native default · acceptEdits · plan · auto

DGC gates what the agent can do without asking. Cycle modes with Shift+Tab or set one with /mode.

• default — reads run freely; model-requested file writes and shell commands ask by baseline.
• acceptEdits — file edits auto-apply by baseline; shell commands ask by baseline.
• plan — prevents model-requested project mutations while the agent investigates and proposes a plan for approval. See the Plan mode page.
• auto — model-requested tool actions are approved. Some integration consent prompts remain user-gated. Use only in a sandbox or a throwaway repo.

Explicit /permissions rules are evaluated deny → ask → allow before those baseline decisions. Subscription turns map the mode into the selected vendor CLI's own flags and policy instead. /sandbox on uses the strongest supported host boundary for native-loop spawned shell commands and hooks; it does not confine parent-process structured file tools or delegated vendor CLIs, and does not skip normal permission prompts. Linux/bubblewrap makes the project the only persistent writable host path for those commands, masks ambient user state, and provides private home, temporary, runtime, process, and network namespaces. macOS/sandbox-exec denies ambient-home reads outside the project and host writes except the project and shared system temporary paths; its temporary and process namespaces are not private. Network is blocked by default on both. Unsupported platforms fail closed instead of running a requested sandbox without confinement. Use /sandbox network on only when needed. The Sandbox page covers backends, what is confined, and what is not.

Each chat keeps its own mode, so a risky refactor can sit in default while a scratch chat beside it runs auto. Choosing a mode also makes it the default for chats you start afterwards; it never moves a chat that is already open, in this window or another one. Reopening a session brings back the mode it ran in when that mode asks no less than the one you are in: a chat that was planning comes back planning, and one that ran in auto comes back in auto when auto is your mode. It is checked again rather than trusted from the file: acceptEdits and auto only while that folder is still trusted. A mode you name for the run wins (dgc --mode plan --continue runs in plan), and a new chat after a reopened one starts in the mode the reopened chat replaced.

In a folder you have not trusted, acceptEdits and auto start as default, for that session only — your stored default is left as it was. Approving a plan into auto there runs it in default and says why. Trust the folder to change that; the editor asks when you pick a mode that needs it.

The approval card shows what the step will do — its summary and, for an edit, the diff it would apply — so you approve against the change rather than raw arguments. Deny can carry a note; the model reads it as the reason and adjusts.