tab cycles three modes, shown at the left of the status bar. Start in plan if you would rather it proposed than acted.
| Mode | Behaviour |
|---|---|
auto | every tool runs immediately |
accept edits | read-only tools run freely; anything that changes state asks first |
plan | anything that changes state is refused, so the model investigates and proposes |
In accept edits a prompt takes over the status row and the agent is blocked until answered:
? run write main.go y approve · n decline
The mode is also written into the system prompt, so the model knows the rules instead of learning them by collecting refusals.
read and list never do; write and edit always do. bash is the awkward one: it can do anything, so it counts as mutating unless the command matches a conservative allowlist — ls, cat, grep, rg, find, git status|log|diff|show and similar.
Redirection, command substitution, env-var prefixes, absolute paths and anything unrecognised all count as mutating.
That is an allowlist, not a denylist, deliberately. There is no way to enumerate every way a shell can change something, and a wrong "this is safe" writes to your disk. The cost is that plan mode sometimes refuses a harmless command it does not recognise.