{{ site.title }}

{{ currentLang.label }}

English

{{ currentLang.label }}

English

{{ theme.darkModeSwitchLabel || 'Appearance' }}

Permissions and Security ​

Status: published 0.3.0 stable release. Supported platforms: Windows and Linux. macOS is not yet officially supported.

Purpose ​

Enforce ask, assisted, and full approval modes while distinguishing path-aware file tools, the Linux bash OS sandbox, and Windows shell risk boundaries.

Public interfaces ​

  • ToolPolicy
  • ApprovalQueue
  • ToolApprovalRequest
  • ToolEffect
  • createLinuxSandboxedBashTool

Errors and boundaries ​

  • Missing approval handlers deny safely
  • A human denial blocks that call and later unapproved calls in the same batch, then pauses after batch reconciliation. It is not fed back as an ordinary recoverable tool error, so the model cannot request another approval in the same run. A sequential workflow saves no output for the denied step and starts no later step.
  • Explicit deny and escaped paths for path-aware file tools remain blocked in full mode
  • Nested path and URL arguments are inspected recursively; approval UI shows effects, complete targets, and reasons first
  • The Windows host shell opens only when mode: full, workspaceOnly: false, and network: allow are all selected; every other combination fails closed
  • Git Bash discovery provides command compatibility rather than operating-system isolation
  • Arbitrary shell side effects are never claimed as automatically reversible
  • Linux bash currently denies network access and fails closed when the sandbox is unavailable

CoreMind supplies mechanisms, quality guardrails, and development guidance. Users or business owners retain control of goals, rules, data fields, approval ownership, and final acceptance.

Source, tests, and examples ​

{{ theme.lastUpdated?.text || theme.lastUpdatedText || 'Last updated' }}:

Released under the MIT License.

Copyright © CoreMind Contributors