Safety: sandbox & approvals

Command sandbox

By default, commands run in a copy of the workspace folder: the agent experiments freely, and changes are transferred to the main folder after successful completion. This protects your files from unexpected side effects.

File operations (read/write) are always confined to the workspace folder — the agent cannot escape it.

Approvals

  • Normal mode — every potentially risky action (command, write, delete) shows an approval card: the tool name, a summary, and «Allow» / «Reject» buttons.
  • Full access — a toggle in the chat header that lets the agent act without per-step approvals. Enable it consciously, when you trust the task.
  • One-time approval tokens with a 30-second TTL prevent replaying decisions.

SSH host keys

On first connection to a server, its host key fingerprint is stored. Later connections verify the fingerprint — protection against server impersonation (MITM).

← Docs