KoboldCpp 1.123 gives file work and shell commands different approval paths

You may be happy for an agent to edit a copied runbook without asking about every file. Giving it the same freedom across your workstation is a different decision. KoboldCpp 1.123’s auto confirmation mode makes that distinction more explicit for file work inside the chosen directory, while keeping shell calls and outside writes subject to confirmation.

The October 13, 2026 release also adds per-tool settings and saved sessions. Those conveniences interact: a restored tool override can change what a global mode appears to promise. Inspect the effective setting for the operation you are about to allow.

Start with the copied workspace

The integrated terminal agent can read and edit files and run commands while using a model through an OpenAI-compatible endpoint. The model can be served by KoboldCpp or another compatible endpoint. Its tools still run where the agent runs; using a local harness does not create an isolated machine.

The release notes describe global on, the default requiring approval; off, approving calls automatically; and auto, approving in-workdir file work while asking about shell calls and outside writes or edits.

For this hypothetical exercise, copy sanitized incident material into a dedicated folder, separate from credentials and production checkouts. Following the agent guide’s launch syntax, substitute your reviewed model file and the copied folder’s absolute path:

koboldcpp --model mymodel.gguf --agent --cli

# At the agent prompt, after selecting the copied workspace:
/workdir /absolute/path/to/incident-fixture
/confirm auto
/confirm shell on
/confirm
/tools

The explicit shell on setting asks for shell-call approval. The subsequent queries show the state governing the run. Let the agent read copied logs and propose a runbook alongside them; this is where fewer routine file prompts can help without unattended shell execution.

The community guide described an older model-review meaning of auto and the earlier launcher tab at the time of review. For 1.123 behavior, use the pinned notes and versioned implementation.

Read the override before the global default

Per-tool confirmation takes precedence. If shell has an off override, choosing global auto does not restore its prompt. Set it to on, or use /confirm shell default to inherit the global mode.

Confirmation controls whether a call starts. Once approved, a shell command can use the running account’s access, including accessible paths outside the starting directory. These are harness approval rules, not an operating-system containment boundary.

If unattended shell work is needed, use a separately restricted account, container or sandbox with tested access. The OpenShell guide discusses that other layer.

Fixture action	Effective setting	Expected approval behavior to check
Write a harmless report inside the copied workdir.	write: auto	Automatic approval for an in-directory path.
Write a harmless file outside that directory.	write: auto	A confirmation prompt before the write.
Run a harmless shell command.	shell: auto or on	A confirmation prompt.
Inspect a shell tool configured with an off override.	shell: off	The tool is configured to approve without a prompt, even if the global mode is auto.

This matrix is a proposed disposable-file test, not a report of executed agent calls. Cancel unexpected operations and inspect the actual filesystem after permitted calls. It deliberately makes no claim that every outside read prompts: the pinned code has separate automatic-review paths for other tools.

Resume the settings and reconcile the work

/save, /load and launch-time --agentload restore more than messages. The implementation saves workdir, global and per-tool confirmation settings and automation limits. Endpoint, API key and model identity are excluded, although the conversation itself may contain sensitive material.

After loading, inspect /workdir, /confirm and /tools. The target files may have changed, while an old override can still permit more than you expected.

Restored settings also cannot resolve a write whose reply was lost. Retain the authorized action and last observed destination state, then inspect the destination before retrying. For the copied runbook, check whether the report already exists, what it contains and which input revision it used.

/maxsteps bounds automated turns and /autocompact reduces conversational context. Neither establishes that the report is correct. Opening the copied output completes the useful check: routine file preparation has stayed in the intended task, and shell work has met the approval setting you actually chose.

Sources and scope

This article follows the October 13 release, the community agent guide, and the pinned source implementation. The discovery lead was the LocalLLaMA release discussion. The incident bundle and acceptance matrix are illustrative. Source inspection was performed; no local model, agent session, or production change was executed for this article.