Permissions

Cycle with shift+tab: default → acceptEdits → plan → auto, plus bypassPermissions.

• Auto mode runs autonomously. Read-only and in-project actions run immediately, known-dangerous commands are hard-blocked, and anything else is screened by an LLM safety classifier. The classifier sees only what you typed and the proposed action, never tool output or the files you mention, so prompt injection can't talk it into approving. Only what you type into a frontend (the TUI, the REPL, the web UI or phone, an ACP client, -p) counts as your request. Every other prompt is shown to it as the agent's task, not as your request: a subagent's task, a goal, team or outcome step, a background run, a scheduled task, a slash command's expansion, a request from an MCP client. After 3 blocks in a row, the decision falls back to you. Optional, experimental: permissions.fast_path = true clears routine shell commands with a small built-in model in microseconds instead of a model call (it can only allow, never block, and never clears inline code such as node -e or python -c, packages fetched to run such as npx github:… or go run …@latest, or curl -K/wget -e option files; see classifier/ for how it's measured). Shell writes to protected paths (.git/, .chanto/, .claude/ settings and hooks, .mcp.json, .husky/, .vscode/ settings and tasks) ask in every mode but bypass, as edits of them do, and so does a write whose target the shell computes ($var, $(…)). In auto mode, extracting an archive or applying a patch asks too.
• Always a human's call, in every mode but bypassPermissions: reading secret files (.env, keys, ~/.ssh, ~/.aws), writing files outside the project or ones that make git or Chanto run commands (.git/hooks, hooks config), turning the command sandbox off, and fetching cloud instance metadata, this machine's own services (localhost, 127.0.0.1, ::1) or local files outside the project. An allow rule you write still covers its case, for example WebFetch(domain:localhost) for your dev server.