Security and permissions
Keep host access and human decisions explicit.
Understand where work runs
airship uses your local machine and SSH connections to hosts you configure. There is no airship account or relay. Claude Code and Codex still connect to their providers according to their own settings.
Host credentials, runtime authentication and repository access remain your responsibility. Treat agent access to a host as access to that user’s files and services.
Choose a permission mode per host
airship host permissions| Mode | Behavior |
|---|---|
Asks first (ask) | Default. Claude uses acceptEdits; Codex uses workspace-write and approvals on request. Ordinary permitted actions can proceed. |
Auto-review (auto) | Uses runtime approval review where supported; falls back to Asks first when unavailable. |
Unattended (unattended) | Removes runtime approval prompts and the runtime sandbox. Tools run with your user’s access. |
Asks first does not mean every action asks. Noninteractive lane steps report denied actions in their results instead of waiting at a prompt.
Review a policy change
Preview the effect before enabling Unattended on a named host:
airship host set box-a --permissions unattended --dry-runIf you choose to enable it, a human must confirm the host-specific phrase:
airship host set box-a --unattended on --confirm "unattended box-a" --apply idleTo return to Asks first:
airship host set box-a --unattended off --apply idle--apply idle restarts eligible units at their next ready point on the same conversation. --apply now interrupts the current turn. Without --apply, loosening takes effect on the next restart. Until a restart occurs, the unit’s old mode remains active. In-place adopted sessions are skipped.
Unreachable hosts retain their last received policy and show stale status. Moves use the destination host’s policy. The app’s host Permissions sheet shows the impact before applying a change.
Human answers stay human
Only the operator answers decisions and runtime dialogs. Agents cannot grant themselves authority by passing an operator flag or writing an answer in their own session. This guard is not a security sandbox; it does not protect secrets from an unattended agent with ordinary user access.
Framework hooks and repository executables run code as your user. Review them before enabling a framework. Moves transfer workspace and session records; trust both machines and review what will be carried.
Use least-privilege accounts and runtime settings appropriate to your work. Keep credentials out of prompts, shared transcripts and screenshots.
Report a vulnerability
Follow the product’s security policy for private vulnerability reporting.