@lazyingart/agintiflow 0.20.94 → 0.20.109

package/README.md

@@ -24,6 +24,14 @@ Use the same agent workspace from Web or CLI, with DeepSeek/Venice/OpenAI routin
 
 The short version: run `aginti` inside a project, give it a task, inspect what it plans, see every tool call, resume later, and keep the outputs in your workspace.
 
+## Visual Preview
+
+The two screenshots below match the current website hero: terminal-first launch on the left, browser console visibility on the right.
+
+| CLI launch | Web console |
+| --- | --- |
+| <img src="./website/assets/screenshots/cli-launch.jpg" alt="AgInTiFlow CLI launch screen" width="480" /> | <img src="./website/assets/screenshots/web-console-conversation-run-output.jpg" alt="AgInTiFlow web console conversation and run output" width="480" /> |
+
 **Links**
 
 | Resource | URL |
@@ -35,8 +43,6 @@ The short version: run `aginti` inside a project, give it a task, inspect what i
 | Product positioning | [references/agintiflow-product-positioning.md](references/agintiflow-product-positioning.md) |
 | Full archived README reference | [references/notes/readme-full-reference-2026-05-05.md](references/notes/readme-full-reference-2026-05-05.md) |
 
-Screenshots are kept out of the README body so the start guide stays readable. View them on the website carousel or in [demos/](demos/) and [website/assets/screenshots/](website/assets/screenshots/).
-
 ## Why This Exists
 
 Most agent tools are either a chat box with hidden state or an expensive one-model loop. AgInTiFlow is built around a different philosophy:
@@ -128,6 +134,7 @@ aginti --language de
 | Use SCS only for complex work | `/scs auto` or `aginti --scs auto "task"` |
 | Work with AAPS workflows | `aginti aaps status`, `/aaps validate` |
 | Choose models | `/route`, `/model`, `/spare`, `/wrapper`, `/auxiliary model` |
+| Switch permissions | `-s safe`, `-s normal`, `-s danger`, or `/safe`, `/normal`, `/danger` |
 | Enable Venice shortcut | `/venice` |
 | Generate images | `/auxiliary image`, then ask for an image |
 | Resume current project | `aginti resume` |
@@ -155,7 +162,7 @@ aginti --resume <session-id> \
   "Take a fresh screenshot of the running app in the emulator, save it with a durable filename in this project, and keep git status clean."
 ```
 
-Permission behavior is intentionally consistent: writes inside the current project are allowed through file tools, workspace-local toolchain builds/probes can run when their command is narrowly classified, network/setup runs are normal in approved Docker workspace mode, and outside-project or trusted-host actions stop with a clear blocker plus a suggested rerun command. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
+Permission behavior is intentionally consistent. Use `-s safe` for read-first sessions that ask before writes/setup, `-s normal` for current-project writes plus Docker setup, and `-s danger` for trusted host/full-access work. Inside chat, `/safe`, `/normal`, and `/danger` switch the current session. When a blocked action appears, CLI and web can offer `No`, `Yes this time`, or `Yes and always for this session` instead of making the agent retry command variants. Android/Gradle builds can use safe local env assignments such as `ANDROID_HOME=... JAVA_HOME=... ./gradlew assembleDebug` and relative workspace logs without requiring whole-host destructive mode. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
 Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
 
@@ -165,20 +172,15 @@ Use these when you want explicit control instead of the default interactive poli
 
 | Mode | Command | What it permits |
 | --- | --- | --- |
-| Strict inspection | `aginti --sandbox-mode docker-readonly --package-install-policy block --allow-shell --no-file-tools --no-web-search "inspect this project without edits"` | Enforced read-only project inspection through shell commands such as `ls`, `rg`, `cat`, and test commands that do not write. No file-tool writes, web calls, workspace writes, or installs. |
-| Full write in current folder | `aginti --sandbox-mode docker-workspace --package-install-policy allow --approve-package-installs --allow-shell --allow-file-tools "build and test this project"` | Read/write inside the current project folder, run network/setup commands in Docker, keep host safer. |
-| Full host computer access | `aginti --sandbox-mode host --package-install-policy allow --approve-package-installs --allow-shell --allow-file-tools --allow-destructive "perform the trusted host maintenance task"` | Direct host shell and destructive actions. Use only when you trust the task and want whole-host access. Android emulator/device work often needs this because the SDK and emulator live on the host. |
+| Safe | `aginti -s safe "inspect this project and ask before edits"` | Docker read-only posture, package/setup approval required, and file-tool writes stop for approval. |
+| Normal | `aginti -s normal "build and test this project"` | Current-project file writes and Docker workspace package/setup are allowed; outside-project writes and host-system changes still stop. |
+| Danger | `aginti -s danger "perform the trusted host maintenance task"` | Trusted host mode with destructive shell, host installs, password typing, and outside-workspace file paths enabled. Hard secret/publish guards still protect obvious credential leaks. |
 
 For resume:
 
 ```bash
 aginti --resume <session-id> \
-  --sandbox-mode host \
-  --package-install-policy allow \
-  --approve-package-installs \
-  --allow-shell \
-  --allow-file-tools \
-  --allow-destructive \
+  -s danger \
   "continue with trusted host access"
 ```
 

package/docker/sandbox.Dockerfile

@@ -6,6 +6,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   bash \
   ca-certificates \
   curl \
+  file \
   findutils \
   gawk \
   git \

package/docs/runtime-modes-and-autonomy.md

@@ -27,6 +27,7 @@ Important boundary: host tmux tools are durable, but they are not a permission e
 
 Codex exposes these concerns as `--sandbox read-only|workspace-write|danger-full-access` and `--ask-for-approval untrusted|on-failure|on-request|never`. AgInTiFlow maps the same philosophy into:
 
+- `-s safe|normal|danger` and `/safe`, `/normal`, `/danger`
 - `--sandbox-mode host|docker-readonly|docker-workspace`
 - `--package-install-policy block|prompt|allow`
 - `--allow-shell|--no-shell`
@@ -50,8 +51,12 @@ The runtime must be consistent when an action is not permitted. A blocked action
 
 Current contract:
 
+- `safe` asks before file-tool writes and package/setup actions. It is the right mode for inspection, review, and cautious first passes.
+- `normal` allows writes inside the current project folder and package/setup inside Docker workspace mode. It still blocks outside-project writes and host-system changes until approved.
+- `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
+- Android/JVM toolchain commands may include safe local env assignments such as `ANDROID_HOME`, `ANDROID_SDK_ROOT`, `JAVA_HOME`, or `GRADLE_USER_HOME`, plus small workspace-local status-log redirects. Secret-like env vars and redirects outside the workspace remain blocked.
 - Workspace writes outside that folder, secret paths, `.git` internals, and dependency folders such as `node_modules` are blocked.
 - `git clone`, `git fetch`, `git pull --ff-only`, `git push`, `curl`, and `wget` are classified as network operations.
 - Network/setup commands are allowed in `docker-workspace` only when package installs are approved.
@@ -59,7 +64,7 @@ Current contract:
 - Destructive host shell/git operations need explicit trusted host mode.
 - Android SDK/emulator work commonly needs host mode because `adb`, emulator images, and device state live outside Docker; use trusted host mode for install/launch/screenshot steps when the user approves that host access.
 
-When a tool is blocked, the tool result includes `permissionAdvice` with three choices: refuse/stop, approve a safer rerun, or switch to a trusted host run. The model prompt requires the agent to present that blocker and avoid retrying variants until the user approves a path.
+When a tool is blocked, the tool result includes `permissionAdvice`. Interactive CLI and web runs present the same approval language: `No`, `Yes this time`, and `Yes and always for this session`. One-time approval temporarily escalates the active continuation; always switches the session to the suggested shortcut mode. The model prompt requires the agent to present that blocker and avoid retrying variants until the user approves a path.
 
 The common controlled rerun shape is:
 
@@ -77,30 +82,14 @@ aginti --resume <session-id> \
 Three practical permission recipes:
 
 ```bash
-# Strict inspection: enforced read-only shell inspection, no file-tool writes, no web, no installs.
-aginti --sandbox-mode docker-readonly \
-  --package-install-policy block \
-  --allow-shell \
-  --no-file-tools \
-  --no-web-search \
-  "inspect this project without edits"
+# Safe: read-first, ask before writes and setup.
+aginti -s safe "inspect this project without edits"
 
-# Full write in the current project folder, with setup commands isolated in Docker.
-aginti --sandbox-mode docker-workspace \
-  --package-install-policy allow \
-  --approve-package-installs \
-  --allow-shell \
-  --allow-file-tools \
-  "build and test this project"
+# Normal: write in the current project folder, setup isolated in Docker.
+aginti -s normal "build and test this project"
 
-# Full host computer access for trusted maintenance.
-aginti --sandbox-mode host \
-  --package-install-policy allow \
-  --approve-package-installs \
-  --allow-shell \
-  --allow-file-tools \
-  --allow-destructive \
-  "perform the trusted host maintenance task"
+# Danger: full trusted host access for maintenance or emulator/device work.
+aginti -s danger "perform the trusted host maintenance task"
 ```
 
 For host-only work, use the stricter trusted form deliberately:
@@ -108,12 +97,7 @@ For host-only work, use the stricter trusted form deliberately:
 ```bash
 aginti --resume <session-id> \
   --cwd /path/to/project \
-  --sandbox-mode host \
-  --package-install-policy allow \
-  --approve-package-installs \
-  --allow-shell \
-  --allow-file-tools \
-  --allow-destructive \
+  -s danger \
   "Continue after trusted host approval. Inspect first and keep unrelated files untouched."
 ```
 
@@ -130,7 +114,7 @@ This starts interactive chat with Docker workspace mode, file tools, shell tools
 Direct trusted host mode:
 
 ```bash
-aginti --sandbox-mode host --allow-shell --allow-destructive "fix this local service"
+aginti -s danger "fix this local service"
 ```
 
 Use this only when the task truly needs host access. The agent should inspect first, show risky commands, stop on ambiguity, and avoid secrets.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.94",
+  "version": "0.20.109",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",
@@ -61,6 +61,7 @@
     "scripts/smoke-inbox.js",
     "scripts/smoke-model-roles.js",
     "scripts/smoke-platform.js",
+    "scripts/smoke-permission-modes.js",
     "scripts/smoke-skills.js",
     "scripts/smoke-skillmesh.js",
     "scripts/smoke-tmux-tools.js",
@@ -92,13 +93,14 @@
     "smoke:inbox": "node scripts/smoke-inbox.js",
     "smoke:model-roles": "node scripts/smoke-model-roles.js",
     "smoke:platform": "node scripts/smoke-platform.js",
+    "smoke:permission-modes": "node scripts/smoke-permission-modes.js",
     "smoke:tmux-tools": "node scripts/smoke-tmux-tools.js",
     "smoke:web-api": "node scripts/smoke-web-api.js",
     "smoke:autoupdate": "node scripts/smoke-auto-update.js",
     "real:deepseek": "node scripts/real-deepseek-capabilities.js",
     "supervision:seed": "node scripts/seed-supervised-homework.js",
     "storage:migrate": "node bin/aginti-cli.js storage migrate",
-    "test": "npm run check && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:cli-chat && npm run smoke:inbox",
+    "test": "npm run check && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:coding-tools && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:tmux-tools && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },

package/public/app.js

@@ -57,6 +57,18 @@ const translations = {
     commandCwdLabel: "Working directory",
     maxStepsLabel: "Max steps",
     sandboxModeLabel: "Sandbox mode",
+    permissionModeLabel: "Permission shortcut",
+    permissionSafeOption: "Safe: ask before writes/setup",
+    permissionNormalOption: "Normal: project writes + Docker setup",
+    permissionDangerOption: "Danger: trusted host/full access",
+    permissionHintSafe: "Safe mode asks before workspace writes and package/setup actions.",
+    permissionHintNormal: "Normal mode allows current-project writes and package setup inside Docker; outside-project and host-system changes still stop for approval.",
+    permissionHintDanger: "Danger mode enables trusted host access, destructive commands, password typing, and outside-workspace file paths. Use only for tasks you trust.",
+    permissionApprovalTitle: "Permission approval",
+    permissionApprovalNo: "No",
+    permissionApprovalOnce: "Yes this time",
+    permissionApprovalAlways: "Yes and always",
+    permissionApprovalFailed: "Permission approval failed.",
     sandboxHostOption: "Host read-only",
     sandboxDockerReadonlyOption: "Docker read-only",
     sandboxDockerWorkspaceOption: "Docker workspace-write",
@@ -672,6 +684,8 @@ const setupApiKeyField = document.querySelector("#setup-api-key");
 const saveApiKeyButton = document.querySelector("#save-api-key");
 const setupStatusEl = document.querySelector("#setup-status");
 const taskProfileField = document.querySelector("#taskProfile");
+const permissionModeField = document.querySelector("#permissionMode");
+const permissionHintEl = document.querySelector("#permission-hint");
 const sandboxModeField = document.querySelector("#sandboxMode");
 const packageInstallPolicyField = document.querySelector("#packageInstallPolicy");
 const packageWarningEl = document.querySelector("#package-warning");
@@ -1218,6 +1232,60 @@ function updatePackageWarning() {
   packageWarningEl.textContent = t(key);
 }
 
+function permissionDefaults(mode = "normal") {
+  if (mode === "safe") {
+    return {
+      sandboxMode: "docker-readonly",
+      packageInstallPolicy: "prompt",
+      workspaceWritePolicy: "prompt",
+      allowPasswords: false,
+      allowDestructive: false,
+      allowOutsideWorkspaceFileTools: false,
+    };
+  }
+  if (mode === "danger") {
+    return {
+      sandboxMode: "host",
+      packageInstallPolicy: "allow",
+      workspaceWritePolicy: "allow",
+      allowPasswords: true,
+      allowDestructive: true,
+      allowOutsideWorkspaceFileTools: true,
+    };
+  }
+  return {
+    sandboxMode: "docker-workspace",
+    packageInstallPolicy: "allow",
+    workspaceWritePolicy: "allow",
+    allowPasswords: false,
+    allowDestructive: false,
+    allowOutsideWorkspaceFileTools: false,
+  };
+}
+
+function updatePermissionHint() {
+  if (!permissionHintEl || !permissionModeField) return;
+  const key =
+    permissionModeField.value === "safe"
+      ? "permissionHintSafe"
+      : permissionModeField.value === "danger"
+        ? "permissionHintDanger"
+        : "permissionHintNormal";
+  permissionHintEl.textContent = t(key);
+}
+
+function applyPermissionModeToForm(mode = permissionModeField?.value || "normal") {
+  const defaults = permissionDefaults(mode);
+  if (sandboxModeField) sandboxModeField.value = defaults.sandboxMode;
+  if (packageInstallPolicyField) packageInstallPolicyField.value = defaults.packageInstallPolicy;
+  const allowPasswordsField = document.querySelector("#allowPasswords");
+  const allowDestructiveField = document.querySelector("#allowDestructive");
+  if (allowPasswordsField) allowPasswordsField.checked = defaults.allowPasswords;
+  if (allowDestructiveField) allowDestructiveField.checked = defaults.allowDestructive;
+  updatePermissionHint();
+  updatePackageWarning();
+}
+
 function applyLanguage(language, { persist = true } = {}) {
   currentLanguage = normalizeLanguage(language);
   document.documentElement.lang = currentLanguage;
@@ -1244,6 +1312,7 @@ function applyLanguage(language, { persist = true } = {}) {
   renderWorkspacePanel();
   renderSandboxStatus();
   updateRoutingHint();
+  updatePermissionHint();
   updatePackageWarning();
   renderSessions(lastSessions);
   renderSessionManager();
@@ -1274,8 +1343,10 @@ function formPayload() {
     allowedDomains: document.querySelector("#allowedDomains").value.trim(),
     commandCwd: document.querySelector("#commandCwd").value.trim(),
     maxSteps: Number(document.querySelector("#maxSteps").value) || 24,
+    permissionMode: permissionModeField?.value || "normal",
     sandboxMode: sandboxModeField.value,
     packageInstallPolicy: packageInstallPolicyField.value,
+    workspaceWritePolicy: permissionDefaults(permissionModeField?.value || "normal").workspaceWritePolicy,
     headless: document.querySelector("#headless").checked,
     allowShellTool: document.querySelector("#allowShellTool").checked,
     allowFileTools: document.querySelector("#allowFileTools").checked,
@@ -1290,6 +1361,7 @@ function formPayload() {
     dockerSandboxImage: document.querySelector("#dockerSandboxImage").value.trim(),
     allowPasswords: document.querySelector("#allowPasswords").checked,
     allowDestructive: document.querySelector("#allowDestructive").checked,
+    allowOutsideWorkspaceFileTools: permissionDefaults(permissionModeField?.value || "normal").allowOutsideWorkspaceFileTools,
   };
 }
 
@@ -1326,6 +1398,33 @@ function renderCommandOutputLog(entry) {
   `;
 }
 
+function renderPermissionApproval(entry) {
+  const advice = entry.data?.permissionAdvice;
+  if (!advice) return "";
+  const summary = advice.summary || advice.reason || "Permission approval is required.";
+  const category = advice.category || entry.data?.category || "";
+  const suggested = advice.suggestedCommand
+    ? `<div class="log-fold-note"><strong>rerun:</strong> <code>${escapeHtml(advice.suggestedCommand)}</code></div>`
+    : "";
+  const trusted = advice.trustedHostCommand
+    ? `<div class="log-fold-note"><strong>host:</strong> <code>${escapeHtml(advice.trustedHostCommand)}</code></div>`
+    : "";
+  return `
+    <article class="permission-approval">
+      <strong>${escapeHtml(t("permissionApprovalTitle"))}</strong>
+      <p>${escapeHtml(summary)}</p>
+      <div class="subtle">${escapeHtml(category)}</div>
+      ${suggested}
+      ${trusted}
+      <div class="permission-actions">
+        <button type="button" class="mini-button danger" data-permission-action="no">${escapeHtml(t("permissionApprovalNo"))}</button>
+        <button type="button" class="mini-button" data-permission-action="once">${escapeHtml(t("permissionApprovalOnce"))}</button>
+        <button type="button" class="mini-button" data-permission-action="always">${escapeHtml(t("permissionApprovalAlways"))}</button>
+      </div>
+    </article>
+  `;
+}
+
 function renderLogs(run) {
   logsEl.dataset.mode = "active";
   const parts = [
@@ -1340,6 +1439,10 @@ function renderLogs(run) {
       continue;
     }
     parts.push(`<div class="log-line">${escapeHtml(`[${entry.at}] ${entry.kind}: ${entry.message}`)}</div>`);
+    if (entry.message === "tool.blocked" && entry.data?.permissionAdvice) {
+      parts.push(renderPermissionApproval(entry));
+      continue;
+    }
     if (entry.data && Object.keys(entry.data).length > 0) {
       parts.push(`<pre class="log-json">${escapeHtml(JSON.stringify(entry.data, null, 2))}</pre>`);
     }
@@ -2270,6 +2373,36 @@ async function stopCurrentRun() {
   await refreshRun();
 }
 
+async function approvePermission(action) {
+  if (!currentSessionId) return;
+  chatStatusEl.textContent = t("sendingStatus");
+  const response = await fetch(`/api/sessions/${encodeURIComponent(currentSessionId)}/approve-permission`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      ...formPayload(),
+      action,
+    }),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    chatStatusEl.textContent = data.error || t("permissionApprovalFailed");
+    return;
+  }
+  if (data.permissionMode && action === "always" && permissionModeField) {
+    permissionModeField.value = data.permissionMode;
+    applyPermissionModeToForm(data.permissionMode);
+  }
+  currentRunStatus = action === "no" ? currentRunStatus : "running";
+  chatStatusEl.textContent = action === "no" ? t("permissionApprovalNo") : t("runningStatus");
+  updateStopRunButton();
+  await refreshRun();
+  if (action !== "no") {
+    if (pollTimer) clearInterval(pollTimer);
+    pollTimer = setInterval(refreshRun, 1500);
+  }
+}
+
 async function refreshChat() {
   if (!currentSessionId) {
     pendingInboxItems = [];
@@ -2595,6 +2728,10 @@ modelField.addEventListener("change", updateRoutingHint);
   });
 sandboxModeField.addEventListener("change", updatePackageWarning);
 packageInstallPolicyField.addEventListener("change", updatePackageWarning);
+permissionModeField?.addEventListener("change", () => {
+  applyPermissionModeToForm(permissionModeField.value);
+  schedulePreferenceSave();
+});
 allowWrapperToolsField.addEventListener("change", () => renderWrapperStatus());
 preferredWrapperField.addEventListener("change", () => renderWrapperStatus());
 taskProfileField?.addEventListener("change", () => {
@@ -2687,6 +2824,14 @@ stopRunButton?.addEventListener("click", () => {
   });
 });
 
+logsEl?.addEventListener("click", (event) => {
+  const button = event.target.closest("[data-permission-action]");
+  if (!button) return;
+  approvePermission(button.dataset.permissionAction || "no").catch((error) => {
+    chatStatusEl.textContent = error instanceof Error ? error.message : String(error);
+  });
+});
+
 window.addEventListener("keydown", (event) => {
   if (event.key !== "Escape" || currentRunStatus !== "running") return;
   const tag = event.target?.tagName?.toLowerCase();
@@ -2870,6 +3015,7 @@ async function loadConfig() {
   document.querySelector("#commandCwd").value = prefs.commandCwd || data.project?.root || "";
   document.querySelector("#headless").checked = prefs.headless ?? data.defaults.headless;
   document.querySelector("#maxSteps").value = prefs.maxSteps ?? data.defaults.maxSteps;
+  if (permissionModeField) permissionModeField.value = prefs.permissionMode || "normal";
   sandboxModeField.value = prefs.sandboxMode || (prefs.useDockerSandbox ? "docker-workspace" : "host");
   packageInstallPolicyField.value = prefs.packageInstallPolicy || "allow";
   document.querySelector("#allowShellTool").checked = prefs.allowShellTool ?? true;
@@ -2891,6 +3037,7 @@ async function loadConfig() {
   await refreshWorkspaceChanges();
   renderSandboxLogs(data.sandbox?.logs || []);
   updateRoutingHint();
+  updatePermissionHint();
   updatePackageWarning();
 
   renderSessions(data.sessions || []);

package/public/index.html

@@ -154,6 +154,16 @@
           </div>
           <p id="package-warning" class="subtle package-warning"></p>
 
+          <label>
+            <span data-i18n="permissionModeLabel">Permission shortcut</span>
+            <select id="permissionMode" name="permissionMode">
+              <option value="safe" data-i18n="permissionSafeOption">Safe: ask before writes/setup</option>
+              <option value="normal" data-i18n="permissionNormalOption">Normal: project writes + Docker setup</option>
+              <option value="danger" data-i18n="permissionDangerOption">Danger: trusted host/full access</option>
+            </select>
+          </label>
+          <p id="permission-hint" class="subtle route-hint"></p>
+
           <div class="grid">
             <label>
               <span data-i18n="sandboxModeLabel">Sandbox mode</span>

package/public/styles.css

@@ -875,6 +875,26 @@ button.danger {
   background: rgba(255, 255, 255, 0.06);
 }
 
+.permission-approval {
+  margin: 8px 0 14px;
+  padding: 12px;
+  border: 1px solid rgba(251, 146, 60, 0.42);
+  border-radius: 14px;
+  background: rgba(124, 45, 18, 0.22);
+  color: #ffedd5;
+}
+
+.permission-approval p {
+  margin: 6px 0;
+}
+
+.permission-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 10px;
+}
+
 .log-stream-title,
 .log-fold-note {
   padding: 0 12px 8px;

package/scripts/smoke-cli-chat.js

@@ -64,7 +64,7 @@ function cellWidth(value = "") {
 }
 
 function runChat(inputText) {
-  return runCli(["chat", "--provider", "mock", "--routing", "manual", "--profile", "code"], inputText);
+  return runCli(["chat", "--provider", "mock", "--routing", "manual", "--profile", "code", "--headless"], inputText);
 }
 
 function runCli(args, inputText) {
@@ -163,6 +163,7 @@ try {
       "| Check | Result |",
       "| --- | --- |",
       "| `/.dockerenv` | **Present** |",
+      "| `data_helper_report.md` | **Found** |",
       "| Hostname | `abc123` |",
     ].join("\n")
   );
@@ -175,6 +176,9 @@ try {
   if ((renderedMarkdown.match(/Present/g) || []).length !== 1) {
     throw new Error("terminal markdown renderer duplicated table rows");
   }
+  if (!renderedMarkdown.includes("data_helper_report.md")) {
+    throw new Error("terminal markdown renderer corrupted underscores in table cell literals");
+  }
   const renderedMarkdownFence = stripMarkdown(
     [
       "```markdown",
@@ -382,6 +386,14 @@ try {
   if (scsAutoArgs.enableScs !== "auto" || scsAutoArgs.goal !== "fix this project") {
     throw new Error("--scs auto should consume auto and preserve the task");
   }
+  const unknownOptionArgs = parseArgs(["--provider", "mock", "--allow-web-search", "research this"]);
+  if (unknownOptionArgs.unknownOptions[0] !== "--allow-web-search" || unknownOptionArgs.goal !== "research this") {
+    throw new Error("unknown option-like arguments before the prompt should be reported, not silently folded into the goal");
+  }
+  const dashedPromptArgs = parseArgs(["--provider", "mock", "--", "--allow-web-search should be prompt text"]);
+  if (dashedPromptArgs.unknownOptions.length || dashedPromptArgs.goal !== "--allow-web-search should be prompt text") {
+    throw new Error("explicit -- delimiter should allow prompt text that starts with a dash");
+  }
   const resumeAfterOptions = parseResumeCommandArgs([
     "web-agent-smoke",
     "--provider",
@@ -412,6 +424,10 @@ try {
   ) {
     throw new Error("resume subcommand should preserve explicit prompt text after --");
   }
+  const resumeUnknownOption = parseResumeCommandArgs(["web-agent-smoke", "--allow-web-search", "continue research"]);
+  if (resumeUnknownOption.unknownOptions[0] !== "--allow-web-search" || resumeUnknownOption.prompt !== "continue research") {
+    throw new Error("resume subcommand should report unknown option-like arguments before prompt text");
+  }
   const leadingResume = splitResumeCommandArgv(["--provider", "mock", "--routing", "manual", "resume", "latest"]);
   if (
     !leadingResume ||
@@ -440,6 +456,7 @@ try {
     !helpResult.stdout.includes("/auxiliary") ||
     !helpResult.stdout.includes("/review") ||
     !helpResult.stdout.includes("/scs") ||
+    !helpResult.stdout.includes("/safe") ||
     helpResult.stdout.includes("helpReview") ||
     helpResult.stdout.includes("helpRename") ||
     helpResult.stdout.includes("/enable" + "ss") ||
@@ -480,6 +497,18 @@ try {
   if (!scsAutoResult.stdout.includes("scs=auto")) {
     throw new Error("interactive /scs auto did not enable auto mode");
   }
+  const safeResult = await runChat("/safe\n");
+  if (!safeResult.stdout.includes("permission=safe") || !safeResult.stdout.includes("writePolicy=prompt")) {
+    throw new Error("interactive /safe did not switch to safe permission mode");
+  }
+  const normalResult = await runChat("/normal\n");
+  if (!normalResult.stdout.includes("permission=normal") || !normalResult.stdout.includes("sandbox=docker-workspace")) {
+    throw new Error("interactive /normal did not switch to normal permission mode");
+  }
+  const dangerResult = await runChat("/danger\n");
+  if (!dangerResult.stdout.includes("permission=danger") || !dangerResult.stdout.includes("sandbox=host")) {
+    throw new Error("interactive /danger did not switch to danger permission mode");
+  }
   const abbreviatedSkillsResult = await runChat("/sk website\n/ex\n");
   if (abbreviatedSkillsResult.stdout.includes("Unknown command") || !abbreviatedSkillsResult.stdout.includes("website-app")) {
     throw new Error("interactive slash command prefix did not auto-select the first matching command");
@@ -558,6 +587,7 @@ try {
           "skills-command",
           "review-command",
           "scs-command-toggle",
+          "permission-mode-slash-commands",
           "resume-command-options",
           "slash-prefix-autoselect",
           "slash-prefix-canonical-history",