Mistral Vibe: Shell and Git Safeguards Tighten the Working-Directory and Trust Boundary
Mistral VibeMistral Vibe 3.0.3 closed several gaps where the agent could reach beyond what a user authorized. Shell tools set to permission = "always" now ask before touching paths outside the working directory, bare symlink names such as cat link are treated as paths, and a new outside_workdir = "deny" setting refuses outside access without a prompt. Git handling was also hardened so untrusted repositories can no longer run their own configured programs during context loading, worktree creation or file completion.
Key Takeaways
- Shell tools set to
permission = "always"now prompt for paths outside the working directory, closing a gap versus file tools. - A new
outside_workdir = "deny"option refuses outside access with a tool error, so the agent continues instead of waiting on a prompt. - Symlinks and Windows junctions passed as bare names, such as
cat link, are now treated as paths and checked like any other outside path. - Repository-defined Git programs (signature verification, file filters, LFS extensions, fsmonitor) no longer run before the folder is trusted.
- Worktree operations respect session and source-repo trust, and untrusted submodules are retained when they cannot be safely inspected.
/reloadpermission changes now apply to running custom subagents on their next tool call, not only to new ones.
Why this release matters for safety
Mistral Vibe 3.0.3 contains a group of changes that share one theme: the agent should only act within what the user has authorized. Several of them fix cases where a permission setting or a trust decision did not apply as widely as users would expect.
Outside-the-workdir access is now checked more strictly
Shell tools configured with permission = "always" previously skipped the extra check for paths outside the project folder. As of 3.0.3, Mistral Vibe asks before a shell command reaches outside the working directory, matching how file tools already behaved.
The release also closes a symlink loophole. A bare file name that is a symlink or a Windows junction, for example cat link, is now treated as a path. A link that points outside the working directory therefore triggers a prompt or a denial, the same as any explicit outside path.
For teams that want a firm rule, Mistral Vibe added outside_workdir = "deny", available globally or per tool. With it set, file and shell access outside the working directory is refused with a tool error instead of a prompt. The agent sees the error and keeps working, so a long task is not blocked waiting for a human.
Repository Git configuration no longer runs code before trust
A second group of fixes addresses Git settings that a repository can carry with it:
- Automatic project context no longer runs repository-configured Git signature verification programs.
- Creating a worktree no longer runs file filters defined in the repository's own Git configuration before the folder is trusted.
- Conditional Git includes are evaluated in the destination worktree, and untrusted snapshots cannot run repository LFS extensions through global filters.
- Worktree Git operations honor both session trust and source repository trust. Untrusted submodules are kept when their contents cannot be safely inspected or saved.
@file completion no longer runs a repository'score.fsmonitorcommand, and no longer hangs on a stuck fsmonitor daemon.
Permission changes reach running subagents
A permission change applied with /reload now reaches custom subagents that are already running, on their next tool call. Before this, a subagent started earlier could keep acting under the old, looser rules.
What users should do
Users who rely on permission = "always" for shell tools will see new prompts for outside paths. Those who prefer unattended runs can set outside_workdir = "deny" to turn those prompts into plain refusals.