What every tool is blocked from touching

One rule applies uniformly across every tool tCode has, read-only or permission-gated, with no exceptions carved out for any of them: none can read from or write to tCode's own configuration directory, where your saved login session actually lives.

This is not left to the permission prompt to catch case by case; it is enforced structurally at the tool level itself, before a call ever reaches the point of asking you anything. There is no legitimate coding task that would ever need to touch tCode's own saved credentials, so the possibility is removed outright.

See Security for the fuller reasoning behind this and what specifically lives in that directory.

This block applies even to an indirect path built to reach the same location another way, a symlink, a relative path constructed with several levels of .., or an absolute path pointing at the same directory by a different route. The check is against the resolved destination, not the literal text of the path as typed.

Because this is enforced at the tool level itself, it holds regardless of what the model is reasoning about or how a request happens to be phrased; there is no prompt wording that reframes a request in a way that bypasses it, since the block does not depend on interpreting intent at all.