You decide how much the room may do without asking. The mode is a chip beside the composer.
- Plan — read and think, change nothing. The room investigates, agrees a plan, and hands it to you. Nothing is written.
- Manual — asks before everything. For a tree you are nervous about.
- Edits — files are free; commands ask.
- Auto — works, and asks only about the dangerous things. The default.
- Bypass — never asks. For a throwaway checkout, not for your main tree.
Approvals
When the room wants to do something the mode does not cover, it asks — and the question reaches wherever you are. An approval raised on your Mac appears on your phone and in the browser too, so a run started at your desk does not sit blocked while you are out.
The three things it asks about: running a command the rules do not already allow, writing outside the workspace, and anything the sandbox refused. Answer once for this time, or allow it for the rest of the session.
The sandbox
Commands run inside a sandbox where the platform supports one, confined to the workspace. When something needs out, you are asked rather than quietly allowed.
Rules you set once
Commands you always allow — your test runner, your linter — can be remembered per folder, so the same approval is not asked twice a day. They are stored with the folder, not globally, because make deploy means different things in different repositories.