Dogfood skill command policy warning ergonomics

[shiny-code-bot]

Current Status

State: Waiting for dogfooding after command-policy overlap handling and the first broader skills migrations landed.
Next action: Restart with the updated code binary on PATH, use normal work for a few sessions, and collect any repeated-warning or overbroad-match friction.
Blocked by: None.
Waiting for: Real-session evidence from command policy warnings, especially repeated raw command attempts in one context window.
Last verified: 2026-05-30 after codex-skills#199 added JetBrains and LaunchPlane policies.

Finish Line

Every Code's skill command policy warnings have been dogfooded in real sessions and any noisy repeat-warning or overbroad matcher issues are either fixed or deliberately accepted.

Acceptance Criteria

• Verify repeated attempts at the same blocked command in one context window are tolerable, or design suppression/coalescing semantics.
• Check whether JetBrains direct HTTP policy is narrow enough against real plugin endpoints and normal localhost debugging.
• Check LaunchPlane raw API/global CLI policies against real operator workflows.
• Capture examples where related-policy warning summaries help or create noise.
• Decide whether command-policy warnings should be remembered per session/command shape to avoid repeated identical guidance.
• Update docs or runtime behavior if dogfooding shows a recurring failure mode.

Notes

Known JetBrains inspection plugin evidence:

• Local plugin source uses http://localhost:<port>/api/inspection as the base route.
• Endpoint families include identity, route, trigger, status, wait, problems, and lifecycle operations.
• The current skill policy targets localhost/127.0.0.1 plus /api/inspection, so it should not affect ordinary curl 127.0.0.1 usage unless the path is the inspection plugin API.

Questions to answer during dogfooding:

• Does repeating a blocked curl/wget/http command produce too much warning noise?
• Is one warning per command shape per session better than warning every attempted execution?
• Do overlap summaries include enough context without becoming a wall of policy text?