Docs04 of 14
Permissions and sandbox
Two separate controls, both on the chat. Agents can ask to raise them. They never lower them.
Approval behavior
| Mode | Command | What it means |
|---|---|---|
| Ask each time | /ask | Ask before tools run. |
| Accept edits | /accept-edits | Allow file edits without asking. |
| Always allow | /always-approve | Skip ordinary permission prompts. |
| Plan mode | /plan | Plan first — research only, then a reviewable plan. |
One permission inbox. Every prompt from every vendor lands in the same card above the message box, translated to that vendor's own protocol: Allow once, Allow for session, or Deny. When a chat is held below what its work needs, the agent may ask to Elevate — you see the card, you decide. An agent cannot lower a limit.
File access
| Profile | Command | What it means |
|---|---|---|
| Full access | /sandbox off | No sandbox. |
| Workspace only | /sandbox workspace | Reads and writes stay inside the linked folder or worktree. |
| Read-only | /sandbox read-only | Read, do not write. |
| Strict | /sandbox strict | The tightest profile. |
Permission mode, filesystem sandbox, network access, and outside-workspace access are separate settings. The desk applies the shared boundary before it translates an approval to a vendor; Codex also receives supported controls through its native config.
Where a chat runs
Environment on the chat is Local folder — the linked project folder — or Isolated worktree: a managed, detached Git worktree kept apart from your working copy. Link a project folder first. The Terminal and Changes use that same directory.
Terminal
The chat terminal is chat-scoped: it opens in that chat's folder or worktree, the same directory the agent works in.
Changes: git review
- Changes, beside the message box, opens the changed files and diffs for the work a chat did. Click a row to open the file beside the chat, or as the project-home pane.
+0/−0stays hidden. - Line stats load in the background and do not re-diff the list once they are known.
- Change instances — a created file's lines stay green. A later prompt that deletes some of them keeps those lines as red instances in the review, instead of shrinking the green count against empty / HEAD.
- Paths outside the project folder — an OpenClaw config, say — still resolve from the cite in the transcript.