# config.json Policies

The policy keys in `config.json` that widen or narrow what tools may touch, and the keys that are no longer read.

Policy keys in `config.json`. `sensitive_path`, `read_only_command` and (since v1.3.10) `readable_path` merge with values embedded in the binary (user entries add to, never replace, the defaults); the rest exist only as user config:

| Key | Embedded source | Purpose |
|---|---|---|
| `sensitive_path` | go-pkg `filesystem/jsons/sensitive_path.json` (`configs/jsons/sensitive_path.json` before v1.3.10) | Credential, key-material, shell startup and tool-setting paths (since v1.3.7 also `.git`, `.claude`, the shell rc files such as `.zshrc` / `.bashrc`, and `.mcp.json`), for reads and writes alike — reachable only after a per-session grant: a plain confirmation inside `$HOME`, the system password outside it. Buckets: `dirs`, `files`, `prefixes`, `extensions` |
| `read_only_command` | `configs/jsons/read_only_command.json` (532 entries since v1.3.3, 409 after `cd` was dropped in v1.3.0) | `run_command` and `background_command` calls (`run_command_background`, covered since v1.3.1, was Removed in v1.3.2) that skip the confirm gate (`git status`, `ls`, `cat`, ...). Since v1.0.25 an entry is matched against the binary plus at most its first two arguments (`git config --get`, `docker compose ps`), a call with `network: true` or a sensitive-path argument never matches, and the dedicated read-only command tool is gone |
| `denied_command` | — | Binaries `run_command` refuses outright, inside `sh -c` too |
| `denied_path` | — | Paths permanently off limits for reads and writes; no prompt can approve them. Entries must be absolute or start with `~/`; the filesystem root is refused |
| `readable_path` | go-pkg `filesystem/jsons/readable_path.json` | Since v1.3.10. Absolute paths outside `$HOME` that `read_files` and `find_files` read without a prompt; user entries add to the built-in system and package locations (`/usr`, `/bin`, `/sbin`, `/lib`, `/lib32`, `/lib64`, `/libx32`, `/opt`, `/snap`, `/etc`, `/srv`, the package databases `/var/lib/dpkg`, `/var/lib/rpm` and `/var/lib/pacman`, `/Applications`, `/System/Library`, `/System/Applications`, `/Library`, `/Users/Shared` and `/dev/null`). Entries must be absolute or start with `~/`, and the filesystem root is dropped. A denied or sensitive path stays blocked even when listed; writes, `open_file`, `file_history` and `rm` still need the password |
| `net_white_list` | — | Hosts exempt from the `http_request` SSRF guard |

Three keys are no longer read: `sensitive_map` (renamed `sensitive_path`), `white_list` (removed — commands run unless listed in `denied_command`), and `path_white_list` (removed — paths outside `$HOME` are approved per session). Up to v1.1.1 their presence logged a startup warning; v1.1.2 dropped the warning, so they are now ignored silently.

v0.35.0 dropped the last pre-v0.28.9 compatibility paths: `limits.max_skill_iterations` (superseded by `limits.max_tool_iterations`) and `planner_model` (superseded by `dispatcher_model`; up to v1.1.1 it was deleted from `config.json` on the next save, since v1.1.2 it is simply left in place) are no longer honoured, and the legacy `api_tools/` / `script_tools/` directories are no longer read — tools live under `tools/script/` (`tools/api/` itself was Removed in v1.3.2; see [Configuration](/config-files)).