Transparency Dock & Approval Gates

BhaiCode Desktop uses the Transparency Dock to monitor, intercept, and gate all agent tool calls before execution.

Risk Classification Tiers

graph TD
    OP["Agent Requests Tool Execution"] --> TIER{"Risk Evaluation"}
    TIER -->|Safe / Read-Only| AUTO["Auto-Executed<br/>(File reads, symbol search, git status)"]
    TIER -->|Workspace Edits| STAGE["Staged in Diff Viewer<br/>(Creating files, editing code)"]
    TIER -->|High-Risk / System| GATE["Approval Gate Intercepted<br/>(Terminal commands, package installs, git push)"]

1. Safe (Read-Only)

• Reading file contents inside the open workspace directory.
• Searching symbols, grepping code, and listing directory contents.
• Inspecting Git status and diffs.
• Action: Executed automatically without interrupting your flow.

2. Workspace Modifications

• Creating new source files or editing existing files inside the project.
• Action: Executed and staged in the Visual Diff Viewer for your review.

3. High-Risk / System Operations (Gated)

• Running shell commands in the terminal (npm install, docker run, rm -rf).
• Modifying files outside the workspace root.
• Git remote write operations (git push).
• Action: Intercepted by the Approval Dock. The agent pauses until you choose an action.

The Approval Prompt

When a high-risk command is intercepted, the dock displays:

1. The Exact Command: Command line, working directory, and environment flags.
2. The Stated Reason: Why the agent believes this command is required.
3. Controls:
   • Approve Once: Allows this specific run.
   • Always Allow for Session: Whitelists this command pattern for the duration of the current task.
   • Deny & Provide Feedback: Cancels the command and sends your explanation back to the agent so it can find an alternative approach.