Anderson LimaSoftware Engineer & Architect
October 16, 2026
5 min read
38 views
Three layers in lemon-code: what never runs, what depends on the permission mode, and what always goes through you
Published: October 28, 2026
Reading time: 9 min
Series: lemon-code in 30 days, part 5 of 13
The CLI's --yolo flag selects bypassPermissions, the most permissive mode. It skips permission prompts, but the blocklist still applies: if the model proposes rm -rf ~, the answer is no.
That refusal doesn't come from the model or from a prompt asking it to be careful. It comes from a rule in code that no permission mode can turn off. This post shows how lemon-code stacks guardrails in three layers and why their order matters.
--yolo selects bypassPermissions.plan is read-only; dontAsk denies actions that would require approval.Picture an office building. The front desk has a list of things that never get in, badge or not. Then your badge decides which floors you can reach. And to enter the vault, someone has to open the door with you.
The front desk is the first layer. It sits before everything, so no badge overrides it.
// minimal destructive blocklist (rewritten and simplified)
const DESTRUCTIVE: Array<{ pattern: RegExp; reason: string }> = [
{ pattern: /\brm\s+-rf\s+\/(\s|$)/, reason: "wipe root" },
{ pattern: /\brm\s+-rf\s+(~|\$HOME)(\s|$)/, reason: "wipe home" },
{ pattern: /\bmkfs\b/, reason: "format partition" },
{ pattern: /\bdd\b.*\bof=\/dev\/(sd[a-z]|hd[a-z]|nvme\d|disk\d)\b/i, reason: "write to block device" },
];
export function isDestructive(command: string) {
const hit = DESTRUCTIVE.find((e) => e.pattern.test(command.trim()));
return hit ? { blocked: true, reason: hit.reason } : { blocked: false, reason: "" };
}
console.log(isDestructive("rm -rf ~")); // { blocked: true, reason: "wipe home" }
console.log(isDestructive("rm -rf ./dist")); // { blocked: false, reason: "" }
The function doesn't take the mode as input. Configuration can't relax it, on purpose.
Free and paid products to turn ideas into a foundation you can actually ship.
13 products available
nextjs · boilerplate
Boilerplate de API em Python com FastAPI, organizado em Clean Architecture (router, service, repository e adapters por módulo). Inclui autenticação JWT com hashing bcrypt, MongoDB, testes com pytest e cobertura, Dockerfile e docker-compose para subir localmente, e documentação Swagger/OpenAPI automática. Repositório de origem privado; snapshot técnico verificado antes da publicação.
View product
react · boilerplate
A React Native foundation for iOS and Android apps with Expo, Clean Architecture, MVVM, Firebase, and native modules. Technical reference from VaiDeFut, with public Google Play distribution and a documented iOS publishing flow.
View product
nextjs · boilerplate
A free open-source kit for getting started with coding agents across Claude Code, Codex, Gemini, Copilot, and OpenCode. The public repository confirms an MIT license.
View product
nextjs · boilerplate
A white-label AI-first foundation for shipping SaaS products with Next.js, chat, RAG, memory, tenants, and documentation. The verified snapshot documents Supabase rather than MongoDB; that limitation is explicit. MongoDB, Redis, and RabbitMQ require a compatible integration/configuration.
View product
nextjs · boilerplate
An advanced white-label, multi-tenant AI-first foundation for accelerating products with Next.js, chat, RAG, memory, and documentation. The verified snapshot does not prove a distinct Ultra layer; that limitation stays explicit while provider, cache, and queue swaps remain visible.
View product
nextjs · boilerplate
A white-label, multi-tenant foundation for turning an idea into an AI-first SaaS with Next.js, chat, RAG, memory, and documented security. The verified snapshot uses Supabase; the name identifies the source repository. Provider, cache, and queue boundaries stay explicit; Redis and RabbitMQ are configurable integrations.
View product
react · portfolio
A one-time contribution that supports free technical content, research, and the continuity of relevant projects published by Anderson Lima. You choose the amount; there is no subscription.
View product
react · boilerplate
A free React starter for building a reliable test suite from the first commit, combining Vitest, Testing Library, Playwright, Vite, TypeScript, Zustand, React Query, MirageJS, and PWA. The repository does not declare an SPDX license; review its terms before commercial use.
View product
react · portfolio
A public React, TypeScript, and Vite monorepo for exploring a component library with a native-inspired visual language. The current README is minimal and does not declare an SPDX license; treat it as a free preview.
View product
nextjs · saas
An AI-first SaaS boilerplate with Next.js, Supabase, Stripe, and provider routing to move from the first prompt toward a real deployment faster. AI, data, email, cache, and queue adaptations stay explicit; Redis and RabbitMQ are configurable integrations.
View product
react · saas
A React + TypeScript starter for multi-tenant SaaS with Firebase, Atomic Design, themes, PWA, product screens, MirageJS, and Gemini chat extensible to other providers. Validate production requirements, costs, and integrations before publishing.
View product
react · boilerplate
A public React starter with TypeScript, Zustand, React Query, Tailwind CSS, PWA, and documented AI integrations. The repository does not declare an SPDX license; review its terms before commercial use.
View product
nextjs · saas
A Next.js, TypeScript, and Tailwind CSS SaaS landing page with SEO, themes, i18n, PWA, and integration points for auth, Stripe, and AI. A clear foundation for leaving the blank screen behind and shaping your positioning.
View productContinue exploring similar topics
I reached for an HTTP provider on tasks an installed CLI could handle. lemon-code's CLI-first rule fits in four lines of precedence.
For HTTP-provider routes, lemon-code records score factors. This teaching example shows how to read the sum and distinguish it from the JEV layer.
lemon-code has six ADRs numbered 0049, all created on the same day. That mistake teaches more about project memory with multiple agents than any well-numbered ADR.
A practical checklist to validate security, cost, evals, and observability before you ship your AI app to production.
Production-tested templates trusted by developers. Save weeks of setup on your next project.
The DESTRUCTIVE_BLOCKLIST covers catastrophic or irreversible operations: wiping root or home, recursive chmod 777 on root, mkfs, dd writing to a block device, and DROP DATABASE or DROP TABLE without a specific target. It applies even in bypassPermissions.
A regex blocklist is never complete and doesn't replace a sandbox. Its job is catching the gross, cheap-to-detect mistake a confused model might produce at 3 a.m. during an autonomous mission.
| Mode | Behavior |
|---|---|
default | asks before sensitive actions |
acceptEdits | accepts edits inside the project, asks before risky commands |
plan | read-only: read, list, search; writes and execution denied |
dontAsk | never asks; anything needing approval is denied |
bypassPermissions (--yolo in the CLI) | skips permission prompts; the destructive blocklist still applies |
I use plan to explore unfamiliar repos: the agent can read without changing files. dontAsk is not auto-approval; actions that would require confirmation are denied. In the CLI, --yolo selects bypassPermissions.
Depending on the mode and applicable rule, some actions go through you: writes outside the project root, sensitive commands and Git operations like push. The menu offers approve once, for the session, permanently, or deny.
The workspace informs that decision: paths outside the root and protected directories can enter the approval flow. That's a path check, not full process isolation.
Execution guardrails don't help if an API key shows up in output. lemon-code scrubs known secret patterns from tool outputs before reuse and masks configured secrets as [REDACTED] in the terminal and UI. Credential config files receive 600 permissions on POSIX systems on a best-effort basis.
Some path checks already exist. ADR 0024, still proposed, describes stronger executor containment: a workspace jail and explicit rules for protected directories such as .git/hooks. The blocklist and approval flow reduce risk, but they aren't process sandboxing.
dontAsk denies actions that would otherwise require confirmation.Good guardrails are a stack with the hardest layer in front. The blocklist ignores the mode, the mode sets autonomy and approval handles the rest. None of them relies on the model behaving.
Friday's post moves from code to memory: how I use ADRs to keep several agents aligned on one project.
If your team is giving coding agents access to local environments and wants a review of the permission model, that's work I do at LEMON.DEV.