Allow-list template / 白名单模板

Split the helper by subcommand, never allow the bare helper: read and steer
verbs may run without a prompt; anything that starts, interrupts, ends,
adopts, attaches, connects or forgets stays on the permission prompt. The
guards are soft, so this split is the safety. Replace <fleet> with the
absolute path the skill read gave you.

按子命令拆分该辅助脚本的授权，绝不允许裸命令本身：读取（read）和引导（steer）类动词可以不经提示直接运行；任何会启动、中断、结束、收编、附加、连接或遗忘的操作都保留在权限提示环节。这些防护是软性的，因此这种拆分本身就是安全边界。把 <fleet> 替换为技能读取结果给出的绝对路径。

Allow without a prompt (read) / 免提示放行（读取）

python3 <fleet> doctor *
python3 <fleet> detect *
python3 <fleet> context *
python3 <fleet> list *
python3 <fleet> machines
python3 <fleet> status *
python3 <fleet> read *
python3 <fleet> dialog *
python3 <fleet> resources *
python3 <fleet> fetch *
python3 <fleet> wait *
python3 <fleet> events *

Allow without a prompt (steer) — optional, per taste / 免提示放行（引导）——可选，视个人偏好

python3 <fleet> approve *
python3 <fleet> deny *
python3 <fleet> send * --keys *

No text-send glob: send * … cannot tell the notification form from
--type (flags may follow the text) and an allow match wins, so every
send that carries text stays on the prompt. --automated labels what is
typed; it grants nothing.

不放行携带文本的 send 通配：send * … 无法区分通知形式与 --type（标志可能出现在文本之后），而 allow 匹配优先生效，因此每条携带文本的 send 都会留在权限提示环节。--automated 只是给所输入的内容打标签，不授予任何权限。

Always prompt (guarded) / 始终提示（受保护）

python3 <fleet> open *
python3 <fleet> stop *
python3 <fleet> close *
python3 <fleet> adopt *
python3 <fleet> attach *
python3 <fleet> connect *
python3 <fleet> forget *
python3 <fleet> send * --type

Claude Code settings template / Claude Code 设置模板

Claude Code matches Bash(...) rules by command prefix (:* means "and
anything after"), so each rule names the helper's path plus one verb.
Replace <fleet> with the absolute path and put the block in
.claude/settings.json (project) or ~/.claude/settings.json (user):

Claude Code 按命令前缀匹配 Bash(...) 规则（:* 表示"以及其后的任何内容"），因此每条规则都写明辅助脚本的路径加一个动词。把 <fleet> 替换为绝对路径，并将该配置块放入 .claude/settings.json（项目级）或 ~/.claude/settings.json（用户级）：

{
  "permissions": {
    "allow": [
      "Bash(python3 <fleet> doctor:*)",
      "Bash(python3 <fleet> detect:*)",
      "Bash(python3 <fleet> context:*)",
      "Bash(python3 <fleet> list:*)",
      "Bash(python3 <fleet> machines)",
      "Bash(python3 <fleet> status:*)",
      "Bash(python3 <fleet> read:*)",
      "Bash(python3 <fleet> dialog:*)",
      "Bash(python3 <fleet> resources:*)",
      "Bash(python3 <fleet> fetch:*)",
      "Bash(python3 <fleet> wait:*)",
      "Bash(python3 <fleet> events:*)"
    ],
    "ask": [
      "Bash(python3 <fleet> open:*)",
      "Bash(python3 <fleet> send:*)",
      "Bash(python3 <fleet> stop:*)",
      "Bash(python3 <fleet> close:*)",
      "Bash(python3 <fleet> adopt:*)",
      "Bash(python3 <fleet> attach:*)",
      "Bash(python3 <fleet> connect:*)",
      "Bash(python3 <fleet> forget:*)"
    ]
  }
}

Muse has no settings-level Bash(...) allow-list: its settings file's
permissions member is a permission profile, not a list of command rules,
and a settings file that holds only the block above does not load. In Muse
the split above is applied at the permission prompt.

Muse 没有设置文件层面的 Bash(...) 白名单：其设置文件中的 permissions 成员是权限配置档案，而不是命令规则列表，仅包含上述配置块的设置文件不会被加载。在 Muse 中，上述拆分是在权限提示环节执行的。

【评论】该模板体现了最小权限思路：只把无副作用的读取动词列入 allow，而把所有改变外部状态的动词（open/stop/adopt/forget 等）留在 ask 列表，并以"防护是软性的"自警，说明作者意识到白名单机制本身可被绕过。