Help

Approvals: calls that wait for your yes

Start a session with --ask commands (or writes, or network). When the agent makes such a call, it is held and a signed Checkpoint is raised.
--ask commands asks about every shell command. --ask risky asks only about risky ones (git push, rm -r, sudo, publishing, deleting in kubectl/terraform, curl | sh, drop table ...);
--ask-match "git push" --ask-match "re:\bdeploy\b" asks only about commands that match what you give (words, or re:<regular expression>). Everything else runs as the Mandate allows.
In the same window you are asked: Allow shell.exec: npm run build? [y/N/a]. a means yes, and never ask about this exact command again for this agent.
From another window: asp approvals, then asp approvals approve 1 (or refuse 1). asp approvals always lists the commands you said a to; asp approvals forget <n|all> takes them back.
Your answer is signed with your key and goes in the log. The run log says, for each command, whether it was asked about or why not (remembered, no match).