Permission modes

Fullhouse permissions are fail-closed: when in doubt, the agent stops and asks.

Defaults

• Agents run locally under your OS user. No sandbox escape, no remote execution — your machine, your credentials.
• Sensitive actions surface an approval prompt before running.
• ACP agents (Gemini, Qwen, Cline, Cursor, goose, Amp, …) are opt-in per agent in Settings → Agents. Nothing extra runs until you enable it.
• macOS asks for Documents/Desktop/Downloads access only when an agent actually needs it — never at launch.

Handoff redaction

Before a thread moves from one agent to another, the Rust core parses the transcript and masks credentials (API keys, tokens). The handoff banner shows the redaction count, and every switch is recorded in a signed ledger entry (source → target, reason, redaction count) written as an atomic 0600 manifest.

Composer modes

Each thread carries a mode — plan, auto, or full — controlling how much the agent may do without asking. Shift+Tab toggles plan mode from the composer. Start in plan, widen only when you trust the task.