Whitelisting terminal commands

[kevfuzz]

Would it be possible to make the terminal permissions more fine grained? I don't want to allow all commands as that would be a security risk but it's also frustrating to have to keep approving the command to compile an Angular application. Could some sort of whitelist be added to allow auto approving some commands?

[pandego]

If you're using the Continue CLI, there is already a command-level allowlist mechanism.

The permissions matcher supports Bash patterns like Bash(npm*), Bash(ng build*), etc., and the checker tests the actual command string against that pattern. The relevant bits are in:

• extensions/cli/spec/permissions.md
• extensions/cli/src/permissions/permissionChecker.ts

So for the CLI/TUI, the shape is basically:

allow:
  - Bash(ng build*)
  - Bash(npm run build*)
ask:
  - Bash(*)

One important nuance: shell mode (!cmd) explicitly bypasses permissions, so this only helps for normal model-invoked terminal tool calls, not shell-mode shortcuts.

If you're asking about the IDE terminal tool rather than the CLI, I don't see the same per-command allowlist exposed there yet - the terminal tool is still permission-gated, but the command-pattern matching I found is in the CLI permissions layer.