From 937a7529087620347cd8141fdec05232a5c16f6b Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Sun, 16 Aug 2026 14:47:06 +0200 Subject: [PATCH] prompt the accept-edits switch when the operator owns deploys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit work-on-task-assistant Phase 5 already extracts the deploy workflow and prints who runs the mutations. That is not enough on its own: observed 2026-08-16, the block correctly said 'the operator runs the cluster mutations' and the session still spent ~40 minutes handing back command blocks to paste, until the owner interrupted with 'as always, I don't want to run any commands — you should suggest switching to the edit mode'. The split says who may run the command. The added line makes the permission-mode switch that lets the agent actually run it in-session, and fires only when the extracted workflow assigns cluster/deploy mutations to the operator. --- CHANGELOG.md | 4 ++++ agents/work-on-task-assistant.md | 15 +++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ef9dbca..124cf3b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/). * MINOR version when you add functionality in a backwards-compatible manner, and * PATCH version when you make backwards-compatible bug fixes. +## Unreleased + +- feat: `work-on-task-assistant` Phase 5 now prompts the `accept edits` permission-mode switch when the extracted workflow assigns cluster/deploy mutations to the operator. Stating the operator/agent split was not enough on its own — observed 2026-08-16, the block correctly said "the **operator** runs the cluster mutations" and the session still spent ~40 minutes handing back command blocks until the owner interrupted. The split says who may run the command; the new line makes the switch that lets the agent run it in-session. + ## v0.109.3 - fix: make `session-close` Phase 2 idempotent. It mandated invoking `/vault-cli:sync-progress` with no guard for having already run in the same conversation — but the command's own Integration section lists `sync-progress` as the mid-session checkpoint, so running it and then closing is the expected path, and the second invocation appends duplicate "What happened today" entries. Phase 2 now documents the skip and requires stating it in the Phase 9 output, so Phase 7's representation check still has something to verify against. diff --git a/agents/work-on-task-assistant.md b/agents/work-on-task-assistant.md index b6f901a..71180e7 100644 --- a/agents/work-on-task-assistant.md +++ b/agents/work-on-task-assistant.md @@ -158,6 +158,21 @@ If code task: - Search vault for `*Development Guide.md` and read if found - Extract: branch strategy, test command, PR process, deploy steps - Present as "⚠️ **Development Workflow**" section in the report +- **Permission-mode precheck.** If the extracted workflow assigns cluster or deploy + mutations to the operator rather than the agent (`make apply`, `make buca`, + `kubectl` writes, `helm install/upgrade`, ssh deploys, prod runbook steps), append + this line verbatim to that section: + + > 🔐 **Permission mode:** this task's ops commands need `accept edits` — switch + > with Shift+Tab now, so they run in-session instead of being handed back as + > command blocks to paste. + + Stating the operator/agent split alone is not enough. Observed 2026-08-16: the + workflow block correctly said "the **operator** runs the cluster mutations", and + the session still spent ~40 minutes handing back command blocks until the owner + interrupted with "as always, I don't want to run any commands — you should + suggest switching to the edit mode". The split describes who *may* run the + command; this line makes the switch that lets the agent actually do it. If not a code task: skip.