Permissions System

Cyberstrike uses a permission system to control which tools the AI agent can execute. This provides security boundaries while maintaining productivity.

Permission Model

flowchart TD
    ToolCall([Tool Called]) --> CheckConfig{Check\nConfig}
    CheckConfig -->|allow| Execute[Execute Tool]
    CheckConfig -->|deny| Block[Block Tool]
    CheckConfig -->|ask| CheckApproved{Previously\nApproved?}
    CheckApproved -->|Yes| Execute
    CheckApproved -->|No| AskUser[Prompt User]
    AskUser -->|Once| Execute
    AskUser -->|Always| Remember[Remember + Execute]
    AskUser -->|Reject| Block
    Remember --> Execute

Permission Modes

Configuring Permissions

Global Configuration

Set permissions in ~/.cyberstrike/config.json:

{
  "permission": {
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "edit": "ask",
    "bash": "ask",
    "websearch": "ask"
  }
}

Project Configuration

Override permissions per-project in cyberstrike.json:

{
  "permission": {
    "bash": "allow",
    "edit": "allow",
    "external_directory": "deny"
  }
}

Project settings override global settings.

Permission Types

File Operations

Command Execution

Web Operations

Special Permissions

Pattern-Based Permissions

Use patterns to grant granular permissions.

Directory Patterns

Allow specific directories:

{
  "permission": {
    "read": {
      "src/**": "allow",
      "test/**": "allow",
      "node_modules/**": "deny"
    },
    "edit": {
      "src/**": "allow",
      "*.config.js": "deny"
    }
  }
}

Command Patterns

Allow specific commands:

{
  "permission": {
    "bash": {
      "git *": "allow",
      "npm test": "allow",
      "npm run *": "allow",
      "rm *": "deny"
    }
  }
}

Wildcard Matching

Agent Permissions

Configure permissions per-agent:

{
  "agent": {
    "web-application": {
      "permission": {
        "bash": "allow",
        "browser": "allow",
        "edit": "ask"
      }
    },
    "code-review": {
      "permission": {
        "read": "allow",
        "glob": "allow",
        "grep": "allow",
        "edit": "deny",
        "bash": "deny"
      }
    }
  }
}

Interactive Approval

When a tool requires permission, Cyberstrike prompts for approval.

Response Options

Approval Dialog

┌─────────────────────────────────────────┐
│  Permission Required                     │
├─────────────────────────────────────────┤
│  Tool: Bash                              │
│  Command: git push origin main           │
│                                          │
│  [Once]  [Always]  [Reject]              │
└─────────────────────────────────────────┘

Keyboard Shortcuts

Session Approval Memory

When you select “Always”, Cyberstrike remembers the approval pattern for the session.

How Memory Works

1. User approves git push with “Always”
2. Pattern git * is stored for session
3. Future git pull, git commit, etc. auto-approve
4. Memory resets when session ends

Viewing Approved Patterns

Approved patterns persist until session restart.

Automation Mode

For CI/CD and automation, configure full trust:

{
  "permission": "allow"
}

This sets all permissions to allow without prompting.

Read-Only Mode

Restrict the agent to read-only operations:

{
  "permission": {
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "lsp": "allow",
    "edit": "deny",
    "bash": "deny",
    "websearch": "deny"
  }
}

Use this for code review or exploration tasks.

External Directory Access

By default, Cyberstrike restricts access to the project directory.

Allowing External Access

{
  "permission": {
    "external_directory": "ask"
  }
}

Specific External Paths

{
  "permission": {
    "external_directory": {
      "/home/user/shared/**": "allow",
      "/tmp/**": "allow",
      "/etc/**": "deny"
    }
  }
}

Permission Hooks

Use plugin hooks for programmatic permission control.

permission.ask Hook

const hooks: Hooks = {
  "permission.ask": async (input, output) => {
    // Auto-approve read operations in src
    if (input.type === "read" && input.path?.startsWith("src/")) {
      output.status = "allow"
      return
    }

    // Block access to secrets
    if (input.path?.includes("secret") || input.path?.includes(".env")) {
      output.status = "deny"
      return
    }

    // Default: prompt user
    output.status = "ask"
  },
}

Hook Input

Hook Output

Security Best Practices

Development Environment

{
  "permission": {
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "edit": "ask",
    "bash": "ask"
  }
}

Production/CI Environment

{
  "permission": {
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "edit": "allow",
    "bash": {
      "npm test": "allow",
      "npm run build": "allow",
      "*": "deny"
    }
  }
}

Security Audit Mode

{
  "permission": {
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "lsp": "allow",
    "websearch": "allow",
    "edit": "deny",
    "bash": "deny"
  }
}

Permission Priority

Permissions are evaluated in order:

1. Agent-specific permissions (highest priority)
2. Project cyberstrike.json
3. Global ~/.cyberstrike/config.json
4. Default built-in values (lowest priority)

More specific patterns take precedence:

{
  "permission": {
    "bash": "deny",
    "bash": {
      "git *": "allow"
    }
  }
}

In this case, git push is allowed but rm -rf is denied.

Troubleshooting

Permission Always Prompting

Check that your configuration is valid:

cyberstrike config validate

Verify the permission is set correctly:

cat ~/.cyberstrike/config.json | jq .permission

Permission Not Applied

1. Check project vs global config priority
2. Verify pattern syntax matches the path
3. Restart Cyberstrike to reload config

Blocked Operation

If a tool is unexpectedly blocked:

1. Check for deny rules in config
2. Check for pattern mismatches
3. Check plugin hooks that may block

Examples

Web Security Testing

{
  "permission": {
    "bash": {
      "nmap *": "allow",
      "nikto *": "allow",
      "sqlmap *": "allow",
      "nuclei *": "allow"
    },
    "browser": "allow",
    "websearch": "allow",
    "edit": "ask"
  }
}

Code Review Only

{
  "permission": {
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "lsp": "allow",
    "edit": "deny",
    "bash": "deny",
    "browser": "deny"
  }
}

Full Automation

{
  "permission": "allow"
}