docs/tools/elevated.md
When an agent runs inside a sandbox, its exec commands are confined to the sandbox environment. Elevated mode lets the agent break out and run commands outside the sandbox instead, with configurable approval gates.
Control elevated mode per-session with slash commands:
| Directive | What it does |
|---|---|
/elevated on | Run outside the sandbox on the configured host path, keep approvals |
/elevated ask | Same as on (alias) |
/elevated full | Run outside the sandbox on the configured host path and skip approvals when the mode/host approval policy is already permissive |
/elevated off | Return to sandbox-confined execution |
Also available as /elev on|off|ask|full.
Send /elevated with no argument to see the current level.
```json5
{
tools: {
elevated: {
enabled: true,
allowFrom: {
discord: ["user-id-123"],
whatsapp: ["+15555550123"],
},
},
},
}
```
```
/elevated full
```
Or use it inline (applies to that message only):
```
/elevated on run the deployment script
```
agents.defaults.elevatedDefault in config)tools.elevated.enabled (must be true)tools.elevated.allowFrom with per-channel listsagents.list[].tools.elevated.enabled (can only further restrict; both the global and per-agent gate must be true)agents.list[].tools.elevated.allowFrom (sender must match both global + per-agent)tools.elevated.allowFrom.<provider> is not configured. No bundled channel currently implements this hook, so in practice every provider needs an explicit tools.elevated.allowFrom.<provider> entry today.Allowlist entry formats:
| Prefix | Matches |
|---|---|
| (none) | Sender ID, E.164, or From field |
name: | Sender display name |
username: | Sender username |
tag: | Sender tag |
id:, from:, e164: | Explicit identity targeting |
exec is denied by tool policy, elevated cannot override it.auto into a free cross-host override. It uses the configured/session exec target rules, choosing node only when the target is already node./exec: the /exec directive adjusts per-session exec defaults (host, security, ask, node) for authorized senders and does not require elevated mode.