feat: YOLO mode — 'action':'allow' one-liner overrides all risk classes

Code change: ActionFor now checks DefaultAction before built-in
defaults, so 'action':'allow' truly means everything is allowed.
Blocked class (fork bombs, dd to block device) always returns Deny
regardless of config. Per-class overrides in Classes map still win.

Tests: 6 E2E tests validating OneLiner (all classes→Allow),
BlockedStillDenied, PerClassOverride, Denied (lockdown),
ShellTool integration, and real command classification.

Docs: YOLO mode section in SECURITY.md with one-liner JSON,
exceptions (Blocked + per-class overrides), use cases (CI,
sandboxed sessions, power users), and lockdown mode ('deny').

Author: jkyberneees

cmd/odek/yolo_e2e_test.go

@@ -0,0 +1,114 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/BackendStack21/kode/internal/danger"
+)
+
+// ── Tests ─────────────────────────────────────────────────────────────
+
+func TestE2E_YOLO_OneLiner(t *testing.T) {
+	skipIfNoE2E(t)
+
+	allow := "allow"
+	dc := &danger.DangerousConfig{DefaultAction: &allow}
+
+	for _, cls := range []danger.RiskClass{
+		danger.Safe, danger.LocalWrite, danger.SystemWrite,
+		danger.Destructive, danger.NetworkEgress,
+		danger.CodeExecution, danger.Install,
+	} {
+		t.Run(string(cls), func(t *testing.T) {
+			if got := dc.ActionFor(cls); got != danger.Allow {
+				t.Errorf("ActionFor(%q) = %q, want %q", cls, got, danger.Allow)
+			}
+		})
+	}
+}
+
+func TestE2E_YOLO_BlockedStillDenied(t *testing.T) {
+	skipIfNoE2E(t)
+
+	allow := "allow"
+	dc := &danger.DangerousConfig{DefaultAction: &allow}
+
+	got := dc.ActionForCommand(":(){ :|:& };:")
+	if got != danger.Deny {
+		t.Errorf("fork bomb = %q, want %q (blocked even in YOLO)", got, danger.Deny)
+	}
+	if got := dc.ActionFor(danger.Blocked); got != danger.Deny {
+		t.Errorf("ActionFor(blocked) = %q, want %q", got, danger.Deny)
+	}
+}
+
+func TestE2E_YOLO_PerClassOverride(t *testing.T) {
+	skipIfNoE2E(t)
+
+	allow := "allow"
+	dc := &danger.DangerousConfig{
+		DefaultAction: &allow,
+		Classes:       map[danger.RiskClass]danger.Action{danger.Destructive: danger.Deny},
+	}
+
+	if got := dc.ActionFor(danger.Destructive); got != danger.Deny {
+		t.Errorf("ActionFor(destructive) = %q, want %q (per-class wins)", got, danger.Deny)
+	}
+	if got := dc.ActionFor(danger.SystemWrite); got != danger.Allow {
+		t.Errorf("ActionFor(system_write) = %q, want %q", got, danger.Allow)
+	}
+}
+
+func TestE2E_YOLO_Denied(t *testing.T) {
+	skipIfNoE2E(t)
+
+	deny := "deny"
+	dc := &danger.DangerousConfig{DefaultAction: &deny}
+
+	if got := dc.ActionFor(danger.Safe); got != danger.Deny {
+		t.Errorf("ActionFor(safe) with deny config = %q, want %q", got, danger.Deny)
+	}
+}
+
+func TestE2E_YOLO_ShellTool(t *testing.T) {
+	skipIfNoE2E(t)
+
+	allow := "allow"
+	st := &shellTool{
+		dangerousConfig: danger.DangerousConfig{DefaultAction: &allow},
+		ttyPath:         "/nonexistent/tty",
+	}
+
+	_, err := st.Call(`{"command": "whoami", "description": "yolo"}`)
+	if err != nil {
+		t.Errorf("YOLO shell tool should allow, got: %v", err)
+	}
+}
+
+func TestE2E_YOLO_Commands(t *testing.T) {
+	skipIfNoE2E(t)
+
+	allow := "allow"
+	dc := danger.DangerousConfig{DefaultAction: &allow}
+
+	cases := []struct {
+		name, cmd string
+	}{
+		{"system_write", "sudo systemctl restart nginx"},
+		{"network_egress", "wget http://example.com/file"},
+		{"code_execution", "node server.js"},
+		{"install", "pip install flask"},
+		{"destructive", "rm -rf /var/log/old"},
+		{"safe", "ls -la"},
+		{"local_write", "mkdir -p /tmp/x"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := dc.ActionForCommand(tc.cmd); got != danger.Allow {
+				cls := danger.Classify(tc.cmd)
+				t.Errorf("ActionForCommand(%q) = %q (class: %s), want %q",
+					tc.cmd, got, cls, danger.Allow)
+			}
+		})
+	}
+}

docs/SECURITY.md

@@ -117,6 +117,40 @@ See `dangerous` section in [CLI.md](CLI.md#dangerous-operations) for the full co
 }
 ```
 
+### YOLO mode (`"action": "allow"`)
+
+Set `"action": "allow"` to skip all prompts — everything runs without approval:
+
+```json
+{"dangerous": { "action": "allow" }}
+```
+
+This makes every risk class (`system_write`, `destructive`, `network_egress`, `code_execution`, `install`) return `allow`. The only exceptions are:
+
+- **Blocked class** — fork bombs, `dd` to block devices — always denied regardless of config
+- **Per-class overrides** — explicit `classes` entries still win over the global default
+
+```json
+{
+  "dangerous": {
+    "action": "allow",
+    "classes": {
+      "destructive": "deny"     // still deny destructive commands
+    }
+  }
+}
+```
+
+Use YOLO mode for:
+
+- **Automated scripts / CI pipelines** — no TTY, no prompts expected
+- **Trusted sandboxed sessions** — `odek run --sandbox --sandbox-network none` keeps risk contained
+- **Power users** who have reviewed the risk model and want full speed
+
+Set `"action": "deny"` for the opposite — lockdown mode — where every operation is denied unless explicitly allowed via `allowlist` or per-class override.
+
+> **Note:** These are the semantics of the `action` field (mapped to `DefaultAction` in code). It overrides all built-in defaults (system_write→prompt, destructive→deny, etc.) but not per-class entries in the `classes` map. Prior to v0.17 this field only applied to unknown risk classes — the v0.17 change makes `"action":"allow"` a true one-liner YOLO mode.
+
 ### Session trust
 
 When you press `T`, the risk class is cached in memory for the lifetime of the odek process. Subsequent commands of the same class skip approval. Trust is **not persisted to disk** — every new `odek run` or `odek continue` starts fresh.

internal/danger/classifier.go

@@ -122,9 +122,11 @@ type DangerousConfig struct {
 	// regardless of their risk classification. Exact match only.
 	Denylist []string `json:"denylist,omitempty"`
 
-	// DefaultAction is used when no /dev/tty is available (non-interactive mode).
-	// Values: "allow" (default), "deny", "prompt"
-	// "prompt" in non-interactive mode falls back to "allow".
+	// DefaultAction is the global default action applied to ALL risk classes
+	// when set. Per-class overrides in Classes still win.
+	// "allow" → YOLO mode (everything runs without prompt)
+	// "deny" → lockdown (everything denied unless explicitly allowed)
+	// Not set → uses built-in defaults per class
 	DefaultAction *string `json:"action,omitempty"`
 
 	// NonInteractive specifies what to do when running without a TTY.
@@ -151,23 +153,30 @@ var defaultActions = map[RiskClass]Action{
 }
 
 // ActionFor returns the configured action for the given risk class.
-// Falls back to defaults for unknown classes and unconfigured classes.
+// Per-class overrides in Classes win first, then the global default
+// action (the "action" field), then built-in defaults, then Prompt.
 func (c *DangerousConfig) ActionFor(cls RiskClass) Action {
 	// If the user explicitly configured an action for this class, use it.
-	// Falls back to built-in defaults for unconfigured classes.
 	if c.Classes != nil {
 		if a, ok := c.Classes[cls]; ok {
 			return a
 		}
 	}
-	// Fallback to built-in defaults
-	if a, ok := defaultActions[cls]; ok {
-		return a
+	// Blocked is always denied regardless of global default action.
+	// This covers commands like "rm -rf /" that are hardcoded as
+	// unrecoverable even in YOLO mode.
+	if cls == Blocked {
+		return Deny
 	}
-	// Unknown class: use default action from config, or prompt
+	// Global default action overrides all built-in defaults.
+	// Set "action": "allow" for YOLO mode, "action": "deny" for lockdown.
 	if c.DefaultAction != nil {
 		return parseAction(*c.DefaultAction)
 	}
+	// Fallback to built-in defaults
+	if a, ok := defaultActions[cls]; ok {
+		return a
+	}
 	return Prompt
 }
 

internal/danger/classifier_test.go

@@ -386,8 +386,8 @@ func TestClassify_Config_DefaultAction(t *testing.T) {
 	}
 
 	cfg2 := DangerousConfig{DefaultAction: strPtr("deny")}
-	if got := cfg2.ActionFor(Safe); got != Allow {
-		t.Errorf("ActionFor(safe) with default=deny should still be allow (safe defaults always allow)")
+	if got := cfg2.ActionFor(Safe); got != Deny {
+		t.Errorf("ActionFor(safe) with default=deny = %s, want deny (global default overrides)", got)
 	}
 }