Skip to content

docs: pin an absolute binary path under a permission cap #29916

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juliusmarminge merged 2 commits into from
Nov 3, 2026
Merged

docs: pin an absolute binary path under a permission cap #29916

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
05761c4
docs: pin an absolute binary path under a permission cap
juliusmarminge Nov 3, 2026
2ec4327
docs: the desktop environment comes from more than the login shell
juliusmarminge Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions docs/user/managed-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,8 +178,13 @@ config home, and the environment variables set on each provider. They come from
[`providers.instances`](#providers) or T3 Code's defaults, and users cannot change them, because a
wrapper script, a launch flag, or a variable such as `NODE_OPTIONS` could otherwise turn off the
provider's approvals. Pin the variables your users need, such as a gateway URL, in
`providers.instances`. Variables in the environment that starts T3 Code itself still reach
providers.
`providers.instances`.

Variables in the environment that starts T3 Code itself still reach providers, and a default
binary path such as `claude` is looked up on that environment's `PATH`. The desktop app builds that
environment from settings the user controls, such as their shell profile, so a user could put their
own `claude` earlier on their `PATH`. Pin an absolute `binaryPath` in `providers.instances` for each
provider you allow.

ACP agents' own mode menus have no effect under `maxRuntimeMode`, except Antigravity's, whose modes
T3 Code can place under the limit. Users still choose which ACP Registry agent runs; leave
Expand Down
Loading