Permission Scoping

Configure via .codebuddy/permissions.json at the workspace root. Or set a default profile via editor settings.

Profiles

Profile	File access	Terminal	Dangerous cmds	Catastrophic cmds
`restricted`	Read-only	Blocked	Blocked	Blocked
`standard`	Read/write	Safe subset	Blocked	Blocked
`trusted`	Full	Full	Allowed	Blocked

Default: standard.

Catastrophic commands are blocked in ALL profiles including trusted. No override.

Config file

{
  "profile": "standard",
  "commandDenyPatterns": [
    "docker\\s+system\\s+prune",
    "kubectl\\s+delete\\s+namespace"
  ],
  "toolAllowlist": ["read_file", "search_files", "write_file"],
  "toolBlocklist": ["execute_command"]
}

Field	Type	Default	Purpose
`profile`	string	`"standard"`	`restricted` / `standard` / `trusted`
`commandDenyPatterns`	string[]	`[]`	Extra regex denies (max 200 chars each — ReDoS guard)
`toolAllowlist`	string[]	`[]`	Tools always allowed regardless of profile
`toolBlocklist`	string[]	`[]`	Tools always denied regardless of profile

Blocklist wins — a tool in both allow + block is blocked.

How checks flow

sequenceDiagram participant Agent participant PS as PermissionScopeService participant Cat as Catastrophic gate Agent->>PS: isToolAllowed("write_file") PS->>PS: toolBlocklist? alt Blocked PS-->>Agent: DENIED else Check allowlist PS->>PS: toolAllowlist? alt Allowed PS-->>Agent: ALLOWED else Profile check alt restricted PS->>PS: READ_ONLY_TOOLS set? PS-->>Agent: Allow iff read-only else standard / trusted PS-->>Agent: ALLOWED end end end Agent->>PS: isCommandAllowed("rm -rf /tmp") PS->>Cat: catastrophic match? alt Match Cat-->>Agent: DENIED (all profiles) else No match PS->>PS: built-in dangerous + custom patterns alt Match & profile ≠ trusted PS-->>Agent: DENIED else PS-->>Agent: ALLOWED end end

Dangerous vs. catastrophic commands

Two tiers of built-in command screening (in addition to any commandDenyPatterns you add):

Dangerous — recursive/destructive deletes, disk-format and raw-device writes, fork bombs, piped remote execution, and privilege-escalation patterns. Blocked in restricted and standard; allowed in trusted.
Catastrophic — a small set of unrecoverable operations (root-tree deletion, disk formatting, raw-device writes, fork bombs). Blocked in every profile including trusted, with no override.

The exact pattern set is intentionally not published.

Restricted-mode tool set

restricted exposes read and search tools only — no write, terminal, browser, or network-mutating tools.

Live reload

.codebuddy/permissions.json is watched — same debounce + serialization + onProfileChanged event as the access-control loader. Regex patterns pre-compiled at load; no per-call allocation.

Diagnostics (Doctor)

Code	Severity	Meaning
`no-config`	info	No `permissions.json` — default profile
`config-loaded`	info	Config loaded
`invalid-profile`	warn	Unknown profile value
`invalid-regex`	warn	A deny pattern failed to compile
`blocklist-overlap`	warn	A tool appears in both allowlist + blocklist

Editor default (no config file)

{ "codebuddy.permissionScope.defaultProfile": "standard" }

Workspace .codebuddy/permissions.json takes priority when present.

Security guarantees

ReDoS defense — regex patterns capped at 200 chars.
Size limit — config files > 64 KB rejected before parsing.
Path traversal — config path validated within workspace.
Pre-compiled — catastrophic patterns compiled at module load, not per check.
Fail-closed — a broken config falls back to standard with a warning.

Security — the broader layered security model
Tools — the tool list this filters