Auto-Approve
The Auto-Approve menu lets you set granular permissions for what Kodik does automatically, without interrupting you with confirmation prompts.
Auto Approve controls when Kodik asks for permission. To remove a capability from the agent entirely, use the separate Harness section; disabling a tool there removes it from the agent and makes its Auto Approve controls inactive. See Tools.
How It Works
Section titled “How It Works”Auto-approve is off by default: Kodik asks for your confirmation before every tool call, including reading or editing files. Once enabled, you configure fine-grained permissions separately for files inside the workspace and outside it.
Approval Modes
Section titled “Approval Modes”The Approval Mode picker (mode) selects one of three levels:
- Default Approvals (
default) — only the granular permissions and command patterns you enable below run without asking; the blocked list (see below) always wins. Everything else prompts. - Autopilot (
autopilot) — all actions and terminal commands run automatically. The model’s own judgment is the main gate: a command it flags as risky still asks for confirmation, and the approval card shows the model’s reason (e.g. “Rewrites remote history” for a force-push). A command on your blocked list still asks, even here. - Full Access (
fullAccess) — everything runs without ever asking, except commands on your blocked list, which still ask. Use it only in isolated, disposable environments.
In Autopilot and Full Access, sensitive-file protection is also bypassed — Kodik can edit sensitive files without additional confirmation.
Earlier versions had an Autopilot toggle (
autopilotMode). An enabled toggle migrates automatically tomode: "autopilot"; the old Autopilot behavior of refusing commands with$(...)substitutions is gone — the model’s own risk judgment covers those now.
Granular Permissions
Section titled “Granular Permissions”Each permission applies separately for files inside the workspace and outside it (...Externally).
| Permission | Tool | Default |
|---|---|---|
Read project files (readFiles) | read_file | on |
Read all files (readFilesExternally) | read_file outside workspace | off |
List files and directories (listFiles) | glob | on |
List all files (listFilesExternally) | glob outside workspace | off |
Search in files (rg) | rg (ripgrep) | on |
Search in all files (rgExternally) | rg outside workspace | off |
Fetch web content (webFetch) | web_fetch | off |
Search the web (webSearch) | web_search | off |
Edit existing project files (editFiles) | edit_file | off |
Edit existing files anywhere (editFilesExternally) | edit_file outside workspace | off |
Create project files (createFiles) | create_file | off |
Create files anywhere (createFilesExternally) | create_file outside workspace | off |
Delete project files (deleteFiles) | delete_file | off |
Delete files anywhere (deleteFilesExternally) | delete_file outside workspace | off |
Edit notebooks (editNotebooks) | edit_notebook | off |
Edit notebooks everywhere (editNotebooksExternally) | edit_notebook outside workspace | off |
Edit sensitive files (editSensitiveFiles) | overrides pattern protection | off |
Create sensitive files (createSensitiveFiles) | overrides pattern protection | off |
Delete sensitive files (deleteSensitiveFiles) | overrides pattern protection | off |
An
...Externallyor sensitive-file permission is automatically disabled if its corresponding base permission is off. Existing installations copy their previous edit-file permissions to the new create- and delete-file permissions once during migration; the three sets can then be changed independently.
Command Patterns
Section titled “Command Patterns”Command patterns (commandPatterns) let you approve specific terminal commands without enabling Autopilot. Each pattern supports the * wildcard (e.g. npm run *, git *). Individual patterns can be temporarily disabled without being deleted.
Commands are matched case-insensitively from the start of the string. If a command is chained with &&, ||, ;, or |, every segment must match an enabled pattern before Kodik runs it without asking. Commands that use command substitution such as `...` or $(...) always pause for approval.
Blocked Commands
Section titled “Blocked Commands”The blocked list (blockedCommands) is a deny-first backstop: any command matching a pattern on it always requires your confirmation, in every mode — Default, Autopilot, and Full Access alike. It takes precedence over your command patterns, so a broad allow rule (for example git *) can’t auto-run something you’ve blocked (for example git push *). Each pattern supports the * wildcard and is checked against every segment of a chained command.
The list is empty by default — nothing is blocked out of the box. Add the commands you never want auto-run in Settings → Auto Approve → Blocked Commands. Common choices:
- File deletion:
rm *,sudo rm *,del *,Remove-Item * - Git clean:
git clean* - Disk destruction:
mkfs*,dd if=*,format * - System power:
shutdown*,reboot* - Other dangerous:
chmod -R 777 /,chown -R *:* /,:(){:|:&};:
Sensitive Files
Section titled “Sensitive Files”Kodik additionally protects files that match sensitive file patterns, even when a file mutation is enabled (unless that operation’s editSensitiveFiles, createSensitiveFiles, or deleteSensitiveFiles permission is explicitly turned on). The default protected patterns include:
- Secrets and environment variables:
**/.env,**/.env.*,**/secrets.*,**/secret.*,**/*secret*,**/*password*,**/*credentials* - Package lock files:
**/package.json,**/package-lock.json,**/yarn.lock,**/pnpm-lock.yaml,**/composer.lock,**/Gemfile.lock,**/Pipfile.lock,**/poetry.lock,**/cargo.lock - Configuration files:
**/*.config.js/ts/mjs/cjs/json,**/tsconfig.json,**/jsconfig.json,**/babel.config.*,**/webpack.config.*,**/vite.config.*,**/rollup.config.*,**/.eslintrc.*,**/.prettierrc.* - Git files:
**/.gitignore,**/.gitattributes,**/.gitmodules,**/.git/** - Docker and deployment:
**/Dockerfile,**/docker-compose.yml/yaml,**/.dockerignore,**/kubernetes/**/*.yaml - CI/CD:
**/.github/workflows/**,**/.gitlab-ci.yml,**/.circleci/**,**/.travis.yml,**/azure-pipelines.yml,**/Jenkinsfile - IDE files:
**/.vscode/**,**/.idea/**,**/.vs/** - Database migrations:
**/migrations/**,**/migrate/** - All dotfiles:
**/.*
You can extend or narrow this list in settings.
Kodik Configuration Files
Section titled “Kodik Configuration Files”Kodik can always read its own configuration assets (skills, commands, rules, hooks, sub-agents) without any auto-approve permissions — this is independent of your settings.
Best Practices
Section titled “Best Practices”For most workflows, start conservatively:
- Auto-approve reading project files (
readFiles,listFiles,rg) - Set the request limit to 10–20
- Leave editing and Autopilot off
As trust in the agent grows, gradually add permissions. Tighten settings for critical production work; Autopilot is acceptable in isolated throwaway environments.