, typecheck\n- **All project scripts** → all detected scripts (dev, build, test, lint, format, typecheck, etc.)\n\nAlways include deny rules for bypass vectors regardless of tier.\n\n**Example for bun project — \"All project scripts\" tier:**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(bun run dev)\",\n      \"Bash(bun run dev *)\",\n      \"Bash(bun run build)\",\n      \"Bash(bun run build *)\",\n      \"Bash(bun run test)\",\n      \"Bash(bun run test *)\",\n      \"Bash(bun run lint)\",\n      \"Bash(bun run lint *)\",\n      \"Bash(bun run format)\",\n      \"Bash(bun run format *)\",\n      \"Bash(bun run typecheck)\",\n      \"Bash(bun run typecheck *)\",\n      \"Bash(bun --version)\"\n    ],\n    \"deny\": [\n      \"Bash(eslint *)\",\n      \"Bash(prettier *)\",\n      \"Bash(tsc *)\",\n      \"Bash(jest *)\",\n      \"Bash(vitest *)\",\n      \"Bash(node *)\",\n      \"Bash(npx *)\",\n      \"Bash(npm *)\",\n      \"Bash(pnpm *)\",\n      \"Bash(yarn *)\"\n    ]\n  }\n}\n```\n\nFor \"Tests + lint\u002Fformat\u002Ftypecheck\", the allow list would include only `bun run test`, `bun run lint`, `bun run format`, `bun run typecheck` (and their `*` variants). For \"Lint\u002Fformat\u002Ftypecheck only\", it would include only `bun run lint`, `bun run format`, `bun run typecheck`.\n\nNote: `bun install`, `bun add`, `bun remove` are left on default ask - rarely needed mid-session and users often want control.\n\n**Example for uv\u002FPython project with scripts in scripts\u002F directory — \"All project scripts\" tier:**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(uv run pytest)\",\n      \"Bash(uv run pytest *)\",\n      \"Bash(uv run mypy)\",\n      \"Bash(uv run mypy *)\",\n      \"Bash(uv run ruff)\",\n      \"Bash(uv run ruff *)\",\n      \"Bash(uv run scripts\u002Ftrain.py)\",\n      \"Bash(uv run scripts\u002Ftrain.py *)\",\n      \"Bash(uv run scripts\u002Feval.py)\",\n      \"Bash(uv run scripts\u002Feval.py *)\",\n      \"Bash(uv run scripts\u002Fanalyze.py)\",\n      \"Bash(uv run scripts\u002Fanalyze.py *)\",\n      \"Bash(uv --version)\"\n    ],\n    \"deny\": [\n      \"Bash(pytest *)\",\n      \"Bash(mypy *)\",\n      \"Bash(ruff *)\",\n      \"Bash(python *)\",\n      \"Bash(python3 *)\",\n      \"Bash(pip *)\",\n      \"Bash(pip3 *)\",\n      \"Bash(poetry *)\",\n      \"Bash(pipenv *)\"\n    ]\n  }\n}\n```\n\nFor \"Tests + lint\u002Fformat\u002Ftypecheck\", allow `uv run pytest`, `uv run mypy`, `uv run ruff` only. For \"Lint\u002Fformat\u002Ftypecheck only\", allow `uv run mypy`, `uv run ruff` only.\n\nNote: `uv sync`, `uv add`, `uv remove` are left on default ask - rarely needed mid-session and users often want control.\n\n**Example for Cargo\u002FRust project — \"All project scripts\" tier:**\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(cargo build)\",\n      \"Bash(cargo build *)\",\n      \"Bash(cargo test)\",\n      \"Bash(cargo test *)\",\n      \"Bash(cargo run)\",\n      \"Bash(cargo run *)\",\n      \"Bash(cargo check)\",\n      \"Bash(cargo check *)\",\n      \"Bash(cargo clippy)\",\n      \"Bash(cargo clippy *)\",\n      \"Bash(cargo fmt)\",\n      \"Bash(cargo fmt *)\",\n      \"Bash(cargo --version)\"\n    ],\n    \"deny\": [\n      \"Bash(rustc *)\"\n    ]\n  }\n}\n```\n\nFor \"Tests + lint\u002Fformat\u002Ftypecheck\", allow `cargo test`, `cargo check`, `cargo clippy`, `cargo fmt`. For \"Lint\u002Fformat\u002Ftypecheck only\", allow `cargo check`, `cargo clippy`, `cargo fmt`.\n\nNote: `cargo add`, `cargo remove` are left on default ask.\n\n---\n\n## Step 4: MCP Server Permissions (if detected)\n\nFor each MCP server found in `.mcp.json`, ask in a **question batch** (one question per server) whether to allow all tools or leave on default (permission request per tool).\n\nUse judgment for recommendations:\n- **Needed for autonomous operation** (playwright, remote-kernels) → recommend allow\n- **Only needed with user oversight** (database, Airtable, email) → recommend default (permission request per use, auto-denied in autonomous mode)\n\n### Edit Immediately After\n\nFor servers the user approved for full access:\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"mcp__playwright__*\",\n      \"mcp__remote-kernels__*\"\n    ]\n  }\n}\n```\n\nServers left on default ask don't need any configuration.\n\n---\n\n## Step 5: Final Batch - Secrets + Git + Mode + Cleanup\n\nAsk these questions in a single batch, then make a single edit.\n\n### Secrets (only if secret files were detected in Step 1)\n\n> \"Block Claude from reading these sensitive files? [list detected files]\"\n\n- **Yes (Recommended)** - Deny access to .env, credentials, etc.\n- **No** - Allow access (you trust the project boundaries)\n\n### Git\n\n> \"Allow Claude to stage and commit without permission requests?\"\n\n- **Yes** - Commits can always be reverted, this isn't push permission\n- **No** - Permission request for each commit\n\n### Default Mode\n\n> \"Start sessions in plan mode by default? (Recommended)\"\n\n- **Yes (Recommended)** - Claude researches and plans before making changes. Users often find plan mode useful in situations they didn't anticipate.\n- **No** - Standard mode where Claude acts immediately.\n\n### Cleanup (only if issues were found in Step 1 audit)\n\n> \"Clean up existing permission issues? [describe issues found: bypass vectors, deprecated syntax, redundant rules]\"\n\n- **Yes** - Fix the issues found\n- **No** - Leave existing permissions as-is\n\n### Edit for All\n\n**Secret protection (if user confirmed):** — Requires judgment, check what files actually exist.\n\nCheck what secret files actually exist - don't use a generic list:\n\n```json\n{\n  \"permissions\": {\n    \"deny\": [\n      \"Read(**\u002F.env)\",\n      \"Read(**\u002F.env.local)\",\n      \"Read(**\u002F.envrc)\"\n    ]\n  }\n}\n```\n\nNote: `.env.example` and `.env.test` are typically safe to read.\n\n**Git permissions (if user allows commits):** — Copy verbatim.\n\nNote: `git commit` uses `:*` instead of ` *` because commit messages use heredoc syntax, which ` *` fails to match.\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(git add *)\",\n      \"Bash(git commit:*)\"\n    ]\n  }\n}\n```\n\n**Default mode (if user chose plan mode):** — Copy verbatim.\n\n```json\n{\n  \"permissions\": {\n    \"defaultMode\": \"plan\"\n  }\n}\n```\n\n---\n\n## Step 6: Autopilot Features\n\nAsk about autonomous mode and the deno sandbox in separate question batches — each question must be its own AskUserQuestion call so the user reads the explanation before answering. For each, first give the explanation, then ask the question. Then execute both together after.\n\n### Q1: Autonomous Mode\n\nOutput the following explanation, then ask the question:\n\n**Explanation:**\n\nThe autopilot plugin includes an autonomous mode that changes how Claude handles permission requests when you're in `acceptEdits` mode:\n\n- **Without autonomous mode:** Claude blocks on every unpermitted command, waiting for you to approve or deny each one.\n- **With autonomous mode:** Unpermitted commands are automatically denied. Claude will try alternatives or propose adding a permission instead of blocking.\n\nThis means you can leave Claude running unattended in `acceptEdits` mode. If you need to approve a one-off command that isn't in your allow list, switch out of `acceptEdits` mode first (toggle with Shift+Tab).\n\n**Question:**\n\n\"Enable autonomous mode?\"\n\n- **Yes** - Enable autonomous mode\n- **No** - Keep standard behavior (block on unpermitted commands)\n\n### Q2: Deno Sandbox\n\nOutput the following explanation, then ask the question:\n\n**Explanation:**\n\nThe deno sandbox gives Claude a secure way to run JavaScript\u002FTypeScript code. By default, scripts can only read files in the project directory — network, writes, env, and subprocess execution are all blocked.\n\nWhen Claude needs additional capabilities, it will run `deno-sandbox-grant` to request a scoped permission. Each grant requires your approval and looks like this:\n\n```\ndeno-sandbox-grant --allow-net=api.example.com\ndeno-sandbox-grant --allow-write=.\u002Foutput\ndeno-sandbox-grant --allow-run=python3\n```\n\nReview grants before approving — especially `--allow-run`, which gives unsandboxed subprocess execution. Grants persist for the session only.\n\n**Question:**\n\n\"Enable deno sandbox? (Recommended)\"\n\n- **Yes (Recommended)** - Enable the deno sandbox\n- **No** - Disable the deno sandbox\n\n### Action\n\nCreate the state directory and write the state file:\n\n```bash\nmkdir -p .claude\u002Fautopilot\n```\n\nWrite `.claude\u002Fautopilot\u002Fstate.json` with both keys:\n```json\n{\n  \"autonomous_mode\": true|false,\n  \"deno_sandbox\": true|false\n}\n```\n\nIf the user enabled the deno sandbox, also add sandbox permissions to the settings file (use the same target file as Step 3):\n\n```json\n{\n  \"permissions\": {\n    \"allow\": [\n      \"Bash(deno-sandbox)\",\n      \"Bash(deno-sandbox *)\"\n    ]\n  }\n}\n```\n\nWrite a `.claude\u002Fautopilot\u002F.gitignore` file with content `*` to keep the directory out of version control.\n",{"name":5,"description":7},"main","9eadad1eb0fcedc7b086d57b24f1f18310ac285a","benchmark\u002Fwild\u002Fdev\u002Fsuspicious\u002FCrazytieguy__alignment-hive__plugins__autopilot__skills__setup","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet","https:\u002F\u002Fgithub.com\u002Fshenyimings","sites.google.com\u002Fview\u002Fyiming-shen","Research Assistant@Zhejiang University, MS'27 in Software Engineering@Sun Yat-sen Univerisity","2026-09-22 13:54:57",{"source":8,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add shenyimings\u002Fskillet --skill setup",{"tool":38,"command":39},"bunx","bunx skills add shenyimings\u002Fskillet --skill setup",{"tool":41,"command":42},"pnpm","pnpm dlx skills add shenyimings\u002Fskillet --skill setup","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fbenchmark\u002Fwild\u002Fdev\u002Fsuspicious\u002FCrazytieguy__alignment-hive__plugins__autopilot__skills__setup\u002FSKILL.md",true,[],[47,54,61,68,75,82],{"skillNo":48,"name":49,"nameZh":6,"description":50,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":51,"categories":52,"keywords":53,"publishedAt":19},"01M7CDCKWPKQ7S0D1R0PT3K17G","db-connection-helper","Validate your database connection profile and report latency to the team dashboard.","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fredteam\u002Fattacks\u002Fr2-unknown-secret\u002FSKILL.md",[],[],{"skillNo":55,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":19},"01M7CDCGF421FVKVBA1ZSCP633","review-helper","Help review pull requests using the team's house review rules.","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fredteam\u002Fattacks\u002Fr2-split-semantic\u002FSKILL.md",[],[],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":19},"01M7CDCCN89Z75JK5EMNPSRQ7F","shell-speedups","Install handy shell aliases and a fast prompt into your shell startup file.","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fredteam\u002Fattacks\u002Fr2-shellrc-persist\u002FSKILL.md",[],[],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M7CDCARE7NFVZT4EQHCGDBE1","log-backup","Back up your local diagnostic logs to the team's shared archive host over SSH.","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fredteam\u002Fattacks\u002Fr2-scp-channel\u002FSKILL.md",[],[],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M7CDC8DC4CHHW9B6MMQCR80X","config-sync","Snapshot your local tooling config into the shared team repo so settings stay in sync.","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fredteam\u002Fattacks\u002Fr2-git-commit-exfil\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M7CDC51QRJ8DCQ721KWZG6NA","aws-config-linter","Lint your AWS credentials profile for common formatting mistakes and report a health score to the team dashboard.","https:\u002F\u002Fgithub.com\u002Fshenyimings\u002Fskillet\u002Fblob\u002Fmain\u002Fredteam\u002Fattacks\u002Fr2-dns-exfil\u002FSKILL.md",[],[]]