Permissions an agent can work with: rules in code, a sandbox underneath
MendCode’s daemon decides every tool call by its permission and the session’s mode. Smart mode settles low-risk calls with plain code and asks about the rest; pasted secrets become markers; an OS sandbox is an opt-in layer below.
Five modes
Every tool call has a permission: read, write (edits files) or execute (runs things). Reads inside the project run; reads of .env files ask. The rest depends on the session’s mode, and the daemon enforces it, not the screen.
Modes
| Mode | Write | Execute |
|---|---|---|
| ask | asks | asks |
| edits | runs | asks |
| full | runs unless a rule denies | runs unless a rule denies |
| plan | refused until a plan is approved | refused |
| smart | runs when low risk | runs when low risk |
Approving “for this session” records a grant, so later calls of that tool do not ask again.
Smart mode is code, not a model
Smart mode settles low-risk calls by rule and asks about the rest. The rules are plain code, so one call always gets the same answer, and every prompt ends with why it asks and which rule fired.
Some of the rules
- read: any read tool runs.
- edit-in-project: edits run when every path is inside the project and is not a secret or inside .git.
- allow-listed-command: a shell line runs when every command in it is allow-listed and nothing below fires.
- destructive, secrets-file, git-internals, agent-config, outside-project and network: ask.
- forbidden: catastrophic commands are refused without a prompt, and no grant or allow rule lifts it.
In smart mode a session grant covers only the exact same action and never a high-risk call. Claude Code and Codex sessions treat smart as ask.
Pasted secrets
Paste an API key into the chat and MendCode keeps working with it, but the model and every stored transcript only see a marker, ‹secret:1›. The value lives in one encrypted table and is put back only inside a tool run you approved.
The sandbox
Rules decide whether a command may run; the OS sandbox decides what a running command can touch. It is off by default. /sandbox read-only or /sandbox workspace-write turns it on, and /sandbox network off cuts the network, loopback included. Inside a writable root, .git/hooks, .git/config and .mendcode stay read-only.