rclone/docs/PERMISSIONS.md

Agent permissions

Fork-only. Source of truth for what AI coding agents may run here. Tool files are renderings of this page: .claude/settings.json, .codex/config.toml, .codex/rules/project.rules, .gemini/settings.json. Change this page and every tool file in the same commit. Review changes to these files and to AGENTS.md like CI config: one line redirects agent behaviour repo-wide.

Verified commands

Run on 2026-11-11. The development host has no Go toolchain, so every go row was run inside the golang:1.26 container (go1.26.11) with the repository mounted, using this wrapper:

docker run --rm -u "$(id -u):$(id -g)" -e HOME=/cache -e GOCACHE=/cache/build \
  -e GOMODCACHE=/cache/mod -e GOFLAGS=-buildvcs=false -e RCLONE_CONFIG=/notfound \
  -v "$HOME/.cache/rclone-go:/cache" -v "$PWD:/src" -w /src golang:1.26 <command>

Only worked rows may appear in a tier, a tool file, or AGENTS.md.

Command	Result
go mod download	worked (container)
go build	worked (container) - binary reports rclone v1.77.0-DEV
go test ./backend/memory/	worked (container)
go test -run 'TestIntegration/FsMkdir/FsPutFiles/FsCopy' ./backend/memory/	worked (container)
go test ./backend/protondrive/	worked (container) - no TestProtonDrive: remote, so the integration test skips
go vet ./backend/protondrive/	worked (container)
gofmt -l backend/protondrive	worked (container) - no output
RCLONE_CONFIG=/notfound go test ./...	failed (container) - 178 packages ok, 7 fail: backend/smb, cmd/gitannex, cmd/mount, cmd/mount2, cmd/serve/docker, cmd/serve/nfs, fs/logger. fs/logger fails because the container has no rsync; the other six were not diagnosed
make, make quicktest, make racequicktest	not run - need Go on the host
golangci-lint run ./...	not run - not installed on the host or in the container
go run ./fstest/test_all -backends protondrive	not run - needs a configured TestProtonDrive: remote

TODO(maintainer): confirm every row above that is not worked.

Tiers

Tier	Commands	Why
Allow	git status, git diff, git log, git show, git branch --list, git rev-parse, git add, git commit, go mod download, go build, go test, go vet, gofmt -l	Inspection and the verified dev loop; no prompt needed.
Ask	git push, git merge, git rebase, git switch, git restore, git commit --amend, rm (any), go get, go mod tidy, go install, make (any target), docker (any)	Leaves the machine, rewrites work, changes dependencies, or is unverified.
Deny	git push --force / -f / --force-with-lease, git reset --hard, git clean (any), git add -f / --force, git commit --no-verify / -n, rm -r / -R / -rf / -fr / -Rf / -fR / --recursive, sudo; reading .env, .env.*, secrets/**	Destroys work, skips checks, or exposes secrets.

Known gaps

• Allowlists save prompts; they are not a security boundary. Use the tool's sandbox for isolation.
• While the host has no Go, the allowed go commands only work through the docker run wrapper above, and docker is in Ask - so each one prompts. Installing Go on the host removes this.
• Prefix rules are bypassable: git -C dir push, flags placed later (git push origin main --force), +refspec pushes. Claude Code's :* matches at a word boundary, so each flag cluster must be listed - which is why git clean is denied whole and rm always asks.
• Allowed test and build commands run code from the repo; an agent that can edit Go files or tests can run anything through go test.
• Denying reads of .env does not stop a program that opens it itself, and git can print staged or committed secrets. Rclone test credentials live in the user's rclone config, outside this repository - keep them there.
• Codex: loaded only once the project is trusted; approval_policy here can loosen a stricter user setting. No allow rules are written because in Codex allow means "run outside the sandbox". Codex cannot deny file reads. --force-with-lease=<ref>, +refspec and late flags only match Ask.
• Gemini CLI: ignored until the folder is trusted; no Ask tier (anything not allowed already asks); cannot deny file reads.
• Cursor and Copilot files are not written: nothing in the repository shows the fork uses them (.vscode is gitignored).