Permissions

How it works

Before each action (reading a file, editing one, running a command, fetching a URL) LatentCode checks your permission rules. Each rule gives one of three answers:

Approving a request

When the agent needs approval, the prompt is replaced by a request like this:

Bash command
git push origin feature/orders

Do you want to proceed?
  1. Yes, allow once
  2. Yes, don't ask again this session for commands starting the same way
  3. No, tell latentcode what to do  (esc)

Press 1–3 to choose, or move with the arrow keys and press enter. esc rejects. ctrl+f shows the request full screen, which helps with long commands and diffs. What "matching" covers depends on the request: the same file, the same pattern, commands starting the same way (for example every git push …), or the same URL origin.

Defaults

Out of the box, the agent can read and change your project freely but asks about anything that reaches outside it, touches secrets or is hard to undo:

Configure permissions

Add a permission block to latentcode.json, globally or in a project:

{
  "permission": {
    "edit": "ask",
    "webfetch": "allow",
    "bash": {
      "*": "ask",
      "npm test*": "allow",
      "git push*": "ask",
      "rm *": "deny"
    },
    "read": {
      "*": "allow",
      "secrets/*": "deny"
    }
  }
}

• A permission takes one action ("edit": "ask") or an object of patterns.
• Patterns are matched against the command for bash, and against the path for read, edit and external_directory. * matches anything, ? one character. A pattern ending in " *" also matches the command with no arguments, so "git status *" matches git status.
• The last matching rule wins. Put "*" first and the exceptions after it. A request that matches nothing asks.
• ~ and $HOME at the start of a pattern expand to your home directory.
• "permission": "ask" as a single string applies to everything.

{
  "agent": {
    "build": {
      "permission": { "bash": { "*": "ask", "npm run *": "allow" } }
    }
  }
}

Command sandbox

On macOS and Linux, shell commands also run inside an operating-system sandbox. A command can read anywhere but can only write inside the project (plus any directories you approved for it), and can only use the network if it was recognized as a network command. This holds even for commands you allowed.

Linux needs bwrap (bubblewrap) installed. Set LATENTCODE_OS_SANDBOX=false to turn the sandbox off.

Without the TUI

latentcode run has nobody to ask, so it rejects every request that would ask, and denies questions and plan mode. Allow what an automated job needs in config, or pass --auto (same as --dangerously-skip-permissions) to approve every request that isn't denied. Only use it in an environment you'd be happy for the agent to change. --auto has no effect in the TUI.

You can also set rules for one process with the LATENTCODE_PERMISSION environment variable, as JSON:

LATENTCODE_PERMISSION='{"bash":{"*":"allow"},"webfetch":"deny"}' latentcode run "run the tests and fix failures"

FAQ