Fixes and tests

Backups and undo

Before a file is written, it is copied to ~/.flanner/curb/backups/, readable by you alone. The copy is kept for 7 days. A settings file can hold tokens, so every fix also denies the agents that folder: Claude Code always, and Codex where its config uses a permissions profile.

Each file is written in one step, read back and compared with what was meant. If anything differs, every file is put back as it was.

--undo restores the files of the last fix, while they still hold what Curb wrote. A file you have edited since is left alone, and named.

A fix is applied only if it leaves no channel broader than before. Adding a deny entry usually tightens, but “usually” is not good enough, so Curb checks three things.

• Every setting it touches is one Curb knows, and moves the tighter way. A deny list only grows. An allow list only shrinks. A sandbox only turns on. A setting Curb cannot judge, such as an environment variable, a helper command, a proxy or an endpoint, leaves the change unproven.
• Reach is no broader. Curb works out the settings as they are and as they would be, with the same rules flanner curb map uses. No channel may move toward open, and no file may become readable through a new channel.
• No new MCP server could load. For Claude Code, Curb tries every listed server name, command and URL against the allow and deny lists, before and after, along with some it made up.

Anything that fails is listed under “Not applied” with the reason, and left to you. So an approval given by mistake can only tighten your settings.

A yes is a grant. It is good for one use and for two minutes. It is bound to the exact change, and held only in the memory of the process that asked. Every write spends one, so a write without a grant fails.

The prompt shows who asked: the chain of programs, such as claude → bash → flanner. It is a hint, not proof. A program can be named anything.

Three refusals pause it. Three approvals refused or ignored within ten minutes pause every request for an hour, and a desktop notification says so. If you did not start them, something on the machine is asking.

No method, no changes. On a machine with no desktop session or no approval method, Curb stays read-only. It lists the changes for you to make by hand. Each outcome, granted or refused, goes into the action log.

What a pass proves. A target is proved only when every method the agent has comes out blocked. The proof covers that target, those methods and that launch, at that time. It says nothing about another file, another way of reading, or a session started with other flags.

A channel then shows as enforced in flanner curb map, for as long as the same settings hold. Change a setting, and it goes back to configured until you test again.

What it costs. Each target is one short agent session, on your own plan. Curb gives a rough token count before it starts. The test prompt and the decoy's fake contents go to your model provider, as any session does. The session's transcript is deleted afterwards.

A rule written relative to the project, such as one for ./.env, is tested in a scratch copy: a temporary folder holding only the project's agent settings, with their env values removed. Your real project files are never touched.

A decoy is a new file of fake credentials carrying a random marker. Its values work nowhere. Curb never plants one inside a git working tree, so a decoy cannot be committed. A folder inside one is reported as not tested.

Decoys expire after 30 days unless renewed. Expired ones are removed the next time you run test or decoys, and flanner curb forget removes them all.