Safety & Control5 min read

Command Guardrails & Limits

Allowed/denied commands, timeouts, request and cost caps

Auto-approving terminal commands is where autonomy pays off most — and where a mistake costs most. Nexgile Code therefore never treats “Execute” as “run anything”: every command is checked against an allowlist and a denylist using longest-prefix matching, long-running commands can be bounded by a timeout, and every task can carry a hard request cap and cost cap. This page is the complete reference for those guardrails.

The allowlist: `allowedCommands`

nexgile-code.allowedCommands is a list of command prefixes that may run without a prompt when the Execute auto-approve toggle is on. The default is deliberately minimal and read-only:

["git log", "git diff", "git show"]

Matching rules:

Prefix match. git log allows git log --oneline -20 and git log -p src/, but not git push.
Case-insensitive. NPM TEST matches an npm test entry.
* is a wildcard that matches every command. Add it only if you fully accept the consequences.

Edit the list in Settings → Auto-Approve → Allowed Auto-Execute Commands (add a prefix, press Add; click an entry to remove it), or in your editor settings under the nexgile-code.allowedCommands key.

The denylist: `deniedCommands`

nexgile-code.deniedCommands (default: empty) is the never-list. A command matching a denied prefix is auto-denied without asking — you don’t get a prompt, the command does not run, and the agent is told the prefix is forbidden and instructed not to work around the restriction by running a different command.

* in the denylist denies every command.
Denied prefixes win over allowed prefixes unless the allowed match is longer (more specific) — see the matrix below.

Conflict resolution: longest prefix wins

When a command matches entries in both lists, the longer (more specific) prefix takes precedence. On an exact tie, denial wins.

Allowlist match	Denylist match	Result
Yes	No	Auto-approve
No	Yes	Auto-deny
Yes (longer)	Yes (shorter)	Auto-approve — allow rule is more specific
Yes (shorter)	Yes (longer or equal)	Auto-deny — deny rule is more specific
No	No	Ask you

Examples:

allowed: ["git"]           denied: ["git push"]
git status                 → auto-approve   ("git" matches, no deny match)
git push origin main       → auto-deny      ("git push" is longer than "git")

allowed: ["git push --dry-run"]   denied: ["git push"]
git push --dry-run         → auto-approve   (allow rule is the longer match)

Two more safeguards apply regardless of your lists:

Command chains are split on &&, ||, ;, |, and &, and every sub-command is checked. One denied sub-command denies the whole chain; every sub-command must be explicitly allowed for the chain to auto-run; anything else falls back to a prompt. git status && rm -rf build never rides in on the back of git status.
Dangerous shell substitutions (parameter expansions that could smuggle in a different command) are never auto-approved, even with * in the allowlist — they always prompt.

Worked example: a practical pair of lists

For a typical Node/TypeScript project:

{
  "nexgile-code.allowedCommands": [
    "git log", "git diff", "git show", "git status",
    "npm test", "npm run lint", "npm run build",
    "npx vitest", "node --version"
  ],
  "nexgile-code.deniedCommands": [
    "rm -rf", "git push --force", "git reset --hard",
    "npm publish", "kubectl delete", "dropdb", "curl"
  ]
}

Principles worth copying:

Allow verification commands (tests, linters, builds, read-only git) — these are what the agent runs most and benefits from most.
Deny irreversible operations (force-push, hard reset, recursive delete, database drops, publishing) even if you never allow them — the denylist also protects you when you later loosen the allowlist.
Keep prefixes tight: allow npm run lint, not npm, unless you are comfortable with every npm subcommand including npm install of arbitrary packages.

Execution timeout

Long or hung commands can stall a task. Two settings bound them:

Setting	Default	Range	Effect
`nexgile-code.commandExecutionTimeout`	0 (no timeout)	0–600 s	Maximum seconds a command may run before it is timed out
`nexgile-code.commandTimeoutAllowlist`	`[]`	—	Command prefixes exempt from the timeout

Set a timeout (for example 120 s) if the agent runs servers or watch-mode tools that never exit, and put legitimately slow commands — npm run build, integration test suites — on the timeout allowlist so they can finish.

Request cap and cost cap

The two hard limits live in Settings → Auto-Approve:

Max Count (allowedMaxRequests) — the maximum number of model requests a task may make before pausing.
Max Cost (allowedMaxCost) — the maximum spend in USD per task, measured against the live cost shown in the task header.

When a task reaches a cap it does not silently die and it does not silently continue: it pauses with an “Auto-Approved Request Limit Reached” or “Auto-Approved Cost Limit Reached” notice and a Reset and Continue button. Nothing further runs until you approve; clicking the button resets the meter and resumes the task.

Request pacing and API timeout

requestDelaySeconds — the base wait Nexgile Code uses before retrying a failed model request; retries back off exponentially from this base (about 5 seconds when unset) and respect any provider rate-limit window you have configured. Raise it if your provider rate-limits you often.
nexgile-code.apiRequestTimeout — how long to wait for a model response before treating the request as failed. Default 600 s, range 0–3600 s (0 = no timeout). Raise it for local providers such as Ollama or LM Studio, where large models can be slow to first token.