危险操作拦截

对明确危险的命令直接拒绝执行。

Markdown 原文Raw markdown

除了逐次请你确认，Bi 还会对一部分明确危险的命令进行拦截，命中后直接拒绝执行，作为比权限更硬的一道关卡。

会被拦截的操作

• 破坏性命令，例如删除文件、推送代码、发布等
• 修改文件权限的命令
• 用命令去做本应由专用能力完成的事，例如用命令读文件、写文件、搜索
• 未登记的插件或能力名称

这些是内置的默认规则，开箱即生效。你也可以在设置中增删自己的规则。

命中后会怎样

被拦截的调用会直接拒绝，不会弹出确认框。智能体会收到失败原因，并尝试其他做法。

部分规则可以改为「需要确认」：命中后弹出确认框，由你当场批准或拒绝，批准后才会执行。

与权限设置的关系

两者都用于把关，但作用不同：

• 需要你批准的操作命中后会弹出确认框，你可以当场放行
• 拦截规则命中后直接拒绝，没有确认环节

两者叠加生效，只有都被允许，操作才会真正执行。

一处常见误解

拦截规则只针对命令内容，不能用来限制「访问工作区之外的路径」。工作区边界是另一套独立的保护机制，无法通过设置放宽。见工作区。

Dangerous command interception

Commands that are clearly dangerous are refused outright.

Markdown 原文Raw markdown

Beyond asking you every time, Bi intercepts a set of clearly dangerous commands and refuses them outright. This is a harder gate than approvals.

What is intercepted

• Destructive commands, such as deleting files, pushing code or publishing
• Commands that change file permissions
• Using a shell for something a dedicated capability should do, such as reading, writing or searching files
• Unregistered plugin or capability names

These are built-in defaults and apply out of the box. You can add or remove rules in Settings.

What happens on a match

The call is refused immediately — no confirmation dialog. The agent receives the reason and tries another approach.

Some rules can be set to “require confirmation” instead: a match raises a prompt, and the command runs only if you approve it on the spot.

Relation to approval settings

Both gate operations, but differently:

• Operations that need approval raise a confirmation dialog you can approve
• Intercept rules refuse outright, with no confirmation step

They stack: an operation runs only if both allow it.

A common misunderstanding

Intercept rules inspect command content. They cannot be used to restrict access outside the workspace. The workspace boundary is a separate mechanism that settings cannot relax. See Workspace.