Filesystem Operations gate
3 allow
13 ask
6 block
Everything that touches disk: rm, mv, cp, mkdir, chmod, chown, ln, sed -i, archives. This gate owns the destructive block floor. Patterns like rm -rf / are denied here so they can never reach the shell. Read-only archive listing is exempt.
Showing all 22 rules.
Blocked · destructive paths
rules/filesystem.toml#block 6 patternsrm / /* ~/ ~/*
Block
rm against / or ~/ blocked: would recursively delete the system or home tree. No legitimate use in an agent workflow.rm -rf /
Block
rm -rf / blocked: would recursively delete the entire root filesystem.rm -rf /*
Block
rm -rf /* blocked: would recursively delete every top-level directory under root.rm -rf ~
Block
rm -rf ~ blocked: would recursively delete the user's home directory.rm -fr /
Block
rm -fr / blocked: would recursively delete the entire root filesystem.rm -fr ~
Block
rm -fr ~ blocked: would recursively delete the user's home directory.Allowed · read-only
rules/filesystem.toml#allow 3 patternstar -t
Allow
Lists archive contents without extracting. Read-only.
tar --list
Allow
Lists archive contents without extracting. Read-only.
unzip -l
Allow
Lists zip archive contents. Read-only.
zip -l is not a listing flag (it converts line endings). Use zipinfo from the basics gate.Asks first · mutations
rules/filesystem.toml#ask 13 patternschgrp
Ask
Changes file group. Verify the target group exists before running.
chmod
Ask
Changes file/dir mode bits. Use the minimum needed: 755 for dirs, 644 for files. Avoid 777 unless you know why.
chown
Ask
Changes file ownership. Verify the target user/group exists before running.
cp
Ask
Copies files or directories. Overwrites destination by default;
-n to skip existing.ln
Ask
Creates a hard or symbolic link.
-s for symlink, -f to overwrite an existing link target.mkdir
Ask
Creates a directory.
-p also creates missing parent directories.mv
Ask
Moves or renames files. Overwrites destination if it exists unless
-n is set.perl
Ask
perl can execute arbitrary code via
-e, -E, system(), or backticks. Treat like running an inline script.rmdir
Ask
Removes empty directories. Fails if the directory contains files; use
rm -r for non-empty trees.touch
Ask
Creates an empty file or updates the mtime/atime of an existing one.
unzip
Ask
Extracts a zip archive. Verify trust; paths inside the archive can use
.. for directory traversal.zip
Ask
Creates or modifies a zip archive. Writes the destination path; existing archives are updated in place.
sed -i --in-place
Ask
sed is safe without -i flag (in-place edit)
The block floor is path-aware, not pattern-matched. The check_rm custom handler normalises paths (// → /, /. → /) before checking, and routes traversal patterns (.., ../, bare *) to ask-with-warn instead of denying. Authoring this declaratively in TOML alone would miss cases.