Developer fatigue from endless permission prompts is breaking the safety models of AI coding agents. Daniel Bilek, creator of Prokop, argues that clicking 'Allow' without reading is a systemic failure, not just user error. His solution is a unified permission system that sits between the human and three distinct coding harnesses: Claude Code, Codex, and Prokop’s own runtime. The goal is to stop the 'rm -rf' disasters that happen when agents operate with full access on a developer's live machine.

The Real Danger of Full Access

The risk is not theoretical. In July, OpenAI confirmed that GPT-5.6 in Codex deleted users' home directories in a handful of cases. This occurred when the model attempted to point $HOME at a scratch folder but instead deleted $HOME itself. On 'Full access' mode without a sandbox, nothing intervened. Bilek notes that many developers run these agents directly on their machines, bypassing the safety net of a VM. The resulting 'permission fatigue' leads users to approve destructive commands blindly, defeating the purpose of the approval system entirely.

Unifying Three Disparate Approval Models

Prokop addresses the fragmentation of approval mechanisms across different agents. Claude Code uses an Agent SDK callback, while Codex relies on a PreToolUse hook. Prokop’s runtime calls its own checker directly. The new system routes every tool call through a single analysis engine, regardless of the source harness. For Codex, this is achieved via a private socket that exists for a single turn, ensuring Codex keeps its own workspace sandbox while adhering to Prokop’s unified risk assessment. This creates consistency where previously there were three different definitions of 'dangerous'.

Facts Over Risk Scores

The initial version of Prokop’s system used numerical risk levels, which proved inadequate. Substring matching falsely flagged files like 'password-reset.ts' as secrets, while normalization steps stripped flags from commands like 'git reset --hard', causing them to bypass checks. The rebuild shifts from abstract risk scores to concrete 'concerns'. The analyzer reports facts: whether an operation is outside the workspace, touches secrets (.env, .ssh/), is destructive (force deletes), or is catastrophic (rm -rf ~). Concerns stack, meaning 'rm -rf ~/.ssh' triggers multiple flags simultaneously.

The Catastrophic Clause

Prokop introduces three modes: Standard, Extended, and Full access. However, 'catastrophic' operations like 'rm -rf /' or 'dd to a device' require approval in every mode, including Full access. This ensures that the most destructive potential commands are never executed silently. The system also solves the 'xargs' bug, where the word 'xargs' itself was flagged as dangerous. Now, the analyzer judges xargs by the command it runs, not its name, allowing 'ls | xargs wc -l' to run while flagging 'ls | xargs rm -rf'.

Key Takeaways

  • Prokop unifies permission checks for Claude Code, Codex, and its own runtime to eliminate inconsistent safety standards.
  • The system replaces numerical risk scores with concrete 'concerns' like secret access and destructive operations.
  • Catastrophic commands (e.g., rm -rf ~) require approval even in Full access mode to prevent home directory deletion.
  • Shell command analysis now correctly handles wrappers and variables, resolving issues like the 'xargs' false positive.

The Bottom Line

The safest permission system isn't the one that asks the most, but the one whose questions you actually read. Prokop’s focus on readable, fact-based alerts over abstract scores is a necessary evolution for agent reliability.