Permission Modes

Every session runs in a permission mode that decides how much the agent can do without asking you first. claude has six modes and a keyboard shortcut to cycle them. codex uses a different system entirely — an approval policy crossed with a sandbox policy, changed through a slash command. kimi has its own modes, shown in its own status line. vord tracks all three, mostly so it can hand the mode to your iPhone and to Auto-Pilot’s plan-approval logic — it doesn’t add a mode picker of its own on the Mac.

The six claude modes

Mode	What it does	Risk
Default	Asks before every tool call that needs permission	none
Accept Edits	Auto-accepts file edits, still asks for other risky actions	none
Plan	Plans first, asks you to approve the plan before it acts	none
Auto	An auto-reviewer decides on tool calls without asking you	elevated
Bypass Permissions	Skips every permission prompt	elevated
Don’t Ask	Refuses any action that would otherwise need a prompt, instead of asking	none

The footer text at the bottom of the claude terminal shows which one is active — vord doesn’t render its own indicator on the Mac. Watch for bypass permissions on, auto mode on, accept edits on, plan mode on, or don't ask on in the CLI itself.

Caution

“Auto” and “Bypass Permissions” both let the agent act without asking you first. “Don’t Ask” sounds similar but does the opposite: it silently refuses anything that would need a prompt rather than approving it. It carries no elevated risk.

The “auto class”

vord treats Auto and Bypass Permissions as the same thing internally — an “auto class.” Which of the two actually sits in claude’s Shift+Tab cycle depends on your claude version: some versions cycle through auto, older ones through bypassPermissions. Since you can’t predict which one you’ll land on, anything that targets “the auto mode” (like the iPhone mode picker) accepts either as fulfilling that goal — a session in auto counts as having reached “Auto” even if you asked for bypassPermissions, and vice versa.

Why Don’t Ask is not a risk mode

Don't Ask looks like it belongs next to the two auto-class modes, but it’s the opposite of elevated risk: it auto-denies any tool call that would otherwise trigger a permission prompt, and only lets pre-approved tools run. Nothing gets waved through that wouldn’t already be allowed. It’s reachable only by starting claude with --permission-mode dontAsk — it never appears in the Shift+Tab cycle, so you won’t stumble into it by accident.

Switching modes

• claude: press Shift+Tab in the terminal to cycle through the modes (Default → Accept Edits → Plan → and onward into whichever mode your version puts in the ring next).
• codex: run the /permissions slash command, which opens codex’s own mode picker as a normal response box.

There’s no separate mode switcher inside vord’s UI on the Mac — you change modes the same way you would in a bare terminal. From your iPhone, though, a dedicated mode button does this for you — see Controlling Sessions from iPhone.

How vord tracks the mode

For claude, vord prefers the structured value claude’s hooks report (permissionMode — default, acceptEdits, plan, bypassPermissions, auto, or dontAsk) whenever the session is hooked in. If a session was started by hand in a plain shell without vord’s hook, there’s no structured signal, so vord falls back to reading the mode footer text directly from the terminal screen. That fallback is deliberately strict about the bare claude welcome screen: it only reports Default when an unambiguous claude footer (shift+tab to cycle or ? for shortcuts) is actually visible, never from the quiet greeting screen alone — otherwise a fresh session with no footer yet would falsely register as some mode.

If neither the hook nor a recognizable footer marker is present, vord reports no mode at all rather than guessing.

The mode survives a resume

A session remembers the mode it was last seen in and comes back in that same mode when you continue it — it doesn’t drop back to the agent’s default the way it used to. Set a session to Plan and close it, and it resumes in Plan; a session that was running in Accept Edits picks up in Accept Edits. vord does this by handing the remembered mode to the agent as a start-up flag (--permission-mode for claude, --sandbox for codex, --plan/--auto for kimi), so it works for sessions you started yourself, not just ones an agent spawned. See History & Resume for the resume flow itself.

Restoring never gives a session more than it had:

• A session vord never saw a mode for starts in the agent’s own default, exactly as before.
• A remembered mode that doesn’t apply to the agent being resumed is ignored rather than translated into something similar.
• For codex, only the sandbox comes back — not the approval policy, which vord doesn’t track. A resumed codex session may therefore ask you to approve things it waved through before. That’s the deliberate direction to err in.

Caution

For kimi, vord can only restore what it was able to see. The mode comes from kimi’s status-line prefix, which covers default, plan, and auto — but not yolo, which has no prefix vord recognizes. Switch a kimi session to yolo in the terminal and vord keeps the last mode it did recognize, then restores that on resume. What vord set itself when it started the session is always remembered correctly.

Codex approval policy × sandbox

codex doesn’t have permission modes in the claude sense. Instead it combines two independent settings from its rollout data — approval_policy and sandbox_policy.type — into three modes that its own /permissions picker shows by name:

codex mode	Sandbox	Risk
Read-only	Agent can read, not write or execute	none
Default	Can read/edit/run inside the working directory, asks outside it (codex’s default)	none
Full Access	Unrestricted machine and network access, no approval needed	elevated

vord labels these with codex’s own terminology rather than mapping them onto claude’s wording — a codex session in Full Access is not the same thing as claude’s Bypass Permissions, even though both carry the same elevated-risk warning color on your iPhone.

Note

codex has no Shift+Tab ring. Its mode only changes through /permissions, and vord’s automatic mode-cycling logic (used for the iPhone direct-select menu) is claude-only for that reason — see Claude vs. Codex.

On the iPhone, the current mode shows as an icon in the session’s special-keys row, with red for the elevated-risk modes (Bypass Permissions, Auto, codex Full Access, kimi auto), and a tap switches it — direct-pick for claude, single-step for codex and kimi. Full behavior in Controlling Sessions from iPhone. That’s a Pro feature; permission-mode tracking itself on the Mac carries no license gate.

Auto-Pilot’s plan-approval rule relies on this same tracked mode to confirm it’s looking at a genuine plan box before approving anything automatically — see Auto-Pilot for the safety model behind that.

kimi: tracked from its status line

kimi has its own mode concept (default / plan / auto / yolo), and its status line carries it as a prefix in front of the model name — plan K3 thinking: … or auto K3 thinking: …, with no prefix meaning the default. kimi’s hooks don’t report the mode, so that status line is the only source — and that’s exactly what vord parses. The mode shows on the iPhone with kimi’s own names (Manual approvals / Plan mode / Auto-approve), with the red warning tint on auto (kimi describes it as “fully autonomous, the agent will not ask questions”). There’s no mode pill on the Mac itself, same as the other agents.

kimi’s TUI toggles plan mode with Shift+Tab, so a tap on the iPhone’s mode key sends that keystroke — a single-step plan on/off toggle, not a direct-pick menu (kimi has no keyboard ring that reaches auto or yolo, so the claude-style picker stays claude-only). kimi’s /plan, /auto, and /yolo slash commands exist but aren’t used by the phone: kimi’s input box swallows text and Return sent in one write as a newline instead of submitting — the same paste-burst trap that shapes all of vord’s kimi keyboard delivery.

Related

• Deletion Protection — a separate system that keeps an agent from deleting files outside its own project, regardless of permission mode.