Configuration
Approval settings
Configure tool auto-approval in Bob Shell by editing settings.json.
The approval key in ~/.bob/settings/settings.json controls which tool groups and individual tools are automatically approved. This file is shared with the IDE; changes made through the IDE settings UI are written to the same file.
Note:
Changes to this file take effect the next time you start a Bob Shell session.
Schema
"approval": {
"allowed_permissions": [
"mcp",
"mode",
"subtask",
"subagent",
"skill",
"todo",
"read",
"execute"
],
"permissionOptions": [
{
"groupId": "read",
"enableOutsideWorkspace": true
}
],
"allowedExecutors": [
{
"toolId": "execute_command",
"approvedCommands": [
"cat",
"git diff",
"git log",
"git rev-parse",
"git show",
"git status",
"grep",
"head",
"tail",
"ls",
"sort",
"wc",
"which",
"du",
"df"
],
"deniedCommands": [
"rm"
]
}
]
}Top-level keys
| Key | Type | Description |
|---|---|---|
allowed_permissions | array of strings | The tool permission groups that are automatically approved. See permission group IDs below. |
permissionOptions | array of objects | Per-group options. Currently supports enableOutsideWorkspace for the read group. |
allowedExecutors | array of objects | Per-tool command allowlists and denylists. Currently applies to execute_command. |
Permission group IDs
| Group ID | Tools covered |
|---|---|
read | File read, directory listing, search |
edit | File write, create, and delete |
execute | Terminal and shell command execution |
mcp | All MCP server tool calls |
skill | Skill activation |
todo | Todo list updates |
subtask | Subtask creation |
subagent | Subagent spawning |
mode | Mode switching |
allowedExecutors schema
| Field | Type | Description |
|---|---|---|
toolId | string | The tool to configure. Currently only execute_command is supported. |
approvedCommands | array of strings | Commands that are automatically approved when matched as a prefix of the full command string. |
deniedCommands | array of strings | Commands that are always denied, even if auto-approve is enabled. Takes precedence over approvedCommands. |
How is this topic?