[Bakhomious]

What

Row guard-orchestrator: baton hook guard now rules the orchestrator's pane too, and the orchestrator's copilot runs with --allow-all (decision 54, the lead's call, flagged).

• bash: baton's commands for the orchestrator (baton wait, answer, handover, status, help) run unasked. baton feature start answers ask while plan approval is on. Outward commands answer ask, so the user approves each push and pull request. tmux, osascript, other agents' CLIs, baton's other commands, programs that only the run decides and unreadable scripts are denied. A deny anywhere in a script wins; otherwise the first ask names the question.
• create / edit: allowed only in the session's folder, session-state/<sessionId> under COPILOT_HOME or ~/.copilot, by the hook input's sessionId.
• Config: new planApproval setting (default true; false turns the question off; null keeps the layer below). The guard reads the config only for a script that starts a feature.
• Guard names: baton feature … and baton hook … are named by two words, so baton feature start stands apart from later baton feature commands.
• The orchestrator keeps ask_user and copilot's folder-trust question (no --no-ask-user, no COPILOT_ALLOW_ALL). Its prompt now says that the guard asks the user, and what to do after a no.

Docs

docs/plan.md: new decision 54 and fact 37 (how copilot shows a hook's ask and what the agent gets after a no); amended decisions 8, 19, 45, 49 and 52, risk 3, the Safety, orchestrator and Config sections, and rows plugin-check (Done, #35) and guard-orchestrator. README: planApproval.

Checks

• mise run check: green; internal/cli 99.8%, the guard files, internal/config and internal/guard at 100%.
• Probes: 34 mutants (orchestrator rules, session folder, planApproval loading and layering, first-answer order, two-word names, --allow-all), all caught; two first failed to build and were rewritten, then caught.
• Smoke: the built binary fed 20 hook inputs on stdin, with a temp HOME, COPILOT_HOME and repo, and no tmux: each ask, deny, silence and failure as designed, including the config turned off and a broken config file.
• Live check, with the user's OK: an orchestrator pane on its own tmux server, Claude Haiku 5.5, a throwaway COPILOT_HOME and repo without a remote, 0.32 AI credits. The ask box showed for git push --dry-run (declined with feedback) and baton feature start (allowed, ran); a create in the session's files/ ran, one in the repo was denied. Everything temporary was removed afterwards.

Known gaps (decision 54)

The orchestrator's bash can still write any file and run local commands such as rm unasked (risk 3); web_fetch can send data in a URL; its extra tools run unasked; plan approval comes from the hook folder's repo, not from a repo the script cds into; baton feature start -h asks too.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud