Lint agent permissions with PermitLint

Use PermitLint's deterministic local CLI before making claims about a policy. The command below downloads the pinned, dependency-free CLI from the public Codeberg npm registry; the analyzer itself makes no network requests and never executes policy files, hooks, or commands.

Workflow

1. Identify the explicit settings file or repository directory in scope. Do not scan unrelated home-directory configuration unless the user includes it.

2. Require Node.js 18 or newer. Run:

   npx --yes --registry=https://codeberg.org/api/packages/automa-tan/npm/ permitlint@0.2.6  --json
   

3. Summarize critical and high findings first. Preserve the reported file and line.

4. Explain that findings are static heuristics, not proof that a runtime is exploitable or that a harness honored the file.

5. Offer minimal, concrete replacement rules. Do not edit policy unless the user asks.

6. For CI, add --check; exit 2 means at least one high or critical finding, while exit 1 means the scan failed or found no policy files.

PermitLint reads only paths the user placed in scope. Source and documentation: https://codeberg.org/automa-tan/permitlint