Approval gate
Every run_code call is scanned and scored FREE, LOW, MEDIUM or HIGH. MEDIUM and HIGH wait for a button press. See approval-gate.json for the decision table.
Levels
- HIGH: recursive delete, disk tools, curl piped to a shell, subprocess, eval, exec, sockets, edits to protected paths.
- MEDIUM: git push, git reset --hard, package installs, chmod, chown, writing files.
- LOW and FREE: everything else that is simple. LOW runs when AUTO_APPROVE_LOW is on.
Buttons
Allow Once, Allow Session, Always Allow (exact command), Deny.
Saved state
Pending requests are saved per session. Always Allow is saved in a shared file. Allow Session and the /allow window are memory only.
Limits
Scanning is by pattern. A command can be disguised.
Decision table
| Action | Example | Decision | Buttons | Remembered for | Survives restart | Notes |
|---|---|---|---|---|---|---|
| run_code, low risk | print(2+2) | allow | none | Yes | Runs at once when AUTO_APPROVE_LOW is on. Detail: - | |
| run_code, medium risk | pip install requests | ask | Allow Once, Allow Session, Always Allow, Deny | one press | No | MEDIUM needs a button. Detail: Allow Once: this call. Allow Session: until /reset or restart. |
| run_code, high risk | shutil.rmtree on a folder | ask | Allow Once, Allow Session, Always Allow, Deny | one press | No | HIGH needs a button every time unless an /allow window is open. Detail: Allow Once only is advised. Allow Session does not cover HIGH. |
| run_code, exact repeat | a command saved with Always Allow | allow | exact normalized text, all chats | Yes | Checked first. Only an identical command matches. Detail: data/always_allow.json | |
| shell command, hard block | reading the harness secret files | deny | never | Yes | Never runs, even with /allow. Detail: - | |
| shell command, high risk | recursive delete | ask | Allow Once, Allow Session, Always Allow, Deny | one press | Yes | Under SHELL_APPROVAL=risky. Detail: shell Always Allow uses the prefix '$ ' |
| shell command, medium risk | git push | ask | Allow Once, Allow Session, Always Allow, Deny | one press | Yes | Under SHELL_APPROVAL=risky. Detail: as above |
| file tool on core code | create_file in a protected folder | deny | never | Yes | File protection is separate from the approval gate. No button exists. Detail: - | |
| /allow window open | any code, including HIGH | allow | 5, 10 or 30 minutes | No | Window is lost on restart. Shell hard blocks still apply. Detail: in memory only | |
| pending approval after restart | a waiting request | ask | Allow Once, Allow Session, Always Allow, Deny | until answered or /reset | Yes | Requests are saved per session. Detail: data/pending_approvals |
See also:SandboxAllow-list
Checked against the source at commit f4fd89f on 29 Oct 2026. Everything here is merged on the main branch; no release has been tagged yet. The source is private, so these pages are the public description.