Docs04 of 14

Permissions and sandbox

Two separate controls, both on the chat. Agents can ask to raise them. They never lower them.

Approval behavior

ModeCommandWhat it means
Ask each time/askAsk before tools run.
Accept edits/accept-editsAllow file edits without asking.
Always allow/always-approveSkip ordinary permission prompts.
Plan mode/planPlan first — research only, then a reviewable plan.

One permission inbox. Every prompt from every vendor lands in the same card above the message box, translated to that vendor's own protocol: Allow once, Allow for session, or Deny. When a chat is held below what its work needs, the agent may ask to Elevate — you see the card, you decide. An agent cannot lower a limit.

File access

ProfileCommandWhat it means
Full access/sandbox offNo sandbox.
Workspace only/sandbox workspaceReads and writes stay inside the linked folder or worktree.
Read-only/sandbox read-onlyRead, do not write.
Strict/sandbox strictThe tightest profile.

Permission mode, filesystem sandbox, network access, and outside-workspace access are separate settings. The desk applies the shared boundary before it translates an approval to a vendor; Codex also receives supported controls through its native config.

Where a chat runs

Environment on the chat is Local folder — the linked project folder — or Isolated worktree: a managed, detached Git worktree kept apart from your working copy. Link a project folder first. The Terminal and Changes use that same directory.

Terminal

The chat terminal is chat-scoped: it opens in that chat's folder or worktree, the same directory the agent works in.

Changes: git review

  • Changes, beside the message box, opens the changed files and diffs for the work a chat did. Click a row to open the file beside the chat, or as the project-home pane. +0/−0 stays hidden.
  • Line stats load in the background and do not re-diff the list once they are known.
  • Change instances — a created file's lines stay green. A later prompt that deletes some of them keeps those lines as red instances in the review, instead of shrinking the green count against empty / HEAD.
  • Paths outside the project folder — an OpenClaw config, say — still resolve from the cite in the transcript.