Configure permissions changedpermissions
Nearest release: v2.1.267, published an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+6added
Lines−7removed
From line
200
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits72to this page, all time
The whole hunk
from line 200, old and new numbered
/
from line 200
200200
201201A deny or ask rule whose tool name matches no known tool produces a startup warning to catch typos. Tool names containing `_` or `*` are exempt from the check.
202202
203The label shown for a tool in the transcript and permission dialog can differ from its canonical name. For example, the tool labeled `Stop Task` in the transcript has the canonical name `TaskStop`. Permission rules and [hook matchers](/docs/en/hooks) match the canonical name only, so a rule written as `Stop Task` doesn't match. For deny and ask rules, the startup warning above catches the mismatch. Use the canonical names listed in the [tools reference](/docs/en/tools-reference).
203The label shown for a tool in the transcript and permission dialog can differ from its canonical name. For example, the tool labeled `Stop Task` in the transcript has the canonical name `TaskStop`. Permission rules and [hook matchers](/docs/en/hooks) don't match the label, so a rule written as `Stop Task` doesn't match. For deny and ask rules, the startup warning above catches the mismatch. Use the canonical names listed in the [tools reference](/docs/en/tools-reference).
204204
205205## Tool-specific permission rules
206206
from line 262
262262 * Different protocol: `curl https://github.com/...`
263263 * Redirects: `curl -L http://short.example.com/xyz`, which redirects to GitHub
264264 * Variables: `URL=http://github.com && curl $URL`
265 * Extra spaces: `curl http://github.com`
266265
267266 For more reliable URL filtering, consider:
268267
from line 484
485484
486485Path patterns share the `//`, `~/`, and `/` anchors from [Read and Edit rules](#read-and-edit), but matching is anchored to the whole directory path rather than gitignore-style. `*` matches exactly one path segment and `**` matches across segments. A trailing `/**` also matches its named root.
487486
488| Rule | Matches | Does not match |
489| --------------------- | ----------------------------------------- | ---------------------------- |
490| `Cd(~/code/*)` | `~/code/app` | `~/code/app/src`, `~/code` |
491| `Cd(~/code/**)` | `~/code` and any directory under it | directories outside `~/code` |
492| `Cd(**/node_modules)` | any `node_modules` directory at any depth | `node_modules/pkg` |
487| Rule | Matches | Does not match |
488| --------------------- | --------------------------------------------------------------------- | ---------------------------- |
489| `Cd(~/code/*)` | `~/code/app` | `~/code/app/src`, `~/code` |
490| `Cd(~/code/**)` | `~/code` and any directory under it | directories outside `~/code` |
491| `Cd(**/node_modules)` | any `node_modules` directory at any depth under the current directory | `node_modules/pkg` |
493492
494493## Extend permissions with hooks
495494
No line in this hunk matches that.