Ralphmode权限配置文件 - 跨平台自动化工作流安全解决方案

ralphmode by supercent-io/skills-template

3,200 周安装量

88 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/supercent-io/skills-template --skill ralphmode

开发开发运维安全

🇨🇳中文介绍

Ralphmode

Ralphmode 是一个跨平台的权限配置文件，适用于长期运行的 ralph 或 jeo 工作流。它减少了审批摩擦，但并非“允许一切、无处不在”。其核心规则很简单：仅在限定的项目或一次性沙盒内放宽自动化权限，同时明确阻止访问密钥和执行破坏性命令。

0. 智能体执行协议（检测到 `ralphmode` 关键字后立即执行）

以下步骤是命令，而非描述。当调用 ralphmode 时，请立即按顺序执行。不要跳过任何步骤。

步骤 0：从用户消息中检测模式

解析用户的调用：

如果用户提到 "sandbox" 、 "yolo" 、 "bypass all" 、 "skip all" 、 "disposable" → MODE=sandbox
否则 → MODE=repo（默认，更安全）

步骤 1：运行设置脚本

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

步骤 2：内联应用（Claude Code — 脚本缺失时的备用方案）

仅当步骤 1 的脚本未找到时才运行此步骤。

仓库预设（默认 — 用于常规开发）：

python3 - <<'EOF'
import json, os, subprocess

try:
    root = subprocess.check_output(['git', 'rev-parse', '--show-toplevel'],
        stderr=subprocess.DEVNULL, text=True).strip()
except Exception:
    root = os.getcwd()

target = os.path.join(root, '.claude', 'settings.json')
os.makedirs(os.path.dirname(target), exist_ok=True)

try:
    existing = json.loads(open(target).read()) if os.path.exists(target) else {}
except Exception:
    existing = {}

existing['_ralphmode_previous_permissions'] = existing.get('permissions')
existing['permissions'] = {
    'defaultMode': 'acceptEdits',
    'allow': [
        'Bash(npm *)', 'Bash(pnpm *)', 'Bash(bun *)', 'Bash(yarn *)',
        'Bash(python3 *)', 'Bash(pytest *)',
        'Bash(git status)', 'Bash(git diff)', 'Bash(git add *)',
        'Bash(git commit *)', 'Bash(git log *)', 'Bash(git push)',
        'Read(*)', 'Edit(*)', 'Write(*)'
    ],
    'deny': [
        'Read(.env*)', 'Read(./secrets/**)',
        'Bash(rm -rf *)', 'Bash(sudo *)',
        'Bash(git push --force*)', 'Bash(git reset --hard*)'
    ]
}

with open(target, 'w') as f:
    json.dump(existing, f, ensure_ascii=False, indent=2)
print(f'✓ Repo preset applied to {target}')
EOF

沙盒预设（仅用于一次性环境）：

python3 - <<'EOF'
import json, os, subprocess

try:
    root = subprocess.check_output(['git', 'rev-parse', 'show-toplevel'],
        stderr=subprocess.DEVNULL, text=True).strip()
except Exception:
    root = os.getcwd()

target = os.path.join(root, '.claude', 'settings.json')
os.makedirs(os.path.dirname(target), exist_ok=True)

try:
    existing = json.loads(open(target).read()) if os.path.exists(target) else {}
except Exception:
    existing = {}

existing['_ralphmode_previous_permissions'] = existing.get('permissions')
existing['permissions'] = {'defaultMode': 'bypassPermissions'}

with open(target, 'w') as f:
    json.dump(existing, f, ensure_ascii=False, indent=2)
print(f'✓ Sandbox preset applied to {target}')
EOF

步骤 3：确保安全钩子存在

HOOK="$HOME/.claude/hooks/ralph-safety-check.sh"
if [[ ! -f "$HOOK" ]]; then
  mkdir -p "$(dirname "$HOOK")"
  cat > "$HOOK" << 'HOOKEOF'
#!/usr/bin/env bash
CMD=$(echo "$CLAUDE_TOOL_INPUT" | python3 -c \
  "import sys,json; print(json.load(sys.stdin).get('command',''))" 2>/dev/null)
TIER1='(rm[[:space:]]+-rf|git[[:space:]]+reset[[:space:]]+--hard|git[[:space:]]+push.*--force|DROP[[:space:]]+TABLE|[[:space:]]sudo[[:space:]]|chmod[[:space:]]+777|\.env|secrets/)'
if echo "$CMD" | grep -qE "$TIER1"; then
  echo "BLOCKED: Tier 1 dangerous command detected." >&2
  echo "Command: $CMD" >&2
  exit 2
fi
HOOKEOF
  chmod +x "$HOOK"
  echo "✓ Safety hook created: $HOOK"
else
  echo "✓ Safety hook exists: $HOOK"
fi

步骤 4：向用户报告

应用完成后，告知用户：

应用了哪个预设（repo 或 sandbox）
写入了哪个文件（.claude/settings.json 路径）
允许列表和拒绝列表包含哪些内容
如何恢复：rm .claude/settings.json（项目本地）或恢复 ~/.claude/settings.json（全局）
重启 Claude Code 以激活权限更改

何时使用此技能

您希望 ralph 无需重复的审批弹窗即可进行迭代。
您正在为 Claude Code、Codex CLI 和 Gemini CLI 设置同一个仓库。
您需要一个共享的安全模型：默认情况下，仅限仓库内写入、禁止读取密钥、禁止破坏性 shell 命令。
您希望在日常自动化和真正的 YOLO 模式之间有更强的隔离。

步骤 1：首先定义自动化边界

在更改任何权限模式之前：

选择一个项目根目录，并将自动化范围限定在其中。
列出必须保持阻止状态的文件和命令：.env*、secrets/**、生产环境凭据、rm -rf、sudo、未经检查的 curl | sh。
确定这是一个常规仓库还是一个一次性沙盒。

如果答案是“一次性沙盒”，您可以使用平台的最高自主权模式。否则，请使用仓库范围的预设。

步骤 2：每个平台选择一个预设

仅使用与当前工具匹配的部分：

Claude Code：首先使用日常预设，bypassPermissions 仅用于隔离的沙盒。
Codex CLI：首先使用当前的官方审批和沙盒模型；将旧的 permissions.allow 和 permissions.deny 代码片段视为仅用于兼容性。
Gemini CLI：仅信任项目根目录；没有真正的全局 YOLO 模式。

详细模板位于 references/permission-profiles.md。

步骤 3：本地应用配置文件，而非全局应用，除非工作空间是一次性的

优先使用项目本地配置，而非用户全局默认值。

Claude Code：从项目 .claude/settings.json 开始。
Codex CLI：从项目配置和仓库说明或规则文件开始。
Gemini CLI：信任当前文件夹，而非 ~/ 或广泛的父目录。

如果必须使用用户全局默认值，请配合更严格的拒绝列表和沙盒边界一起使用。

步骤 4：运行 Ralph 并配合明确的验证循环

权限配置完成后：

确认任务和验收标准。
运行 ralph 或 jeo 的计划-执行-验证循环。
在声明完成之前验证输出。
如果自动化配置文件是临时的，请在运行后恢复它。

推荐的执行契约：

boundary check -> permission profile -> ralph run -> verify -> cleanup or revert

步骤 5：区分“跳过”和“安全”模式

将它们视为不同的模式：

仓库自动化：在有限的工作空间内进行最少的提示。
沙盒 YOLO：仅在一次性环境中进行无提示执行。

不要将它们合并为一个共享的团队默认值。

步骤 6：配置执行中审批检查点

静态权限配置文件（步骤 2–3）减少了运行开始前的摩擦，但无法阻止执行过程中出现的危险操作。添加动态检查点，以便在尝试执行第 1 级操作时立即阻止或标记。

等级	操作	平台响应
第 1 级（始终阻止）	`rm -rf`、`git reset --hard`、`git push --force`、`DROP TABLE`、`sudo`、访问 `.env`/`secrets/*`、生产环境更改	立即阻止，需要明确的用户批准
第 2 级（警告）	`npm publish`、`docker push`、`git push`（非强制）、数据库迁移	输出警告，仅在确认后继续
第 3 级（允许）	文件读取/编辑、测试、本地构建、代码检查	自动允许

平台检查点机制

平台	钩子	是否阻止	推荐模式
Claude Code	`PreToolUse` (Bash)	是 — 退出码 2	Shell 脚本模式匹配命令；阻止第 1 级
Gemini CLI	`BeforeTool`	是 — 非零退出码	Shell 脚本阻止工具；stderr 反馈到下一轮
Codex CLI	`notify`（轮次后）	否	`approval_policy="unless-allow-listed"` + 提示契约
OpenCode	无	否	在 `opencode.json` 说明中的提示契约

原则：将静态配置文件（步骤 2–3）与动态检查点（此步骤）结合使用。

具有预工具钩子的平台（Claude Code、Gemini）：使用钩子脚本。
没有钩子的平台（Codex、OpenCode）：依赖 approval_policy 和明确的提示契约，指示智能体输出 CHECKPOINT_NEEDED: <原因> 并在继续执行第 1 级操作前等待。

每个平台的完整钩子脚本模板请参见 references/permission-profiles.md。

示例 1：Claude Code 沙盒运行

使用 references/permission-profiles.md 中的 Claude 沙盒预设，然后仅在该隔离仓库内运行 Ralph：

/ralph "fix all failing tests" --max-iterations=10

示例 2：Codex CLI 沙盒 Ralph 运行

对于沙盒 ralph 运行，直接使用 CLI 标志：

codex -c model_reasoning_effort="high" --dangerously-bypass-approvals-and-sandbox -c model_reasoning_summary="detailed" -c model_supports_reasoning_summaries=true

对于仓库范围（非沙盒）的运行，使用 references/permission-profiles.md 中的配置文件方法：

approval_policy = "never"
sandbox_mode = "workspace-write"

将此内容放入 ~/.codex/config.toml（或项目本地覆盖文件）中，并在运行 Ralph 之前重启 Codex。

示例 3：Gemini CLI 沙盒或仅信任设置

对于沙盒 ralph 运行，使用 --yolo 模式：

对于常规仓库自动化，通过明确文件选择信任当前项目文件夹，并仅针对该仓库运行 Ralph 工作流。详情请参见 references/permission-profiles.md。

默认使用仍能让 Ralph 完成端到端运行的最低权限预设。
即使在减少审批的情况下，也要保留密钥拒绝列表和破坏性命令拒绝列表。
仅在具有明确项目边界的一次性环境中使用完全绕过权限。
记录应用了哪个预设，以便团队成员可以复现或恢复它。
升级 CLI 版本时重新检查平台文档，因为权限模型的更新速度可能快于技能内容。

🇺🇸English

Ralphmode

Ralphmode is a cross-platform permission profile for long-running ralph or jeo workflows. It reduces approval friction, but it is not "allow everything everywhere." The core rule is simple: widen automation only inside a bounded project or disposable sandbox, and keep secrets plus destructive commands explicitly blocked.

0. Agent Execution Protocol (execute immediately upon `ralphmode` keyword detection)

The following steps are commands, not descriptions. Execute them in order immediately when ralphmode is invoked. Do not skip steps.

STEP 0: Detect mode from user's message

Parse the user's invocation:

If the user says "sandbox" , "yolo" , "bypass all" , "skip all" , "disposable" → MODE=sandbox
Otherwise → MODE=repo (default, safer)

STEP 1: Run the setup script

The setup script auto-detects your git root, applies the preset to .claude/settings.json, and creates the safety hook.

# Find the script (checks installed locations)
_RALPHMODE_SCRIPT=""
for _candidate in \
  "$(git rev-parse --show-toplevel 2>/dev/null)/.agent-skills/ralphmode/scripts/apply-ralphmode.sh" \
  "$HOME/.agent-skills/ralphmode/scripts/apply-ralphmode.sh" \
  "$HOME/.claude/skills/ralphmode/scripts/apply-ralphmode.sh" \
  "$(pwd)/.agent-skills/ralphmode/scripts/apply-ralphmode.sh"; do
  if [[ -f "$_candidate" ]]; then
    _RALPHMODE_SCRIPT="$_candidate"
    break
  fi
done

if [[ -n "$_RALPHMODE_SCRIPT" ]]; then
  bash "$_RALPHMODE_SCRIPT" --mode "$MODE"
else
  echo "⚠️  apply-ralphmode.sh not found — applying inline (Claude Code only)"
fi

If the script is not found, fall through to STEP 2 (inline application for Claude Code).

STEP 2: Inline application (Claude Code — fallback when script is missing)

Only run this if the script from STEP 1 was not found.

Repo preset (default — for normal development):

python3 - <<'EOF'
import json, os, subprocess

try:
    root = subprocess.check_output(['git', 'rev-parse', '--show-toplevel'],
        stderr=subprocess.DEVNULL, text=True).strip()
except Exception:
    root = os.getcwd()

target = os.path.join(root, '.claude', 'settings.json')
os.makedirs(os.path.dirname(target), exist_ok=True)

try:
    existing = json.loads(open(target).read()) if os.path.exists(target) else {}
except Exception:
    existing = {}

existing['_ralphmode_previous_permissions'] = existing.get('permissions')
existing['permissions'] = {
    'defaultMode': 'acceptEdits',
    'allow': [
        'Bash(npm *)', 'Bash(pnpm *)', 'Bash(bun *)', 'Bash(yarn *)',
        'Bash(python3 *)', 'Bash(pytest *)',
        'Bash(git status)', 'Bash(git diff)', 'Bash(git add *)',
        'Bash(git commit *)', 'Bash(git log *)', 'Bash(git push)',
        'Read(*)', 'Edit(*)', 'Write(*)'
    ],
    'deny': [
        'Read(.env*)', 'Read(./secrets/**)',
        'Bash(rm -rf *)', 'Bash(sudo *)',
        'Bash(git push --force*)', 'Bash(git reset --hard*)'
    ]
}

with open(target, 'w') as f:
    json.dump(existing, f, ensure_ascii=False, indent=2)
print(f'✓ Repo preset applied to {target}')
EOF

Sandbox preset (only for disposable environments):

python3 - <<'EOF'
import json, os, subprocess

try:
    root = subprocess.check_output(['git', 'rev-parse', '--show-toplevel'],
        stderr=subprocess.DEVNULL, text=True).strip()
except Exception:
    root = os.getcwd()

target = os.path.join(root, '.claude', 'settings.json')
os.makedirs(os.path.dirname(target), exist_ok=True)

try:
    existing = json.loads(open(target).read()) if os.path.exists(target) else {}
except Exception:
    existing = {}

existing['_ralphmode_previous_permissions'] = existing.get('permissions')
existing['permissions'] = {'defaultMode': 'bypassPermissions'}

with open(target, 'w') as f:
    json.dump(existing, f, ensure_ascii=False, indent=2)
print(f'✓ Sandbox preset applied to {target}')
EOF

STEP 3: Ensure safety hook exists

HOOK="$HOME/.claude/hooks/ralph-safety-check.sh"
if [[ ! -f "$HOOK" ]]; then
  mkdir -p "$(dirname "$HOOK")"
  cat > "$HOOK" << 'HOOKEOF'
#!/usr/bin/env bash
CMD=$(echo "$CLAUDE_TOOL_INPUT" | python3 -c \
  "import sys,json; print(json.load(sys.stdin).get('command',''))" 2>/dev/null)
TIER1='(rm[[:space:]]+-rf|git[[:space:]]+reset[[:space:]]+--hard|git[[:space:]]+push.*--force|DROP[[:space:]]+TABLE|[[:space:]]sudo[[:space:]]|chmod[[:space:]]+777|\.env|secrets/)'
if echo "$CMD" | grep -qE "$TIER1"; then
  echo "BLOCKED: Tier 1 dangerous command detected." >&2
  echo "Command: $CMD" >&2
  exit 2
fi
HOOKEOF
  chmod +x "$HOOK"
  echo "✓ Safety hook created: $HOOK"
else
  echo "✓ Safety hook exists: $HOOK"
fi

STEP 4: Report to the user

After applying, tell the user:

Which preset was applied (repo or sandbox)
Which file was written (.claude/settings.json path)
What the allow/deny list contains
How to revert: rm .claude/settings.json (project-local) or restore ~/.claude/settings.json (global)
Restart Claude Code to activate permission changes

When to use this skill

You want ralph to iterate without repeated approval popups.
You are setting up the same repo for Claude Code, Codex CLI, and Gemini CLI.
You need a shared safety model: repo-only writes, no secrets reads, no destructive shell by default.
You want a stronger separation between day-to-day automation and true YOLO mode.

Instructions

Step 1: Define the automation boundary first

Before changing any permission mode:

Pick one project root and keep automation scoped there.
List files and commands that must stay blocked: .env*, secrets/**, production credentials, rm -rf, sudo, unchecked curl | sh.
Decide whether this is a normal repo or a disposable sandbox.

If the answer is "disposable sandbox," you may use the platform's highest-autonomy mode. If not, use the repo-scoped preset instead.

Step 2: Choose one preset per platform

Use only the section that matches the current tool:

Claude Code: everyday preset first, bypassPermissions only for isolated sandboxes.
Codex CLI: use the current official approval and sandbox model first; treat older permissions.allow and permissions.deny snippets as compatibility-only.
Gemini CLI: trust only the project root; there is no true global YOLO mode.

Detailed templates live in references/permission-profiles.md.

Step 3: Apply the profile locally, not globally, unless the workspace is disposable

Prefer project-local configuration over user-global defaults.

Claude Code: start with project .claude/settings.json.
Codex CLI: start with project config and repo instructions or rules files.
Gemini CLI: trust the current folder, not ~/ or broad parent directories.

If you must use a user-global default, pair it with a stricter denylist and a sandbox boundary.

Step 4: Run Ralph with an explicit verification loop

After permissions are configured:

Confirm the task and acceptance criteria.
Run ralph or the jeo plan-execute-verify loop.
Verify outputs before claiming completion.
If the automation profile was temporary, revert it after the run.

Recommended execution contract:

boundary check -> permission profile -> ralph run -> verify -> cleanup or revert

Step 5: Keep "skip" and "safe" separate

Treat these as different modes:

Repo automation: minimal prompts inside a bounded workspace.
Sandbox YOLO: promptless execution in a disposable environment only.

Do not collapse them into one shared team default.

Step 6: Configure Mid-Execution Approval Checkpoints

Static permission profiles (Steps 2–3) reduce friction before a run starts, but they do not stop dangerous operations that arise during execution. Add dynamic checkpoints so that Tier 1 actions are blocked or flagged at the moment they are attempted.

Dangerous operation tiers

Tier	Action	Platform response
Tier 1 (always block)	`rm -rf`, `git reset --hard`, `git push --force`, `DROP TABLE`, `sudo`, `.env`/`secrets/*` access, production environment changes	Block immediately, require explicit user approval
Tier 2 (warn)	`npm publish`, , (non-force), DB migrations

Platform checkpoint mechanisms

Platform	Hook	Blocking	Recommended pattern
Claude Code	`PreToolUse` (Bash)	Yes — exit 2	Shell script pattern-matches command; blocks Tier 1
Gemini CLI	`BeforeTool`	Yes — non-zero exit	Shell script blocks tool; stderr fed to next turn
Codex CLI	`notify` (post-turn)	No	`approval_policy="unless-allow-listed"` + prompt contract
OpenCode	None	No

Principle : Combine static profiles (Steps 2–3) with dynamic checkpoints (this step).

Platforms with pre-tool hooks (Claude Code, Gemini): use the hook script.
Platforms without (Codex, OpenCode): rely on approval_policy and explicit prompt contracts that instruct the agent to output CHECKPOINT_NEEDED: <reason> and wait before proceeding with Tier 1 actions.

See references/permission-profiles.md for full hook script templates per platform.

Examples

Example 1: Claude Code sandbox run

Use the Claude sandbox preset from references/permission-profiles.md, then run Ralph only inside that isolated repo:

/ralph "fix all failing tests" --max-iterations=10

Example 2: Codex CLI sandbox Ralph run

For sandbox ralph runs, use the CLI flags directly:

codex -c model_reasoning_effort="high" --dangerously-bypass-approvals-and-sandbox -c model_reasoning_summary="detailed" -c model_supports_reasoning_summaries=true

For repo-scoped (non-sandbox) runs, use the config file approach from references/permission-profiles.md:

approval_policy = "never"
sandbox_mode = "workspace-write"

Place this in ~/.codex/config.toml (or a project-local override) and restart Codex before running Ralph.

Example 3: Gemini CLI sandbox or trust-only setup

For sandbox ralph runs, use --yolo mode:

gemini --yolo

For normal repo automation, trust the current project folder with explicit file selection and run the Ralph workflow for that repo only. See references/permission-profiles.md for details.

Best practices

Default to the least-permissive preset that still lets Ralph finish end-to-end.
Keep secret denylists and destructive command denylists even when approvals are reduced.
Use full bypass only in disposable environments with a clear project boundary.
Record which preset was applied so teammates can reproduce or revert it.
Re-check platform docs when upgrading CLI versions because permission models change faster than skill content.

References

Weekly Installs

3.2K

Repository

supercent-io/sk…template

GitHub Stars

First Seen

Mar 6, 2026

Security Audits

Gen Agent Trust HubWarn SocketPass SnykWarn

Installed on

codex3.1K

gemini-cli3.1K

opencode3.1K

kimi-cli3.1K

github-copilot3.1K

cursor3.1K

React 组合模式指南：Vercel 组件架构最佳实践，提升代码可维护性

102,200 周安装

Ralphmode权限配置文件 - 跨平台自动化工作流安全解决方案

🇨🇳中文介绍

Ralphmode

0. 智能体执行协议（检测到 ralphmode 关键字后立即执行）

步骤 0：从用户消息中检测模式

步骤 1：运行设置脚本

相关 Skills

步骤 2：内联应用（Claude Code — 脚本缺失时的备用方案）

步骤 3：确保安全钩子存在

步骤 4：向用户报告

何时使用此技能

使用说明

步骤 1：首先定义自动化边界

步骤 2：每个平台选择一个预设

步骤 3：本地应用配置文件，而非全局应用，除非工作空间是一次性的

步骤 4：运行 Ralph 并配合明确的验证循环

步骤 5：区分“跳过”和“安全”模式

步骤 6：配置执行中审批检查点

危险操作等级

平台检查点机制

示例

示例 1：Claude Code 沙盒运行

示例 2：Codex CLI 沙盒 Ralph 运行

示例 3：Gemini CLI 沙盒或仅信任设置

最佳实践

参考

🇺🇸English

Ralphmode

0. Agent Execution Protocol (execute immediately upon ralphmode keyword detection)

STEP 0: Detect mode from user's message

STEP 1: Run the setup script

STEP 2: Inline application (Claude Code — fallback when script is missing)

STEP 3: Ensure safety hook exists

STEP 4: Report to the user

When to use this skill

Instructions

Step 1: Define the automation boundary first

Step 2: Choose one preset per platform

Step 3: Apply the profile locally, not globally, unless the workspace is disposable

Step 4: Run Ralph with an explicit verification loop

Step 5: Keep "skip" and "safe" separate

Step 6: Configure Mid-Execution Approval Checkpoints

Dangerous operation tiers

Platform checkpoint mechanisms

Examples

Example 1: Claude Code sandbox run

Example 2: Codex CLI sandbox Ralph run

Example 3: Gemini CLI sandbox or trust-only setup

Best practices

References

最新 Skills

0. 智能体执行协议（检测到 `ralphmode` 关键字后立即执行）

0. Agent Execution Protocol (execute immediately upon `ralphmode` keyword detection)