Command restrictions

Use [commands] denied to prevent an agent and the processes it launches from running selected executables:

[commands]
denied = ["ssh", "sudo", "docker"]

Restrictions cover normal PATH lookups and, where OS-level enforcement is available, absolute executable paths as well. Shell built-ins are outside the command policy because they are handled by the shell rather than launched as executables.

Denied commands exit with status 126 and return a structured command_denied policy error. On macOS, command restrictions use the OS process sandbox whenever command denials are configured. On Linux with a systemd user session, resolved executable paths are also enforced for descendants; otherwise the CLI uses PATH wrappers.

Inspect a command

Check a profile without starting an agent:

stashbase agent command --profile coding --command curl
stashbase agent command --profile coding --command curl --json

The report identifies whether the command is denied and whether enforcement is OS-level or uses the PATH-wrapper fallback.

Command denials observed directly by the proxy are recorded in the audit log as command_denied events. A nested tool may instead surface the native operating-system error it received.

Combine command restrictions with filesystem restrictions and profile validation.