analyst mode --yolo bypass: file writes NOT blocked with --yolo flag #377
Description
Bug Summary: When using --agent analyst with --yolo, file writes are NOT blocked. The catch-all wildcard deny (*: deny) is bypassed by --yolo, allowing model creation. Interactive mode (no --yolo) correctly blocks file writes.
Expected Behavior: The analyst agent should not be able to write/edit files regardless of the --yolo flag.
Actual Behavior: --yolo bypasses the catch-all wildcard deny, permitting file writes and model creation.
Proposed Fix: Add explicit named denies for write/edit operations in the analyst agent permissions config instead of relying on the wildcard deny.
Workaround: Do not use --yolo with analyst mode.
Tested On: v0.5.7
Related Jira: AI-5980
Metadata
| Field | Value |
|---|---|
| CLI Version | 0.5.7 |
| Platform | darwin |
| Architecture | arm64 |
| OS Release | 25.3.0 |
| Category | bug |
| Working Directory | altimate-openclaw-workspace |
| Session ID | ses_2e9112e82ffegslQvjpDE5XUbc |