timbers-toolbox
Public
UNRESTRICTED_MODE.md
UNRESTRICTED_MODE.md
One toggle to disable all restrictions: every tool enabled, no workspace sandbox.
Plugins → Timbers Toolbox → ⚠️ UNRESTRICTED MODE (Master Switch — All Tools, No Sandbox)
(general.unrestrictedMode = true), then reload / lms push.
list_directory, read_file, save_file, change_directory,
etc. accept ANY absolute path on ANY drive — including outside the workspace.
change_directory("D:\\timbertim92\\airllm") just works; CWD + workspace root follow.sandboxWorkspace exec pinning is bypassed (commands run from process CWD).Normal behavior: per-permission gating + workspace boundary (Access Denied outside root).
Only enable for trusted local use — the model can read/write/delete anywhere your user account can.
One toggle to disable all restrictions: every tool enabled, no workspace sandbox.
Plugins → Timbers Toolbox → ⚠️ UNRESTRICTED MODE (Master Switch — All Tools, No Sandbox)
(general.unrestrictedMode = true), then reload / lms push.
list_directory, read_file, save_file, change_directory,
etc. accept ANY absolute path on ANY drive — including outside the workspace.
change_directory("D:\\timbertim92\\airllm") just works; CWD + workspace root follow.sandboxWorkspace exec pinning is bypassed (commands run from process CWD).Normal behavior: per-permission gating + workspace boundary (Access Denied outside root).
Only enable for trusted local use — the model can read/write/delete anywhere your user account can.
src/config.ts — new general.unrestrictedMode boolean (default false).src/locales/i18n.ts — label entry.src/pathSecurity.ts — setUnrestrictedMode() / isUnrestrictedMode(); validatePath,
validatePathAsync, isPathInsideWorkspace, rejectAbsolutePath all bypassed when ON.src/stateManager.ts — assertInsideWorkspace / assertInsideWorkspaceSync bypassed;
changeWorkingDirectory short-circuits to cd anywhere when ON.src/toolsProvider.ts — reads the flag first, pushes it into pathSecurity, forces every
allow* / enable* to true, clears exec sandboxing, patches both sub-agent loops.npx tsc src/pathSecurity.ts --outDir /tmp/pstest --module commonjs --target es2020 --skipLibCheck
node -e "const ps=require('/tmp/pstest/pathSecurity.js'); ps.setUnrestrictedMode(true); console.log(ps.validatePath('D:/a','D:/a','D:/timbertim92/airllm'))"
# → D:\timbertim92\airllm (no Access Denied)
src/config.ts — new general.unrestrictedMode boolean (default false).src/locales/i18n.ts — label entry.src/pathSecurity.ts — setUnrestrictedMode() / isUnrestrictedMode(); validatePath,
validatePathAsync, isPathInsideWorkspace, rejectAbsolutePath all bypassed when ON.src/stateManager.ts — assertInsideWorkspace / assertInsideWorkspaceSync bypassed;
changeWorkingDirectory short-circuits to cd anywhere when ON.src/toolsProvider.ts — reads the flag first, pushes it into pathSecurity, forces every
allow* / enable* to true, clears exec sandboxing, patches both sub-agent loops.npx tsc src/pathSecurity.ts --outDir /tmp/pstest --module commonjs --target es2020 --skipLibCheck
node -e "const ps=require('/tmp/pstest/pathSecurity.js'); ps.setUnrestrictedMode(true); console.log(ps.validatePath('D:/a','D:/a','D:/timbertim92/airllm'))"
# → D:\timbertim92\airllm (no Access Denied)