Learned-rule candidate: pre-grant scoped access for non-interactive agent runs #67

Repeated failure pattern

Agents launched non-interactively by FixLab (no user to answer prompts) were auto-denied on permission prompts, which blocked jobs at early stages. Each case was fixed separately, after the fact:

• Grant non-interactive agents access to linked node_modules directories #56: node_modules junctions that resolve outside the repository were denied on the path-permission prompt. The job was blocked at intake. The fix passed --add-dir in the dashboard and run executors.
• Grant agents access to each job's screenshot directory #57: screenshots stored in the job artifact directory outside the repository were denied ("Permission denied because no interactive user response was available"). Diagnosis was blocked. The fix passed --add-dir for the current job's directory only.
• fix: guide agents to quote the fixlab exec separator and avoid cmd /c #61: on Windows PowerShell the unquoted -- separator for fixlab exec was lost, and the agent fell back to cmd /c. That was denied in a non-interactive session and blocked the job at reproduce. The fix updated all agent guidance copies and the prompt.

These are three distinct pull requests with independent failure evidence. The configured minimum in .github/copilot-code-review.yml is 2 distinct runs.

Proposed candidate rule

When a change makes a non-interactive agent run read, write, or execute something it did not before (an out-of-repository path, a new artifact directory, or a new shell or command form), do two things in the same change:

1. Grant the narrowest explicit access for that specific job-scoped, FixLab-owned path or command in every execution entry point, for example --add-dir <job dir>. Never use --allow-all-paths or broad tool grants.
2. Direct agents toward commands that need no approval, such as quoting the -- separator and avoiding cmd /c.

Add a regression test that asserts the executor receives the grant or the guidance.

Why existing active rules do not cover it

The only active rule, "Mirror cross-runtime guidance in every execution entry point", covers parity of behavioral and validation guidance across surfaces. It does not require anticipating permission prompts in non-interactive runs, and it does not cover scoped path or tool grants passed to the agent process. #56 and #57 were grants in executor code, not guidance parity.

Validation or retirement condition

• Promote only through a reviewed pull request that adds the rule under # Candidate rules or # Active rules.
• Validate that the next 10 pull requests touching agent launch, paths, or commands show no new "permission denied / no interactive user response" blocker (matching the configured minimumCleanRuns: 10).
• Retire through a reviewed pull request after those 10 clean runs.

Security and compatibility risk

• Security: the rule must not widen access. Grants are limited to job-scoped, FixLab-owned directories and keep the invariants about loopback binding, owned-process cleanup, and no credentials or browser state in prompts or logs. Wording must forbid blanket path or tool approval.
• Compatibility: --add-dir behavior may differ between Agency and direct Copilot runtimes, so tests should cover both. The Windows-specific guidance (cmd /c) should be scoped to PowerShell.

No source files were modified. Human PR review is required for promotion.

Generated by Review FixLab learned-rule candidates · copilot · auto · 20.9 AIC · ⊞ 7.1K · ◷