read-only planning, then one-tap approve

The DGC workflow below applies to native local/API routes. Switch to plan mode (/mode plan or Shift+Tab) and the native agent goes read-only: it explores the code, reasons about an approach, and presents a concrete plan — files it will touch, the steps, the risks — without model-requested project mutations.

A delegated subscription turn instead maps plan to the vendor CLI's supported planning/read-only flag. That CLI owns its behavior; DGC does not inject present_plan, create the approval dialog, or save a native plan.md from it.

When the plan lands you get an approval prompt:

• Approve — DGC drops back to your previous edit mode and executes the plan.
• Keep planning — give feedback, stay read-only, and receive a revised plan.

Asking for a plan or design doc in Auto (or any other mode) also offers the native browser page plus a Markdown download. You do not have to say "in the browser". The native present_document tool creates a light page with section links, tables and a Markdown download, without an execution-approval dialog. Use browser Print → Save as PDF to export a PDF. Links are local to the machine running DGC and last while that process runs. General interactive HTML previews use artifact; approving a plan to execute still uses present_plan in Plan mode.

Plan mode is enforced in the permission layer, not by instruction. While it is active the agent may use only the read-only tools — reading files, grep, glob, code intelligence, web search — plus planning, checklist and document controls. Every model-requested mutation tool is denied outright: no file writes, no edits, no shell commands. Two further limits apply only in this mode: paths outside the project are refused, and MCP discovery and execution are not exposed at all.

Plan mode therefore prevents model-requested project mutations before you have read what the agent intends to do. Configured lifecycle hooks still run at their normal events, DGC still writes private session and plan state, and the selected model or remote integrations may receive inspected content, so review those settings before opening unfamiliar or sensitive code.

DGC keeps the plan inline in the transcript, saves a plan.md beside the session, and (by default) renders a self-contained preview on loopback. /view-plan reopens the saved copy. The preview never inherits LAN sharing; arbitrary project previews remain disabled in plan mode unless artifact_in_plan is explicitly enabled.

/plan enters read-only mode without starting a turn. /plan TASK inspects the project and prepares a plan. It does not toggle back into execution; use /mode or the mode selector when you want to change permissions.

/review enters read-only mode and reviews staged, working, and untracked changes for concrete bugs. Use /review --staged, /review --working, /review --base main, or /review --commit HEAD~1 to choose the comparison, followed by optional focus text. Native review uses the bounded git_diff tool without executing repository filters or network transports. Partial coverage is explicit. Findings should name the file/line, trigger, and impact; a source review must not claim tests were run.

/init inspects existing guidance and prepares or updates DGC.md using ordinary edit permissions. In plan mode it proposes the guide before any write. It never precreates a placeholder or bypasses approval to overwrite existing instructions.

These commands work in the interactive CLI, TUI, and editor. Selecting them after other text prepares the draft until Send; skills and context stay attached. Pause an active goal before starting a separate workflow. Unsupported subscription modes and invalid selections are rejected before starting a model request.