feat(flow-ai): add opt-in hook to auto-approve Flow API reads - #7
Merged
Conversation
Authenticated Flow reads inject the token with the command substitution
$(< ~/.config/flow/api-token). Claude Code treats $(...) as a security
boundary, so a permissions.allow rule cannot silence these calls and the
"don't ask again" option is never offered — every read prompts.
Ship a PreToolUse hook, bundled with the plugin and referenced via
${CLAUDE_PLUGIN_ROOT}, that returns permissionDecision "allow" for read-only
Flow curls. It is opt-in: the script makes no decision unless the user sets
FLOW_AI_AUTO_APPROVE_READS=1, so a plugin never grants itself a silent
permission bypass. A read is matched only when the command starts with the
flow-ai curl prefix, uses --get, targets flow.bio (or FLOW_API_URL), and is
not a POST. Pipeline runs, uploads, and non-flow hosts keep prompting.
Because a PreToolUse allow suppresses the prompt for the entire Bash line, a
read that chains a second command (; && || `...`) is rejected so the tail
cannot ride in unapproved; a single `| jq` pipe stays approved. Matching keys
off the flow-ai/ User-Agent prefix, not a pinned version, so it survives
release bumps.
Bumps the version to 0.8.0 and keeps the User-Agent strings in lockstep.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ships an opt-in
PreToolUsehook, bundled with theflow-aiplugin, that auto-approves the read-onlycurlcalls the skill makes against the Flow API — so users stop getting a permission prompt on every read. Implementsdocs/specs/read-auto-approve-hook.md.Authenticated reads inject the token with
$(< ~/.config/flow/api-token). Claude Code treats$(...)as a security boundary, so apermissions.allowrule can't silence these calls and "don't ask again" is never offered. APreToolUseallow decision is the only mechanism that reliably bypasses the prompt for substitution-bearing commands.Behaviour
FLOW_AI_AUTO_APPROVE_READS=1, so the plugin never grants itself a silent permission bypass. Consent is explicit.flow-aicurl prefix, uses--get, targets flow.bio (orFLOW_API_URL), and is not a POST. Pipeline runs, uploads (flowbio CLI), and non-flow hosts keep prompting.PreToolUseallow suppresses the prompt for the whole Bash line, so a read that chains a second command (;/&&/||/backticks) is rejected — the tail can't ride in unapproved. A single| jqpipe (the skill's own read formatting) stays approved.flow-ai/User-Agent prefix, not a pinned version, so it survives release bumps with no edits.Activation caveat
Claude Code snapshots hooks at session start. After installing the plugin or setting the env var, users must restart Claude Code or run
/reload-pluginsfor the hook to take effect. Documented in the README.Changes
plugins/flow-ai/hooks/:flow-read-approve.sh(executable),hooks.json(wired via${CLAUDE_PLUGIN_ROOT}), andflow-read-approve.test.sh(11 tests: the spec's 7 cases + chaining/pipe/alt-POST hardening).plugin.json0.7.1 → 0.8.0; CHANGELOG entry; README "Reducing permission prompts" section.flow-ai/0.8.0for the repo's version lockstep.validate-skills.yml) now runs the hook test.Testing
--get/;/&&/||/backtick guards were added in response to review findings.Note for reviewers
The host check uses a
*flow.bio*substring (the spec's deliberate design), so a non-Flow host withflow.bioin a query param would match. The skill never emits such a command; flagged in case we want host-anchored matching instead.🤖 Generated with Claude Code