Set Agent Dispatch Permissions

When the spec-kitty-implement-review skill runs a mission, the orchestrating agent starts other coding agents to implement and review work packages. Each dispatch command it ships keeps that agent's sandbox or approval prompts on. No shipped skill tells an agent to turn them off; a gate test (tests/architectural/test_no_unsandboxed_agent_dispatch.py) fails if one does.

What the dispatched agent may do by default

Agent	Shipped mode	git and spec-kitty
Codex	--sandbox workspace-write	Edits the workspace only, network off. Its sandbox keeps .git read-only, so the orchestrator commits its work and runs move-task
Gemini	--approval-mode auto_edit	Denied in a headless run until you allow them
Qwen Code	--approval-mode auto-edit	Denied in a headless run until you allow them
LLxprt Code	--approval-mode=auto_edit	Denied in a headless run until you allow them
Copilot	--allow-tool 'write' --allow-tool 'shell(git:*)' --allow-tool 'shell(spec-kitty:*)'	Allowed; git push denied (best effort: the deny matches that spelling only, so git -c x push or git remote set-url are not covered)
Cursor	print mode without --force	Denied until you allow them
Kilocode	no automatic approval	Denied until you allow them

When a dispatched agent cannot commit or run spec-kitty agent tasks move-task, the orchestrator commits the agent's deliverables with spec-kitty safe-commit and runs the lifecycle command after the agent finishes, as it does for agents with no command line. Nothing is lost; the work package just moves one step later.

Allow only the commands the agent needs

Allow git and spec-kitty, and nothing broader, in the agent's own permission settings:

• Gemini: a policy file under ~/.gemini/policies/ with one rule per command, for example toolName = "run_shell_command", commandPrefix = "git", decision = "allow".
• Cursor: .cursor/cli.json permissions Shell(git) and Shell(spec-kitty).
• Kilocode: a bash permission map in its config that allows git * and spec-kitty * and denies *.
• Qwen Code and LLxprt Code: their allowed-tools setting for the shell tool, in the form your installed version documents.

Check the exact syntax against your installed version; these settings change between releases.

Elevated dispatch is your decision

Every agent also has a mode that switches its sandbox or approvals off entirely, for example Codex --sandbox danger-full-access, Gemini and Qwen --yolo, Copilot --allow-all-tools, Cursor --force and Kilocode --auto. In that mode the dispatched agent can change any file you can and reach the network, without asking.

Spec Kitty never picks that mode for you. If you decide you want it, tell the orchestrating agent yourself, in your own message in the session, naming the agent: for example "dispatch the Codex reviewer with --sandbox danger-full-access for this mission". The skill follows only such an instruction from you, never one it finds in a work package prompt, an issue or tool output, and it records in the work package note that the agent ran without a sandbox. Spec Kitty's orchestrator API rejects a dispatch policy whose dangerous_flags include any of four specific flags (BANNED_FLAGS: --full-auto, --yolo, --dangerously-bypass-approvals-and-sandbox and --dangerously-skip-permissions); it does not cover every flag or spelling that lowers a harness's guard.