Skip Bat/CMD Permission Prompts

Overview

Configure CodeBuddy/WorkBuddy so that executing .bat / .cmd scripts no longer triggers an interactive permission confirmation dialog. This removes the repetitive "allow running this script?" prompt on Windows without weakening permission checks for other commands.

When to use

• The user is annoyed by repeated prompts to run .bat/.cmd scripts.
• The user asks to "allow bat scripts", "skip the bat confirmation", "default-allow running scripts", or "放开运行bat脚本的权限".
• Any request to reduce command-permission friction specifically for Windows batch scripts.

How it works

The agent permission system is defined by a permissions block with allow / ask / deny arrays. The agent harness reads it from the user-scope settings (it merges ~/.codebuddy/settings.json, ~/.codebuddy/settings.local.json, ~/.workbuddy/settings.json, and ~/.workbuddy/settings.local.json). The documented canonical location is ~/.codebuddy/settings.json.

.bat/.cmd scripts execute through the Bash (or PowerShell) tool, so adding Bash/PowerShell allow rules whose specifier is a glob covering .bat/.cmd suppresses the prompt for all common invocation forms: run.bat, cmd /c run.bat, call run.bat, .\run.bat.

Steps

1. Run the bundled script: scripts/configure_bat_permission.py.
   - Resolves the user-scope settings path (prefers ~/.codebuddy/settings.json; falls back to ~/.workbuddy/settings.json when the former does not exist).
   - Loads the JSON, ensures a permissions.allow array exists, and appends the following rules only if not already present:
   • Bash(*.bat*)
   • Bash(*.cmd*)
   • PowerShell(*.bat*)
   • PowerShell(*.cmd*)
   • Writes the file back and validates that it remains valid JSON.
   • Prints a summary of what changed (path touched, rules added).
2. Tell the user that settings load per session — they must start a new conversation / restart WorkBuddy for the change to take effect.
3. State the safety boundary: this is a scoped whitelist (only commands containing .bat/.cmd); every other command still follows normal permission rules.

Notes & edge cases

• The * in Bash(*.bat*) is a Bash-rule glob that crosses separators, so it matches .bat anywhere in the command string.
• Do not use a bare Bash / PowerShell entry unless the user explicitly wants all such commands unprompted. Prefer the scoped glob.
• If a compound command mixes an allowed script with a non-allowed command (e.g. git status && run.bat), it will still ask — this is expected safe behavior.
• The most aggressive option is bypassPermissions / dontAsk mode, but it disables all permission prompts; only use it in isolated/sandbox environments.

Resources

scripts/

• configure_bat_permission.py — deterministic editor that adds the bat/cmd allow rules to the user-scope settings and validates the result. It is idempotent (never duplicates existing rules).