Working

Deciding what runs without asking

Four modes, from read-only to fully automatic, and how to answer a prompt so you only decide once.

By default, ContextCode asks before it runs a command or writes a file. You can move that dial in either direction, per project or everywhere.

The mode you're in always shows under the prompt box, so you never have to wonder.

The four modes

Mode	What happens
`plan`	Read-only. It can look at anything and propose anything, but writes and commands are refused.
`default`	Asks before writing files or running commands.
`auto`	Runs without asking, except for things your deny rules block and anything destructive.
`bypass`	Runs everything. Deny rules and the destructive-command floor still hold.

Switch with /permissions (or /approvals, the same thing):

Code

/permissions plan          read-only for this project
/permissions auto          trusted for this project
/permissions auto global   trusted everywhere

The choice is remembered per project.

Answering a prompt so you decide once

When a prompt appears, the key you press decides how far the answer reaches:

Key	Reach
`y`	Just this once
`n`	Deny, this once
`e`	Trust this kind of command, in this project
`g`	Trust this kind of command, everywhere
`b`	Auto-approve everything, in this project

e is the one to reach for. After a handful of e answers on a new project, the prompts mostly stop — and they stop for the right things rather than all things.

Writing the rules down

Prompt answers accumulate into your settings file. You can also write rules directly, in ~/.contextcode/settings.json for every project or <project>/.contextcode/settings.json for one:

JSON

{
  "permissions": {
    "mode": "default",
    "allow": ["run_bash(go *)", "run_bash(git *)"],
    "deny":  ["run_bash(sudo *)"]
  }
}

Deny always wins, in every mode.

Plan mode is genuinely read-only

/permissions plan is useful for more than caution. Point it at an unfamiliar repository and ask it to explain the architecture, and you know with certainty that nothing changed while it looked.

Agents ask too

A background agent that hits a permission boundary asks you through the same prompt queue, tagged with which agent is asking. You don't have to go looking for a blocked run — it comes to you.

If it doesn't work

It still asks about a command I approved. Approvals match a command shape, not a literal string. npm test approved won't cover npm run test:watch. Approve the broader shape with a rule like run_bash(npm *).

It refuses something even in bypass. Deny rules and the destructive-command floor apply in every mode — that's deliberate. Check your deny list.

I set auto but prompts came back. Modes are per project. A new project starts at default unless you set auto global.