Permission modes
ask, plan, and agent, and the guardrails shared by all three.
Each mode maps to a specific set of allowed tools. The same mapping applies whether you're in a single-shot run or an interactive chat.
| Mode | Can edit / run? | Best for |
|---|---|---|
| ask | No, read-only | Quick answers and exploration |
| plan | No, proposes a plan only | Reviewing an approach before acting |
| agent | Yes, reads, edits, and runs commands | Getting work done |
ask
Read-only. CodeBrew explores and answers questions, but never changes files. Tools allowed: Read, Glob, Grep, WebSearch, WebFetch. Edit, Write, and Bash are blocked.
plan
Proposes a plan only, no changes. CodeBrew explores with the same read-only toolset as ask, then lays out what it would do without touching anything.
agent
Full access. CodeBrew can read, edit, and write files, and run commands. Tools allowed: Read, Edit, Write, Bash, Glob, Grep.
Shared guardrails
Every mode applies the same session limits, regardless of how much access it grants:
- maxTurns: 25, stops runaway loops
- maxBudgetUsd: 1.0, caps spend per session
- effort: medium, balances speed and depth
Inside a chat session, /mode agent|ask|plan switches the live permission mode instantly, no restart required.