Struct PermissionRules 

pub struct PermissionRules {
    pub autonomous: bool,
    pub sandbox: SandboxLevel,
    pub disallowed_tools: Vec<String>,
    pub allowed_tools: Vec<String>,
    pub allowed_edit_paths: Vec<PathBuf>,
    pub deny_read_only: bool,
    pub extra_writable_dirs: Vec<PathBuf>,
}

Unified permission rules that each agent translates into its native flags.

Instead of hardcoding --permission-mode bypassPermissions for Claude and --sandbox workspace-write for Codex, we define a single set of rules and let each AgentRunner format them for its CLI.

Fields

autonomous: bool

Whether the agent runs fully autonomous (no user prompts).

sandbox: SandboxLevel

Sandbox level for filesystem access.

disallowed_tools: Vec<String>

Tool patterns to disallow (e.g., ["Bash(rm *)", "Bash(rm -*)"]).

allowed_tools: Vec<String>

Tools to allow (whitelist). Overrides disallowed_tools when non-empty.

Items are either agent-native tool names (e.g., “Edit”, “Write”, “Bash”) or CLI command names (e.g., “git”, “npm”) which get translated to agent-specific patterns (e.g., Bash(git*) for Claude).

allowed_edit_paths: Vec<PathBuf>

Paths where the agent is allowed to edit files (worktree path). When set, Edit/Write tools are scoped to these paths only. Set dynamically per invocation (not from config).

deny_read_only: bool

Restrict to orchestration-only operations — denies Read, Glob, Grep, and Bash commands for browsing/reading files (ls, cat, find, etc.). Agents translate this into their native permission model.

extra_writable_dirs: Vec<PathBuf>

Additional directories that must be writable (e.g. the git common dir when running inside a worktree whose .git metadata lives outside the sandbox root). Codex translates these into --add-dir flags; other agents ignore the field.

Implementations

impl PermissionRules

pub fn from_config() -> Self

Load permission rules from config, falling back to defaults.

pub fn deny_read_only() -> Self

Restriction preset for control sessions: denies Read, Glob, Grep, and Bash commands that read files or list directories (ls, cat, find, etc.).

The agent remains autonomous but is prevented from browsing or reading arbitrary files on the host machine. Translation into agent-native flags is handled by each AgentRunner::build_command() implementation.

Trait Implementations

impl Clone for PermissionRules

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionRules

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionRules

fn default() -> Self

Returns the “default value” for a type.