v0.3.1 — Security fix: enforce allowedTools, gate --dangerously-skip-permissions

Security fix

Fixes #1 — an allowlisted chat user could get the agent to run any tool (including Bash) with no permission prompts, because:

• agent.allowedTools was declared in the spawn options interface but never forwarded to claude as --allowedTools. The per-agent tool allowlist advertised by config and docs was not enforced at all.
• --dangerously-skip-permissions was hardcoded on every spawn, bypassing all runtime permission prompts.

Effective prior behavior: any user on allowedUsers had, through the agent, the ability to run any tool the model chose with no gating. This update restores the intended threat model: allowedUsers as authentication, allowedTools as authorization, dangerouslySkipPermissions as an explicit per-agent knob.

What changed

Spawner (src/spawner.ts)

• spawnText, spawnStreamJson, spawnStreaming, and spawnAsync now pass --allowedTools <tools...> to claude whenever the list is non-empty
• --dangerously-skip-permissions is gated on a new per-agent dangerouslySkipPermissions option for sync spawn paths. Default: true (back-compat)
• Async (tmux) spawns still unconditionally pass the flag — interactive mode has no TTY to answer a permission prompt — but correctly apply allowedTools

Config (src/config.ts)

• New optional field on AgentConfig: dangerouslySkipPermissions?: boolean

CLI (src/cli.ts)

• ccg agents add default allowedTools is now Read, Grep, Glob (was Edit, Read, Write, Bash, Grep, Glob). Operators opt into shell/write tools explicitly
• New --dangerously-skip-permissions flag on ccg agents add; defaults to false for new agents

Router (src/router.ts)

• Forwards agent.dangerouslySkipPermissions ?? true to spawn options (explicit back-compat default for existing configs)
• Passes agent.allowedTools through to async tmux spawns

Migration (src/migrate.ts)

• OpenClaw migrations explicitly set dangerouslySkipPermissions: true on migrated agents, preserving prior behavior with visibility

Docs

• New "Security model" section in docs/concepts/architecture.md: threat model, two-gate design, practical rules of thumb
• README now has a top-level Security model section linking into the docs

Upgrade

npm install -g ccgateway@0.3.1

Existing agents continue to work identically. dangerouslySkipPermissions defaults to true when the field is missing — no behavior change on upgrade.

Recommended actions after upgrading:

1. Review ccg agents list — for each agent, decide whether Bash, Write, and Edit belong in allowedTools given who is on allowedUsers
2. Consider setting dangerouslySkipPermissions: false in ~/.ccgateway/config.json once allowedTools is narrowed — this re-enables claude's permission gating
3. Read the new Security model docs

Credits

Reported by @consigcody94 in #1. Root cause (missing --allowedTools forwarding) uncovered during the fix.

Full changelog: v0.3.0...v0.3.1