Every tool sits behind a permission key. Three values:

Value	Badge	Meaning
allow	✅	runs immediately
ask	❓	popup appears — Deny · Always · Allow — and waits
deny	❌	blocked completely

Key	What it gates
read	reading files
edit	write, edit, apply_patch
bash	bash, shell
glob, grep, list	search tools
task	subagent delegation
webfetch, websearch	internet tools
skill, question, todowrite	their tools
sensor	device/sensor control
external_directory	anything outside the workspace
doom_loop	recovery when the agent is stuck

1. Session grant from a previous Always
2. Safe-command allow-list (read-only shell commands)
3. Glob rules from tui.json (app_settings.permissions.<tool>)
4. Agent default — build * → allow, plan → ask

The app asks for everything it needs once: storage, camera, battery exemption and all-files access — no hunting through settings later.

rm -rf /, sudo, su, mkfs, dd, world-writable chmods and secret files (.env, *.pem, *.key) are denied by default, and Always grants reset when you start a new session or restart the app.

---