Feedback for “Agentveil”: Nanocoder already ships a per-tool approval layer, and the CLI confirmations claim is not true of it

[will-lamerton]

The Problem section rules out the closest existing mitigation like this:

Agent-level Confirmations: Only work in hosted environments with custom UIs; CLI agents lack this surface.

Nanocoder is a CLI agent and it already has that surface. From the current Nano-Collective/nanocoder source:

• source/tools/approval-policy.ts is a single approval authority that every execution path routes through (interactive loop, subagents, plain shell). It fails safe: an unknown tool, or a policy function that throws, requires approval.
• Five development modes ship today: normal, auto-accept, yolo, plan, headless.
• execute_bash always requires approval unless explicitly always-allowed or running headless. Auto-accept still prompts for bash.
• File tools already validate paths, with tests covering directory traversal, absolute path escapes, null byte injection and paths escaping the project directory (source/tools/file-tools-path-validation.spec.ts).
• There is an MCP layer and a command injection test suite in source/security/.

So the sentence as written is not true of the collective's own agent, and a reviewer who knows Nanocoder will stop there. That is a shame, because the real case for Agentveil is strong and the document mostly does not make it:

1. Enforcement below the agent's own code. Nanocoder's policy is enforced by Nanocoder. A prompt injected agent still cannot bypass it, but a bug in the agent, a plugin, a custom tool, or anything spawned by an allowed shell command can. Enforcement outside the process is a genuinely different guarantee.
2. Portability across agents. approval-policy.ts protects Nanocoder users. A gateway protects whatever the user runs, including agents the collective did not write.
3. The audit trail. Nanocoder has no hash chained record of what was allowed and denied.
4. Declarative, diffable, shareable policy. Approval policy in Nanocoder is code plus a mode setting. policy.yaml is a version controlled artefact a team can review.

There is also a UX question that follows from this. If both layers prompt, the user answers twice. Does Agentveil replace approval-policy.ts for Nanocoder sessions, does Nanocoder delegate to it when a --gateway is present, or do both stay and one of them goes quiet?

What would help: rewrite the third mitigation bullet to describe what CLI agents including Nanocoder already do, then argue the four points above as the delta. And add a line to the Composition section on which layer owns the prompt when both are present.

Raised during the public review window (closes 2026-09-19).