Keychain prompts: block-keychain-prompt-commands

A gate on shell calls (tama hook block-keychain-prompt-commands) that refuses a command which can raise a macOS Keychain or interactive sign-in prompt. The prompt is native UI the agent cannot answer, so the session stands still until a person clicks it. The refusal names the non-interactive route: already-approved environment variables, an explicit connection string, service-role API calls, or a checked-in migration that invokes no keychain-backed CLI.

#How it decides

Whether a command can raise such a prompt is what it does, so a model reads it through Oko's model call (block_keychain_prompt_commands/judge-prompt.md): macOS's own keychain tool, a keychain-backed git credential helper, adding SSH keys with the keychain option, a CLI that keeps its sign-in in the keychain, or an interactive sign-in, single sign-on or access-token subcommand of one. A tool named only in data (a commit message, a search pattern), a tool's help or version, and explicit non-interactive credentials pass. No list of CLI names decides it: every CLI such a list left out prompted unseen. The refusal's reason: line is the model's sentence naming what touches the keychain.

The gate reads the shell tool in every harness spelling (Claude's Bash, OMP's bash, Codex's exec_command). A question the judge leaves unanswered refuses the command with TAMA_HOOK_INFRASTRUCTURE: block-keychain-prompt-commands: review unavailable: … and the judge's recorded state, as asking a model describes.

#Where it comes from

Source: rust/crates/tama-hook-tools/src/ports/block_keychain_prompt_commands/. The journey cargo test --manifest-path rust/Cargo.toml -p tama-cli --test keychain_prompt_commands runs the built hook with the judge recorded as not answering and requires that refusal; with TAMA_TEST_KEYCHAIN_JUDGE=1 and -- --ignored it asks the real judge and requires git credential fill, aws sso login and ssh-add --apple-use-keychain refused, and vercel deploy --token …, aws s3 ls and a commit message naming the keychain passed.