Permission modes#

DGC gates what the agent can do without asking. Cycle modes with Shift+Tab or set one with /mode.

default — reads run freely; every file write and shell command asks first.
acceptEdits — file edits auto-apply; shell commands still ask.
plan — read-only. The agent investigates and proposes a plan but changes

nothing until you approve. See the *Plan mode* page.

auto — full access, nothing asks. Use only in a sandbox or a throwaway repo.

You can also carve out standing rules with /permissions (allow / ask / deny). /sandbox on uses the strongest supported host boundary and does not skip normal permission prompts. Linux/bubblewrap makes the project the only persistent writable host path, masks ambient user state, and provides private home, temporary, runtime, process, and network namespaces. macOS/sandbox-exec denies ambient-home reads outside the project and host writes except the project and shared system temporary paths; its temporary and process namespaces are not private. Network is blocked by default on both. Unsupported platforms fail closed instead of running a requested sandbox without confinement. Use /sandbox network on only when needed.