Permissions#
Modes plan | ask | accept-edits | auto | yolo, over Tool(pattern) rules
loaded from global, project and local settings. decide() is pure — rules and a
request in, a decision out — so the policy is tested without a terminal.
Order is the policy, and it is deliberately not "most specific wins":
- A matching deny rule refuses. No mode and no allow rule overrides it.
- Read-only tools never prompt.
planrefuses every mutating tool.- A write outside cwd prompts whatever the rules say, in every mode but yolo.
yoloallows.- A matching ask rule prompts even where an allow rule would match.
- A matching allow rule allows.
- Otherwise the mode decides.
Rules from the three scopes are concatenated rather than shadowing one another: a scoped override would let a project's checked-in settings remove a deny rule the user set globally.
Command patterns match every segment of a chained command. Without that,
Bash(npm run *) would allow npm run build && rm -rf ~.
Choose a mode#
| Mode | Default behavior |
|---|---|
plan | Refuse mutating tools; inspect and plan only |
ask | Prompt for mutating actions without an allow rule |
accept-edits | Allow file edits in the working directory; commands and network still prompt |
auto | Allow actions unless rules or an outside-directory write require otherwise |
yolo | Allow without prompts; explicit deny rules still win |
earshot --permission-mode askReview the real action#
A terminal permission prompt shows the actual command or complete diff. Choose Allow once, persist an exact tool/target rule for the project, or Deny and tell the agent why. Escape denies. A saved rule does not become a wildcard.
Files do not approve themselves#
Skills may narrow tools. Hooks may deny or downgrade an allow to a prompt. MCP read-only hints are displayed but never trusted as authority. Project MCP processes and in-process extensions stay inert until explicitly trusted. See MCP, hooks, and extensions.