You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Description:** "When enabled, Roo will automatically view directory contents and read files without requiring you to click the Approve button."
102
128
129
+
**Additional option:**
130
+
-**Include files outside workspace:** Allow Roo to read files outside the current workspace directory
131
+
103
132
**Risk level:** Medium
104
133
105
134
While this setting only allows reading files (not modifying them), it could potentially expose sensitive data. Still recommended as a starting point for most users, but be mindful of what files Roo can access.
135
+
136
+
#### Workspace Boundary Protection
137
+
138
+
By default, Roo can only read files within your current workspace directory. The "Include files outside workspace" option extends read access beyond the workspace boundary. Consider the security implications:
139
+
140
+
-**Default (unchecked)**: Roo can only read files in your project directory
141
+
-**Enabled**: Roo can read any file on your system that you have access to
142
+
-**Recommendation**: Keep disabled unless you specifically need Roo to access external files
106
143
:::
107
144
108
145
### Write Operations
109
146
110
-
:::caution Write Operations
111
-
<imgsrc="/img/auto-approving-actions/auto-approving-actions-7.png"alt="Write operations setting with delay slider"width="550" />
147
+
:::caution Write Operations (Risk: High)
148
+
<imgsrc="/img/auto-approving-actions/auto-approving-actions-16.png"alt="Write operations setting with delay slider"width="550" />
112
149
113
150
**Setting:** "Always approve write operations"
114
151
115
152
**Description:** "Automatically create and edit files without requiring approval"
116
153
117
-
**Delay slider:** "Delay after writes to allow diagnostics to detect potential problems" (Default: 1000ms)
154
+
**Delay slider:** "Delay after writes to allow diagnostics to detect potential problems" (Default: 0ms)
155
+
156
+
**Additional options:**
157
+
-**Include files outside workspace:** Allow Roo to modify files outside the current workspace directory
158
+
-**Include protected files:** Allow Roo to modify files normally protected by .rooignore and .roo/ directory
118
159
119
160
**Risk level:** High
120
161
121
162
This setting allows Roo to modify your files without confirmation. The delay timer is crucial:
122
163
- Higher values (2000ms+): Recommended for complex projects where diagnostics take longer
123
-
- Default (1000ms): Suitable for most projects
124
-
- Lower values: Use only when speed is critical and you're in a controlled environment
125
-
- Zero: No delay for diagnostics (not recommended for critical code)
164
+
- Default (0ms): No delay - use when speed is critical
165
+
- 1000ms: Suitable for most projects with active diagnostics
166
+
- Lower values: Use only when in a controlled environment
167
+
168
+
#### Security Boundaries
169
+
170
+
The write operations setting includes two important security controls:
171
+
172
+
1.**Workspace Boundary Protection**: By default, Roo can only modify files within your current workspace. Enable "Include files outside workspace" with extreme caution.
173
+
174
+
2.**Protected Files**: Files in .rooignore and the .roo/ directory are protected by default. The "Include protected files" option bypasses this protection - use only when necessary.
126
175
127
176
#### Write Delay & Problems Pane Integration
128
177
@@ -146,8 +195,7 @@ This works like a human developer pausing to check for errors after changing cod
**Description:** "Enable auto-approval of individual MCP tools in the MCP Servers view (requires both this setting and the tool's individual 'Always allow' checkbox)"
194
241
195
242
**Risk level:** Medium-High (depends on configured MCP tools)
196
243
197
-
This setting works in conjunction with individual tool permissions in the MCP Servers view. Both this global setting and the tool-specific permission must be enabled for auto-approval.
244
+
This setting requires a two-step permission process for security:
245
+
246
+
1.**Enable this global setting** - Acts as a master switch for all MCP tool auto-approval
247
+
2.**Enable individual tool permissions** - In the MCP Servers view, check "Always allow" for specific tools
248
+
249
+
**Important:** Both permissions must be active for a tool to auto-approve. This dual-permission system ensures you maintain granular control over which MCP tools can execute without confirmation.
250
+
251
+
Example workflow:
252
+
- Enable "Always approve MCP tools" in settings
253
+
- Navigate to MCP Servers view
254
+
- Find the specific tool (e.g., filesystem operations)
@@ -246,23 +303,77 @@ This setting allows terminal command execution with controls. While risky, the w
246
303
- Always verify commands that interact with external systems
247
304
248
305
**Interface elements:**
249
-
- Text field to enter command prefixes (e.g., 'git')
306
+
- Text field to enter command prefixes
250
307
- "Add" button to add new prefixes
251
308
- Clickable command buttons with X to remove them
309
+
310
+
**Common whitelist examples:**
311
+
-`git` - Version control operations
312
+
-`npm run` - Run package.json scripts
313
+
-`python -m pytest` - Run Python tests
314
+
-`cargo test` - Run Rust tests
315
+
-`go test` - Run Go tests
316
+
-`docker ps` - List Docker containers
317
+
-`ls` - List directory contents
318
+
-`cat` - Display file contents
319
+
320
+
**Security tip:** Be specific with prefixes. Instead of allowing all `python` commands, limit to `python -m pytest` for test execution only.
252
321
:::
253
322
254
323
### Follow-Up Questions
255
324
256
-
:::info Follow-Up Questions
325
+
:::info Follow-Up Questions (Risk: Low)
257
326
<imgsrc="/img/auto-approving-actions/auto-approving-actions-15.png"alt="Follow-up question operations setting with timeout slider"width="550" />
258
327
259
328
**Setting:**`Always default answer for follow-up questions`
260
329
261
-
**Description:** Automatically selects the first AI-suggested answer for a follow-up question after a configurable timeout. This speeds up your workflow by letting Roo proceed without manual intervention. A visual countdown appears on the first suggestion.
330
+
**Description:** Automatically selects the first AI-suggested answer for a follow-up question after a configurable timeout. This speeds up your workflow by letting Roo proceed without manual intervention.
331
+
332
+
**Visual countdown:** When enabled, a countdown timer appears on the first suggestion button, showing the remaining time before auto-selection. The timer is displayed as a circular progress indicator that depletes as time passes.
262
333
263
334
**Timeout slider:** Use the slider to set the wait time from 1 to 300 seconds (Default: 60s).
264
335
265
-
**Note:** You can override the timer at any point by clicking a different suggestion, editing a suggestion, or typing a response.
336
+
**Override options:** You can cancel the auto-selection at any time by:
337
+
- Clicking a different suggestion
338
+
- Editing any suggestion
339
+
- Typing your own response
340
+
- Clicking the timer to pause it
266
341
267
342
**Risk level:** Low
343
+
344
+
**Use cases:**
345
+
- Overnight runs where you want Roo to continue working
346
+
- Repetitive tasks where the default suggestions are usually correct
347
+
- Testing workflows where interaction isn't critical
348
+
:::
349
+
350
+
### Update Todo List
351
+
352
+
:::info Update Todo List (Risk: Low)
353
+
354
+
**Setting:** "Always approve todo list updates"
355
+
356
+
**Description:** "Automatically update the to-do list without requiring approval"
357
+
358
+
**Risk level:** Low
359
+
360
+
This setting allows Roo to automatically update task progress and todo lists during work sessions. This includes:
361
+
- Marking tasks as completed
362
+
- Adding new discovered tasks
363
+
- Updating task status (pending, in progress, completed)
364
+
- Reorganizing task priorities
365
+
366
+
**Benefits:**
367
+
- Maintains real-time task progress visibility
368
+
- Reduces interruptions during multi-step workflows
369
+
- Keeps project status accurately reflected
370
+
- Helps track complex task dependencies
371
+
372
+
**Use cases:**
373
+
- Long-running development sessions
374
+
- Multi-step refactoring projects
375
+
- Complex debugging workflows
376
+
- Feature implementation with many subtasks
377
+
378
+
This is particularly useful when combined with the Subtasks permission, as it allows Roo to maintain a complete picture of project progress without constant approval requests.
0 commit comments