Desktop Code sessions and file permissions

After attaching a desktop conversation to a local project, the Code Agent can read and modify project files. The permission selector below the composer takes effect on the next turn and cannot be changed while a turn is running. It controls the Code session's file sandbox and exception approvals. It does not govern network access or replace enterprise Tool permissions.

Mode	File boundary and approval behavior
Ask for approval	Default. Work inside the project workspace is allowed; crossing the file sandbox asks you for approval.
Auto review	Keeps the project file sandbox. An independent reviewer evaluates each exception and denies it when uncertain.
Full access	No file sandbox or approval prompts for these actions. Use it only when you trust the current task and project.
Custom (config.toml)	Reads the file sandbox, approval policy and reviewer from a local configuration file.

Ask for approval does not prompt for every file write. Writing inside the permitted project workspace normally proceeds; an action outside the sandbox triggers approval. Business Tool authorization and approval follow their own configuration.

Custom configuration

Edit custom configuration opens config.toml in the desktop app's user-data directory. It is shared on that device, not created per project. A default template is created on first use. Save the file, select Custom again to validate it, and the settings apply from the next turn.

sandbox_mode = "workspace-write"
approval_policy = "ask"
approval_reviewer = "user"

• sandbox_mode: read-only, workspace-write, or danger-full-access.
• approval_policy: ask or never.
• approval_reviewer: user or auto_review. Auto review requires ask and a sandbox boundary; it cannot be combined with danger-full-access.

The current DSH runtime isolates file actions only. These modes do not restrict network access. To share desktop Code work with a colleague, create a read-only snapshot visible to signed-in members of the same organization.