Every day
Permissions
Lampson sorts every action into three kinds:
| kind | examples | ask (default) | yolo | strict |
|---|---|---|---|---|
| always refused | rm -rf /, formatting disks, fork bombs, force-pushing to main | blocked | blocked | blocked |
| risky | recursive deletes, git reset --hard, sudo, curl … | sh, DROP TABLE, writing .env, installing packages | asks you | allowed | blocked |
| everyday | reading, editing files in the project, running tests, git status | allowed | allowed | allowed |
Change the mode any time: /ask /yolo /strict in the terminal, the selector in the web header, or start with lampson --yolo / lampson --strict. .env only sets the default.
Some things always ask§
Regardless of mode, a few actions always wait for a human because they bring outside code or instructions onto your machine: installing a skill, turning a plugin on, adding an MCP server. yolo does not skip them; strict denies them.
Where it can reach§
File tools only work inside the project folder you opened. Absolute paths, .., and sibling folders are refused — not by a rule the agent could argue with, but by the language Lampson is written in: each tool declares the folder it may touch, and the runtime enforces it.
The bash tool runs real commands, and those are not confined by the language. That is why risky commands ask, and why for a public deployment you should run Lampson in a container.
Sub-agents never ask§
A sub-agent works in the background and cannot interrupt you. It runs strict (risky → denied, and it reports the limitation) unless you started Lampson with --yolo.
Unattended runs§
A scheduled task has its permission envelope fixed when you create it. In ask mode, a risky action waits for your approval — in the web UI, or through a link on your phone. No answer in time means denied. Nothing is ever auto-approved.