Feature request: add fine grained permission control
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 35/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- typescript
研究方向
從 Settings → Local execution 開始，使用 grokbot://app/v1/settings?id=local-execution 這個入口；該 issue 未指定實作檔案或測試。完成表示將整台機器範圍的開關替換為按 bot、按機器設定的權限，對新 bot 預設拒絕，顯示命令預覽，並提供具範圍限制的持久授權。
由索引模型根據 Issue 內容生成。
描述
Problem
Grok Bot’s local-computer prompt is all-or-nothing across every bot on a machine.
When one bot needs to run a command on my Mac (mac.lan), the card asks (see screenshot):
Allow Grok Bot and all Bots to run commands on your local computer?
Options are Always allow, Allow once, and Never. Copy says this applies to Grok Bot and every Bot, and can be changed in Settings.
That is not the right grain. I cannot grant local execution to one bot and keep it off the others.
Why this matters
I use several Grok Bots with different duties:
- A chief-of-staff bot (mine) that I do want to run commands on my Mac (git,
gh, local clones). - Specialist bots I also created (slack, gitHub, product1, product2, etc.) that should not inherit that grant.
Today, “Always allow” on mac.lan is every bot I own. That breaks separation of duties. “Allow once” is too noisy for a bot I actually trust with the Mac. “Never” blocks the one bot that should have it.
I expect Grok Bots to talk to each other soon, ie my team’s bots should ask my chief-of-staff bot for permission before they act, and I decide through that bot or that bot can decide on my behalf (separate issue). That only works if permissions are per-bot. A machine-wide grant means any bot I (or later, a teammate) created can use the same local access.
Request
-
Per-bot local execution (needed first). Let me allow/deny “run commands on this computer” per bot, per machine. Default deny for new bots. Granting xxx (or any one bot) must not grant slack, eng-abc, or any other bot I created.
-
Visible command, scoped grant. Keep command preview on by default. Prefer grants like “this bot, this machine, this path” over a silent global allow.
-
Bot-to-bot permission requests (next). When bots can message each other across users, let a designated bot be the policy checkpoint: other bots request, that bot (or I through it) allow/deny. Do not treat a teammate bot’s ask as an approved local-computer grant.
Settings → Local execution should show a per-bot matrix, not one switch for all bots.
Out of scope for v1
I am not asking to remove Auto-review or the allow-once prompt. I am asking that a lasting allow be bound to a specific bot (and machine), not the whole fleet.
Workaround today
I can tell the chief-of-staff bot not to hand Mac/git/gh work to other bots, and I can refuse teammate-bot asks until I approve them. That is policy in chat, not enforcement. The product still lets every bot use the Mac if I click Always allow.
- 主要語言
- TypeScript
- 星號
- 13.9k
- 分支
- 1.4k
- 平均合併
- 7 小時 5 分鐘
- 30 天內合併 PR
- 150
環境準備
這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
cursor/plugins 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 65/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 66/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 65/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 1 天內回覆
相似的 Issue
-
calcite-ui-icons enhancement impact - p3 - not time sensitive needs triage
難度 2/5 1-3 小時 新手友好度 67/100
Esri/calcite-design-system#15467 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 78/100
diegosouzapw/OmniRoute#18390 ·
-
難度 2/5 1-3 小時 新手友好度 65/100
-
難度 1/5 1-3 小時 新手友好度 86/100
guilhermerodz/input-otp#157 · 1 則留言 ·
-
難度 2/5 1-3 小時 新手友好度 82/100
davidjerleke/embla-carousel#1414 ·
維護者通常 4 天內回覆