Permission Scoping

Configure via .codebuddy/permissions.json at the workspace root. Or set a default profile via editor settings.

Profiles

Profile	File access	Terminal	Dangerous cmds	Catastrophic cmds
restricted	Read-only	Blocked	Blocked	Blocked
standard	Read/write	Safe subset	Blocked	Blocked
trusted	Full	Full	Allowed	Blocked

Default: standard.

Catastrophic commands are blocked in ALL profiles including trusted. No override.

Config file

{
  "profile": "standard",
  "commandDenyPatterns": [
    "docker\\s+system\\s+prune",
    "kubectl\\s+delete\\s+namespace"
  ],
  "toolAllowlist": ["read_file", "search_files", "write_file"],
  "toolBlocklist": ["execute_command"]
}

Field	Type	Default	Purpose
profile	string	"standard"	restricted / standard / trusted
commandDenyPatterns	string[]	[]	Extra regex denies (max 200 chars each — ReDoS guard)
toolAllowlist	string[]	[]	Tools always allowed regardless of profile
toolBlocklist	string[]	[]	Tools always denied regardless of profile

Blocklist wins — a tool in both allow + block is blocked.

How checks flow

sequenceDiagram participant Agent participant PS as PermissionScopeService participant Cat as Catastrophic gate Agent->>PS: isToolAllowed("write_file") PS->>PS: toolBlocklist? alt Blocked PS-->>Agent: DENIED else Check allowlist PS->>PS: toolAllowlist? alt Allowed PS-->>Agent: ALLOWED else Profile check alt restricted PS->>PS: READ_ONLY_TOOLS set? PS-->>Agent: Allow iff read-only else standard / trusted PS-->>Agent: ALLOWED end end end Agent->>PS: isCommandAllowed("rm -rf /tmp") PS->>Cat: catastrophic match? alt Match Cat-->>Agent: DENIED (all profiles) else No match PS->>PS: built-in dangerous + custom patterns alt Match & profile ≠ trusted PS-->>Agent: DENIED else PS-->>Agent: ALLOWED end end

Dangerous command patterns (blocked in restricted + standard)

Category	Pattern
Recursive delete	rm -rf
Destructive file ops	rm -f /, rmdir /
Disk / partition	mkfs*, dd of=/dev/*
Fork bomb	:(){ :|: & };:
Piped remote execution	curl … | bash, wget … | python
Privilege escalation	chmod 777, chown root
Data exfil	eval $…

Catastrophic commands (blocked always)

Pattern	Reason
rm -rf /	Recursive root deletion — unrecoverable
mkfs*	Formats partitions — unrecoverable
dd of=/dev/*	Raw disk writes — unrecoverable
:(){ :|: & };:	Fork bomb — crashes system

Restricted-mode tool set

Only these are available in restricted:

read_file, search_files, list_files, search_vector_db, ripgrep_search, search_symbols, get_diagnostics, get_architecture_knowledge, think, web_search, open_web_preview, standup_intelligence, team_graph.

Live reload

.codebuddy/permissions.json is watched — same debounce + serialization + onProfileChanged event as the access-control loader. Regex patterns pre-compiled at load; no per-call allocation.

Diagnostics (Doctor)

Code	Severity	Meaning
no-config	info	No permissions.json — default profile
config-loaded	info	Config loaded
invalid-profile	warn	Unknown profile value
invalid-regex	warn	A deny pattern failed to compile
blocklist-overlap	warn	A tool appears in both allowlist + blocklist

Editor default (no config file)

{ "codebuddy.permissionScope.defaultProfile": "standard" }

Workspace .codebuddy/permissions.json takes priority when present.

Security guarantees

• ReDoS defense — regex patterns capped at 200 chars.
• Size limit — config files > 64 KB rejected before parsing.
• Path traversal — config path validated within workspace.
• Pre-compiled — catastrophic patterns compiled at module load, not per check.
• Fail-closed — a broken config falls back to standard with a warning.

Related

• Security — the broader layered security model
• Tools — the tool list this filters