Blog

An unattended agent has no one to click ask

I leave coding agents on a machine I do not watch. A CI job. A laptop I shut and walked away from.

ask means a human is supposed to decide. There is no one at that keyboard. A leftover unused ask is not a fence.

Permissions for an unattended coding agent are not the same as permissions for a session I am staring at. I learned that by copying a laptop policy onto a box I left alone.

Leftover ask is allow when you are attended

On an attended coding host, leftover unused policy ask is allow. That includes Grok and OpenClaw. Leftover unused policy ask is not a host-wire decision and does not open an ask UI. You get a block, or the command runs.

OpenCode leftover unused ask does not show an ask screen. I do not describe one. The unused verdict does not pause the tool. It becomes allow.

That's why leftover ask feels safe and is not. I wrote ask in local packs and assumed the host would wait. It did not wait. Nobody clicked. The command ran.

Leftover unused ask will not appear as ask in the host session. It is rewritten before emit. SoftBlock, FM, missing origin, and a leaked decision: ask stay deny. stage unattended is deny. Policy names also include stage.

ask is a draft verdict. It is a note that a human should have been in the loop. If I am not in the loop, the note is not a control.

The other names still mean what they mean. allow runs. deny does not. observe records and still runs. Unattended observe still runs. Observe will not save you overnight. Leftover unused ask is not a host-wire name. It is rewritten before emit. I will not see ask in the session. I do not want a leftover ask pretending it was a deny because I was not there to notice.

Unattended and CI already harden unused ask to deny

Unattended and CI harden leftover unused ask to deny. That is existing --ci or a truthy CI / RYK_CI / RYK_UNATTENDED / RYK_NONINTERACTIVE. There is no new flag. There is no rv unattended command.

If I am not in the room, I do not want a draft verdict to become allow. Those keys are how leftover unused ask becomes deny.

deny is the fence. You should see it before the tool runs.

On OpenCode the visible deny is denied: a toast titled denied, a tool error like denied <context>: <detail>, or the fallback denied this command. Other hosts use other deny strings. It is not a [rv] DENIED line.

I prove the OpenCode path before I trust the wiring. The walkthrough is Trigger a known OpenCode deny before you leave. No block on that host means the hook never fired.

If the command starts with no block, I stop. I do not add more ask rules. Writing more policy does not cover a silent host. I wrote that miss in If a hook never fires, the action already ran.

rv test and rv explain run the in-process shell_engine. They do not apply leftover-ask rewrite or the unattended/--ci fold. They do not prove the host will fire the hook. They are not how I prove unattended harden.

What I leave running

I do not leave an agent on a policy I only tested while I was sitting there.

curl -fsSL https://rykanv.com/install | sh
rv setup
rv hermes

rv setup is first-run. It creates workspace local packs if missing. Then I launch the host. rv hermes is a real launch.

That path is attended unless --ci or an unattended env key is set. Leftover ask stays allow if you just walk away. Always-on Hermes leftover-ask deny is rv agents setup hermes (writes .rv_unattended). There is no rv unattended command.

CI is the same problem with a worse clock. There is never a person on that box. Unused ask has to hit --ci or those env keys, or the job is running attended leftover-ask allow with no one attending.

I still write policy. I treat ask as a fence only after I know whether --ci or those env keys are on. There is no product mode named attended. Leftover unused ask hardens when --ci or those env keys are truthy.

A laptop policy that says ask is a reminder to me. The same file on an unattended box is a hole unless leftover unused ask hardened to deny. I check those keys before I leave. I do not hope the model behaves.

What this is not

Install is on the docs. How the check works is in Runtime guardrails decide allow, ask, or deny before the tool runs. Other posts are on the blog. I start from rykanv.com.

Leftover ask is a policy verdict. It is not a person in the room. If I leave the machine, I want unused ask hardened to deny, and I want to have seen the deny once before I go.