What the CallByte Agent Can Do on Your Machine
CallByte runs an open-source Python daemon (callbyte start) on your own hardware. All operations are bound by a locally declared policy file stored at ~/.callbyte/policy.json.
Operator-Declared Rules
The server cannot override your local machine policy. Every incoming message is checked locally before execution.
Strict Path Boundaries
Worktrees and command runs are strictly constrained to registered project directories and .callbyte-worktrees.
Non-Worktree Protection
Non-worktree sessions cannot be killed or purged remotely unless explicitly permitted in your policy.
Agent Daemon Capabilities
| Action | Default Scope | Enforced Restriction |
|---|---|---|
| prepare_worktree | Creates isolated git worktrees for tasks | Must reside within allowed_project_roots |
| create_session | Launches coding assistant CLI subprocesses (Claude, Codex, Gemini) | Checked against max_session_count & project root bounds |
| command | Runs test/lint/build commands in session directories | Filtered by command_allow and command_deny patterns |
| git_push | Pushes task branches to remote repositories | Remote URL must match allowed_git_remotes |
| kill_session / purge | Cleans up finished or stalled agent sessions | Guarded by allow_non_worktree_kill_purge (defaults to worktree-only) |
Policy Configuration Schema (~/.callbyte/policy.json)
Allowed project directory roots. Path resolution strictly checks that operations and worktrees are contained within one of these paths. Defaults to registered projects in ~/.callbyte/projects.json plus ~/.callbyte-worktrees.
Allowed git remote URL patterns / prefixes for push operations. Defaults to the repository's origin remote URLs.
Allowlist patterns (exact or glob) for commands executed via command frames. If specified, only matching commands are allowed.
Denylist patterns (exact or glob) for commands executed via command frames. Matching commands are immediately rejected even if in command_allow.
Maximum number of concurrent active agent sessions allowed on this host. Null or omitted means unlimited.
Whether kill_session / purge operations are permitted to terminate non-worktree sessions. When false (default), non-worktree sessions are protected from remote termination.
Example Policy File
To customize permissions on your machine, write a JSON file to ~/.callbyte/policy.json:
{
"allowed_project_roots": [
"/home/user/projects",
"/home/user/.callbyte-worktrees"
],
"allowed_git_remotes": [
"[email protected]:my-org/*",
"https://gitlab.com/my-org/*"
],
"command_allow": [
"pytest*",
"npm test*",
"cargo test*"
],
"command_deny": [
"rm -rf /*",
"*sudo*"
],
"max_session_count": 5,
"allow_non_worktree_kill_purge": false
}