Permissions

Ordinary work in the project runs without a prompt. A command that needs more than the built-in rules stops and asks, unless you have already written a rule for it.

Built in

These rules ship with PARI. A line in a permission file overrides the matching row. A deny wins over an allow.

Rule	Default	How you override it
Read, search, and edit files inside the project	Allow	Add `read-only` to a permission file.
Run a command inside the project, with no network	Allow	A deny rule for that command.
Network for one package install	Allow	Add `deny package-network`.
Network for any other command	Ask	An allow rule or a deny rule for that command.
Writing `.git`, including commit, push, and reset	Ask	An allow rule or a deny rule for that command.
`~/.ssh`, `~/.aws`, `~/.gnupg`, and credential files	Deny	An allow rule for that command.

A package install is one of pip, pip3, npm, pnpm, yarn, cargo, poetry, or uv, with install, add, update, fetch, or sync. pip install requests; curl https://example.com is not a package install.

An allow rule starts that command and widens only the grant it needs, such as the network or a writable .git. The command still runs inside Bubblewrap. Allowing git push does not allow curl.

Rules you write

Put one rule per line in the project file, the home file, or both.

File	Applies to
`.pari/permissions`	This project only.
`~/.pari/permissions`	Every project.

allow bash git push
allow bash git commit
allow bash curl *
deny bash rm *
deny package-network
read-only

allow and deny name the tool, then the command. A trailing * matches the rest of the line. deny package-network turns off network for package installs. read-only refuses writes for the session. Blank lines and lines that start with # are ignored.

If either file denies a command, PARI does not run it and does not ask. An allow in either file runs it. Otherwise the built-in default applies.

The prompt

When a tool needs access that no rule covers, PARI stops before the command runs:

git push needs network and a git write

  once
  this repo
  no

Choice	What happens
once	Run this command only. The next matching command asks again.
this repo	Append the allow line to `.pari/permissions` and run the command.
no	Skip the command. The same command asks again next time.

How PARI decides

A deny rule in either permission file refuses the command. There is no prompt.
An allow rule that matches the command runs it, with the sandbox grant that command needs.
A built-in allow runs it with no prompt.
Anything else opens the prompt. The choices are once, this repo, and no.

git push

git push is a command that needs the network and a writable .git. Both default to ask, so the first push opens the prompt. Choosing this repo saves:

allow bash git push

The next git push in that project uses the saved rule. git commit is a separate command and asks on its own until you allow it too.

An approved git write gets your user.name and user.email from the host, so the commit has an author. An approved push, fetch, pull, or gh command also gets a GitHub token from GH_TOKEN, GITHUB_TOKEN, or gh auth token. The token is offered to https://github.com only, and only for that command. The prompt shows uses GitHub token when it applies. If no token is available, the command does not start.

Sandbox →
The kernel boundary a command stays inside after you allow it.
Troubleshooting →
Fix a refused command or a missing Bubblewrap.