Permissions and Safety

Permission modes

TokenDanceCode gives you four permission modes, each tuned for a different operating context:

Mode	Approval prompt	Auto-reject high-risk	Auto-approve known-safe	Use case
default	Shown for requires_approval tools	No	No	Interactive local use
safe	Shown for requires_approval tools	Yes — rejects destructive operations	No	Shared or CI environments
auto	Hidden — auto-approves most tools	No	Yes — skips prompt for safe tools	Scripting / non-interactive
yolo	Hidden — approves everything	No	Yes (everything)	Fully autonomous runs

What each mode blocks or allows in practice:

• safe: Blocks rm -rf, git push --force, chmod 777, PowerShell Remove-Item -Recurse, and any tool with risk: "high". Edits to files outside the workspace root are denied.
• default: Prompts the user for tools classified as requires_approval. The user can approve or reject per invocation.
• auto: Skips prompts for tools with risk: "low" and risk: "medium" whose permission profiles match the current workspace. Still prompts for risk: "high".
• yolo: No prompts, no rejections. Every tool runs immediately.

Which one should you pick? default for daily development; safe for shared servers or CI pipelines; auto for automation scripts; yolo only for fully trusted batch jobs.

Approval bridge

When you use TokenDanceCode remotely through AgentHub, permission prompts that would appear locally are forwarded to the Hub Server via the SDK bridge. The Hub Server renders an approval panel in your browser — you click allow or deny, and the decision is sent back to your local runtime. The whole flow is transparent to the tool call itself: you see a consistent approval UI without worrying about network plumbing.

Safety defaults

Every tool carries metadata — risk, riskSummary, permissionProfiles, permissionReasons, and safetyNotes — for use by AgentHub diagnostic panels and permission explanations. The PowerShell tool layer includes built-in high-risk command blocking to protect your local workspace.

Secret boundaries:

• API keys and tokens are read from environment variables or config files inside ~/.config/tokendance/.
• The doctor command reports key presence/missing but never prints real key values.
• Transcripts (JSONL) redact secret-bearing fields before writing to disk.

Edit this page on GitHub