Shell commands: writes, deletes and pre-approved programs

A policy that only watches the edit tools has a hole the size of a shell: one > redirect or sed -i rewrites any file, with no diff to review and nothing captured for undo. These settings close it, and then take back the prompts that closing it would otherwise cost.

All of them are in Project settings → Safe edits.

Don't let the shell edit files

• Denied: commands that write files — output redirects (>, >>), sed -i, tee, PowerShell's Set-Content, and the like. The agent is told to use its edit tools instead, which the policy can review and undo can capture.
• Asked: commands that delete, move or copy files — rm, mv, cp — stop for your answer in the console rather than failing outright, because no edit tool can delete a file and a dead end only gets worked around.
• Let through: work inside build-output folders such as node_modules, and an arrow inside code: ->, => and >= in a PHP, JavaScript or Rust one-liner are not redirects.

Fewer prompts for commands

• Don't ask before running commands in this project pre-approves shell commands whose working folder is inside the project. …including commands run from outside the project widens that to anywhere.
• Commands that don't need asking is an allowlist of program names, picked from a catalogue with Choose commands… rather than typed — the hard part is remembering which programs your own work runs.

A command line is approved only when every program on it is ticked: git status goes through, and git log | curl … does not, because curl is not on the list. Lines are read the way a shell reads them — quotes, &&, pipes and redirects such as 2>&1 — and navigation words like cd and pwd never need ticking.

Only program names are listed, never arguments. The rules that read arguments — the shell-write block and the no-read folders — run first and still deny.

Order

Every "don't ask" switch runs after every rule that can deny. Pre-approving a program can remove a prompt; it can never let through a write the policy blocks.