Autonomy levels

The agent has three autonomy levels. You’re always in control of which one is active.

L1 — Suggest

The default. The agent can read files and reply in chat, but it can’t touch the filesystem or run commands. Use this when:

• You’re exploring an unfamiliar codebase.
• You want a code review, not a refactor.
• You’re paranoid (good).

L2 — Auto-edit

The agent can propose patches. Every patch shows up as a diff in the editor; nothing is written until you click Apply. You can stage patches one hunk at a time. Use this when:

• You trust the agent on a well-scoped task.
• You want to keep the conversation moving without manual copy-paste.

Auto-edit never:

• Deletes a file.
• Touches files outside the open folder.
• Modifies .env, .git/, or anything matching your .gitignore.

L3 — Agent

The agent can run terminal commands. You get a confirmation prompt for every command, and a one-click Always allow pytest for safe recurring ones. Use this when:

• You want a true “do this end-to-end” experience.
• The task involves multiple build / test cycles.

L3 will ask twice before:

• rm -rf, find -delete, or any pattern matching destructive shell.
• git push --force, git reset --hard, branch deletions.
• Any package install that touches the global Python / Node environment.

Dangerous commands are listed in core/agent/dangerous_commands.py in the repo — feel free to extend the list with project-specific rules.