Back to CallByte/Agent Security & Policy
View My Machines
Declared Local Policy Enforced

What the CallByte Agent Can Do on Your Machine

CallByte runs an open-source Python daemon (callbyte start) on your own hardware. All operations are bound by a locally declared policy file stored at ~/.callbyte/policy.json.

Operator-Declared Rules

The server cannot override your local machine policy. Every incoming message is checked locally before execution.

Strict Path Boundaries

Worktrees and command runs are strictly constrained to registered project directories and .callbyte-worktrees.

Non-Worktree Protection

Non-worktree sessions cannot be killed or purged remotely unless explicitly permitted in your policy.

Agent Daemon Capabilities

ActionDefault ScopeEnforced Restriction
prepare_worktreeCreates isolated git worktrees for tasksMust reside within allowed_project_roots
create_sessionLaunches coding assistant CLI subprocesses (Claude, Codex, Gemini)Checked against max_session_count & project root bounds
commandRuns test/lint/build commands in session directoriesFiltered by command_allow and command_deny patterns
git_pushPushes task branches to remote repositoriesRemote URL must match allowed_git_remotes
kill_session / purgeCleans up finished or stalled agent sessionsGuarded by allow_non_worktree_kill_purge (defaults to worktree-only)

Policy Configuration Schema (~/.callbyte/policy.json)

allowed_project_rootsarray

Allowed project directory roots. Path resolution strictly checks that operations and worktrees are contained within one of these paths. Defaults to registered projects in ~/.callbyte/projects.json plus ~/.callbyte-worktrees.

Default: []
allowed_git_remotesarray

Allowed git remote URL patterns / prefixes for push operations. Defaults to the repository's origin remote URLs.

Default: []
command_allowarray

Allowlist patterns (exact or glob) for commands executed via command frames. If specified, only matching commands are allowed.

Default: []
command_denyarray

Denylist patterns (exact or glob) for commands executed via command frames. Matching commands are immediately rejected even if in command_allow.

Default: []
max_session_countinteger | null

Maximum number of concurrent active agent sessions allowed on this host. Null or omitted means unlimited.

Default: null
allow_non_worktree_kill_purgeboolean

Whether kill_session / purge operations are permitted to terminate non-worktree sessions. When false (default), non-worktree sessions are protected from remote termination.

Default: false

Example Policy File

To customize permissions on your machine, write a JSON file to ~/.callbyte/policy.json:

{
  "allowed_project_roots": [
    "/home/user/projects",
    "/home/user/.callbyte-worktrees"
  ],
  "allowed_git_remotes": [
    "[email protected]:my-org/*",
    "https://gitlab.com/my-org/*"
  ],
  "command_allow": [
    "pytest*",
    "npm test*",
    "cargo test*"
  ],
  "command_deny": [
    "rm -rf /*",
    "*sudo*"
  ],
  "max_session_count": 5,
  "allow_non_worktree_kill_purge": false
}