How do I set permission rules (allow, ask, deny) in Line CLI?

Add a permissions block to ~/.config/line/settings.json:

{
  "permissions": {
    "allow": ["bash(npm test*)", "Read"],
    "ask": ["bash(git push*)"],
    "deny": ["read_file(.env*)", "bash(rm -rf*)"]
  }
}

Rule examples#

How rules combine#

• Deny wins over ask and allow. A deny on reading a file also blocks cat-ing it.
• An allowed command prefix can't smuggle a second command (npm test && curl … | sh isn't allowed by bash(npm test*)).
• A project's .line/settings.json can add ask and deny rules, never allow.

For one run: --allowed-tools "bash(npm test*),read_file" and --disallowed-tools "bash,web_fetch".