✄𐘗
text code block:
✄𐘗process where event.type == "start" and event.action in ("exec", "start") and
(
  (
    process.args in (
      "--dangerously-skip-permissions",
      "--allow-dangerously-skip-permissions",
      "--permission-mode=bypassPermissions"
    ) or
    (process.args == "--permission-mode" and process.args == "bypassPermissions")
  ) and
  (
    process.name in ("claude", "claude.exe") or
    process.executable : (
      "*/.local/share/claude/versions/*",
      "*/.claude/downloads/*",
      "*Caskroom/claude-code/*",
      "*\\Claude\\versions\\*"
    ) or
    (process.name in ("node", "node.exe") and process.args : "*@anthropic-ai/claude-code*")
  )
) or
(
  (
    process.args in ("--dangerously-bypass-approvals-and-sandbox", "--full-auto", "--yolo") or
    process.command_line : (
      "* -s danger-full-access*",
      "*--sandbox danger-full-access*",
      "*--sandbox=danger-full-access*",
      "*--ask-for-approval never*",
      "*--ask-for-approval=never*"
    )
  ) and
  (
    process.name in (
      "codex", "codex.exe", "codex-exec",
      "codex-aarch64-apple-darwin", "codex-x86_64-apple-darwin",
      "codex-linux-arm64", "codex-linux-x64"
    ) or
    (process.name in ("node", "node.exe") and process.args : ("*@openai/codex*", "*/codex", "*\\codex*"))
  )
) or
(
  (
    process.args in ("--yolo", "-y") or
    (process.args == "--approval-mode" and process.args == "yolo") or
    process.args == "--approval-mode=yolo"
  ) and
  (
    process.name in ("gemini", "gemini-cli", "gemini.exe", "gemini-cli.exe") or
    (process.name in ("node", "node.exe") and process.args : ("*@google/gemini-cli*", "*/gemini", "*\\gemini*"))
  )
) or
(
  (
    process.args in (
      "--yolo",
      "--autopilot",
      "--allow-all",
      "--allow-all-tools",
      "--allow-all-paths",
      "--allow-all-urls"
    )
  ) and
  (
    process.name in ("copilot", "copilot.exe") or
    (process.name in ("node", "node.exe") and process.args : ("*@github/copilot*", "*/copilot", "*\\copilot*"))
  )
) or
(
  process.args == "--dangerously-skip-permissions" and
  (
    process.name in ("opencode", "opencode.exe", ".opencode") or
    process.executable : ("*opencode-ai*", "*\\.opencode*") or
    (process.name in ("node", "node.exe") and process.args : ("*opencode-ai*", "*/opencode", "*\\opencode*"))
  )
)