Agent and waiver commands

Commands that let agents publish, and that waive leak findings a person has checked.

Grants that let coding agents publish, and waivers for leak findings a person has checked. Making either needs a person at a console. Each card shows the command’s own help: ghostbranch <command> --help prints the same. Every command also takes the global flags.

agents allow

Let agents publish to this repo with --yes, for a while (needs a person at a console)

Usage

ghostbranch agents allow [flags]

Description

agents allow lets coding agents on this machine publish to one repo pair with --yes, without the console code, for 1h, 6h (the default), 1d, 7d, 15d, 30d or 90d, or --until-revoked. Making the grant itself needs a person to type a code at a console, so an agent cannot grant itself. Agents still need a green gate and a clean leak scan for every publish. Grants live on this machine only.

Flags

Flag	Value	Default	Description
--for	<string>	—	how long: 1h, 6h (default), 1d, 7d, 15d, 30d or 90d
--plan	—	—	preview the grant without making it
--until-revoked	—	—	never expire; take it back with ghostbranch agents revoke

agents status

agents statusread-only

List agent grants, and whether the current token can publish to the public repo

Usage

ghostbranch agents status

agents revoke

Take back the agent grant for this repo (or --all); needs no console

Usage

ghostbranch agents revoke [flags]

Flags

Flag	Value	Default	Description
--all	—	—	revoke every grant in this workspace (also clears a grants.json that isn't valid JSON; a file from a newer Ghostbranch is kept); with --repo, every grant for that repo
--plan	—	—	preview what would be revoked

waivers add

Waive leak findings that are false positives (needs a person at a console)

Usage

ghostbranch waivers add <feature> <id>... [flags]

Description

waivers add lets a publish go ahead despite leak findings a person has checked and judged safe, such as a fake key in a test fixture. It rebases, strips and scans the feature again on this machine (no push, no CI), shows each finding at the console, and needs a person to type a code: an agent cannot waive. A waiver covers exactly that content in that file; changed content is a new finding. Findings in the commit message, branch or PR text are never waivable: change the text instead. Waivers live on this machine only.

Flags

Flag	Value	Default	Description
--plan	—	—	show what would be waived without waiving it
--reason	<string>	—	why these findings are safe to publish (recorded in the ledger)

waivers list

waivers listread-only

List waivers for this repo (or every repo when none can be told apart)

Usage

ghostbranch waivers list

waivers revoke

Revoke waivers for this repo, or every waiver with --all; needs no console

Usage

ghostbranch waivers revoke <id>... | --all [flags]

Flags

Flag	Value	Default	Description
--all	—	—	revoke every waiver in this workspace (also clears a waivers.json that isn't valid JSON; a file from a newer Ghostbranch is kept)
--plan	—	—	preview what would be revoked