How often the agent should stop to ask "are you sure?" depends entirely on what you're doing. LingCode ships three permission modes so you can match the consent level to the risk — and switch between them mid-conversation as the risk changes.
Every agentic tool has the same tension. Asking permission for every action is safe but exhausting — you end up clicking "yes" without reading, which is worse than not asking. Skipping permission entirely is fast but reckless — the agent gets a turn or two of unsupervised power, which is plenty of time to overwrite a config file or run the wrong shell command. The trick is that the right setting is different from moment to moment in the same session. Reviewing what the agent would do before letting it touch anything is the right setting at the start of a complex task. Letting it churn through ten edits without prompting is the right setting once you've established trust for that task.
LingCode addresses this with three named permission modes you switch between as needed, not a single global setting you have to pick correctly at install time. Default asks before destructive actions. acceptEdits auto-approves file edits but still prompts for shell, deletes, and external calls. Plan mode is read-only — the agent can think, analyze, and plan but cannot actually do anything until you exit plan mode.
The actual mechanism is a keyboard shortcut: Shift+Tab in the chat panel cycles through the three modes. Once you know which mode means what, this becomes a fluent gesture — you press Shift+Tab when the work shifts in risk level.
default — ask first, do secondIn default mode, the agent prompts before every destructive action. A file edit shows a diff and waits. A shell command shows the exact command and waits. A network call shows the URL and waits. Read-only actions (reading a file, running tests in non-interactive mode, querying the language server) don't prompt — those are free.
Use default when you don't yet know what the agent is going to do. The first turn of a new task. An unfamiliar repo. Whenever the prompt is vague and you want to see the plan before committing to it.
acceptEdits — flow mode for known workOnce you've watched the agent make a few correct edits and you're in flow on a known task — a series of similar refactors, applying the same lint fix across many files, working through a list of TODOs — default mode's "approve every edit" becomes friction. Switch to acceptEdits and file writes go through without prompting. Shell commands, deletions, network calls, and tool invocations that touch the world outside your filesystem still prompt.
This is the most common steady-state mode for active development. You stay alert for the prompts that matter (commands that could break things) while letting the small edits flow.
acceptEdits, edits to protected configuration files (.pbxproj, Info.plist, entitlements) are snapshotted before the write. If acceptEdits approves something you regret, see Undo bad AI edits.
plan — read-only, propose-onlyIn plan mode, every action that would modify state is blocked at the tool layer. The agent can read files, search the codebase, query symbols, run analysis — it can build a complete understanding of what to do — but it cannot write, exec, or call. The final output is a plan: a structured proposal of changes for you to review.
Use plan when the right thing to do isn't obvious yet and you want the agent's analysis without its hands on the keyboard. A migration whose ordering matters. A refactor that touches a system you don't know well. Any task where "let me think before I do" is the right discipline.
When the plan looks good, exit plan mode (Shift+Tab back to default or acceptEdits) and let the agent execute it.
With the chat panel focused, press Shift+Tab. The status bar at the bottom updates to show the new mode. Press again to cycle through: default → acceptEdits → plan → default.
The mode change applies from the next turn forward — the current turn finishes with whatever mode it started in. This matters: if you switch mid-tool-call, that call still goes through under the old mode. Switch before sending the next message.
plandefaultacceptEditsplan first, then default for the execution turnPlugin-installed hooks (PreToolUse, UserPromptSubmit, etc.) run regardless of permission mode. A PreToolUse hook that blocks a tool call blocks it in all three modes; acceptEdits doesn't override a hook that says no. This is intentional: hooks are an explicit policy you (or your project) decided on, and modes shouldn't be able to escape them.
So if you find a hook is getting in the way, the answer is to adjust the hook, not the mode.
tty, deny-all, and yolo for its three permission policies. They're conceptually different: the CLI modes are about "how do I get consent when there's no GUI" rather than "what does the agent gate by default." Same goal, different surface.