Permissions
localcode has three autonomy levels. Set one at startup or toggle approvals with /permissions:
- suggest - asks before every shell command and every file write.
- auto_edit (the interactive default) - edits files without asking, but confirms risky or destructive shell commands such as
rm -rf,git push,pip install,npm install, andcurl ... | sh. - full_auto - nothing prompts.
Two rules hold at every level:
- Network tools never prompt.
web_search,web_fetch, and MCP tools run without asking, even insuggest. See Network Boundary. - A hard safety block cannot be turned off. Catastrophic operations -
rm -rf /,mkfs,ddto a disk device, or writing credential files like~/.ssh/id_rsa- are refused in every mode, includingfull_auto. It is a guard against mistakes, not a security boundary.