command-code 1.58.1 → 1.60.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/dist/bundled/command-code-knowledge/reference/custom-agents.md +2 -2
  3. package/dist/bundled/command-code-knowledge/reference/custom-slash-commands.md +6 -6
  4. package/dist/bundled/command-code-knowledge/reference/headless.md +2 -2
  5. package/dist/bundled/command-code-knowledge/reference/models.md +2 -0
  6. package/dist/bundled/command-code-knowledge/reference/permissions.md +52 -50
  7. package/dist/bundled/command-code-knowledge/reference/plan-mode.md +19 -19
  8. package/dist/bundled/command-code-knowledge/reference/product-help.md +7 -5
  9. package/dist/bundled/command-code-knowledge/reference/tools.md +6 -6
  10. package/dist/cli.mjs +5 -5
  11. package/package.json +1 -1
  12. package/vsix/commandcode-vscode.vsix +0 -0
package/CHANGELOG.md CHANGED
@@ -1,5 +1,18 @@
1
1
  # command-code
2
2
 
3
+ ## 1.60.0
4
+
5
+ ### Minor Changes
6
+
7
+ - feat: add Step 5 Preview
8
+
9
+ ## 1.59.0
10
+
11
+ ### Minor Changes
12
+
13
+ - feat: add Grok 4.7
14
+ - feat: shift+tab cycles into yolo everywhere, auto-accept is now accept edits
15
+
3
16
  ## 1.58.1
4
17
 
5
18
  ### Patch Changes
package/dist/bundled/command-code-knowledge/reference/custom-agents.md CHANGED
@@ -242,7 +242,7 @@ Only these keys are read; anything else is ignored. All except `name` are option
242
242
  | `model` | `string` | No | inherit | Any `/model` id. Omit or set `inherit` to follow the session model. |
243
243
  | `reasoningEffort` | `string` | No | model default | Reasoning level the pinned model supports; an unsupported level falls back to the model default. |
244
244
  | `maxTurns` | `integer` | No | `100` | Caps the agent's loop. |
245
- | `permissionMode` | `string` | No | inherit | Overrides the session mode: `default`, `auto-accept`, `bypass`, `plan`, `dont-ask`. A session already in `plan`/`bypass` wins. |
245
+ | `permissionMode` | `string` | No | inherit | Overrides the session mode: `default`, `accept-edits`, `yolo`, `plan`, `dont-ask` (`auto-accept` and `bypass` accepted as aliases). A session already in `plan`/`yolo` wins. |
246
246
  | `background` | `boolean` | No | `false` | `true` detaches every run: the `agent` tool returns an `agent_id`; results come from `agent_output`. |
247
247
  | `showOutput` | `boolean` | No | `false` | `true` shows the agent's final message verbatim in the feed instead of a short "done" line. |
248
248
 
@@ -304,7 +304,7 @@ disallowedTools: shell_command, write_file # …except shells and file writes
304
304
  model: claude-opus-4-8 # any /model id, or omit to inherit
305
305
  reasoningEffort: high # a level THIS model supports (varies by model); omit for default
306
306
  maxTurns: 40 # cap the loop (default 100)
307
- permissionMode: plan # default|auto-accept|bypass|plan|dont-ask
307
+ permissionMode: plan # default|accept-edits|yolo|plan|dont-ask
308
308
  background: true # detach; collect via agent_output
309
309
  showOutput: true # render the final report in the feed
310
310
  ---
package/dist/bundled/command-code-knowledge/reference/custom-slash-commands.md CHANGED
@@ -53,9 +53,9 @@ Every built-in command, grouped by area. Aliases are shown in parentheses on the
53
53
 
54
54
  | **Command** | **Description** |
55
55
  | ------------------------------------ | ---------------------------------------------------------------------------------- |
56
- | `/mode [default\|auto-accept\|plan]` | Show or switch the permission mode; bare `/mode` prints the current mode |
56
+ | `/mode [default\|accept-edits\|plan]` | Show or switch the permission mode; bare `/mode` prints the current mode |
57
57
  | `/mode:default` | Switch to default mode (prompt before edits/commands) |
58
- | `/mode:auto-accept` | Switch to auto-accept mode (accept edits automatically) |
58
+ | `/mode:accept-edits` | Switch to accept edits mode (accept edits automatically) |
59
59
  | `/mode:plan` | Switch to plan mode (read-only, no side effects) |
60
60
  | `/plan [task]` | Enter plan mode; `/plan <task>` plans that task |
61
61
  | `/plans [name]` | Browse, review, and annotate saved plans; bare `/plans` opens the browser |
@@ -67,9 +67,9 @@ Every built-in command, grouped by area. Aliases are shown in parentheses on the
67
67
 
68
68
  Yolo (bypass permissions) mode is deliberately **not** switchable via
69
69
  `/mode` - slash commands are agent-invokable, so a mid-session route into
70
- bypass would let the model disable its own permission prompts. It is only
71
- reachable through the explicit `--yolo` launch flag, which also adds it to
72
- the shift+tab mode cycle.
70
+ permission bypass would let the model disable its own permission prompts. It is
71
+ reachable through the shift+tab mode cycle, or the explicit `--yolo` launch
72
+ flag to start a session directly in it.
73
73
 
74
74
  ### Models & providers
75
75
 
@@ -133,7 +133,7 @@ Every built-in command, grouped by area. Aliases are shown in parentheses on the
133
133
 
134
134
  ### Bare invocations that open a picker
135
135
 
136
- `/model`, `/effort`, and `/theme` each take an optional value (`/model gpt-5`, `/effort high`, `/theme dark`) that applies directly as a one-shot. But unlike other optional-value commands, running them **bare** doesn't perform a default action - it opens an interactive picker immediately. Bare `/mode` also runs immediately, printing the current mode and the available switches (`/mode:default`, `/mode:auto-accept`, `/mode:plan` - or press shift+tab to cycle).
136
+ `/model`, `/effort`, and `/theme` each take an optional value (`/model gpt-5`, `/effort high`, `/theme dark`) that applies directly as a one-shot. But unlike other optional-value commands, running them **bare** doesn't perform a default action - it opens an interactive picker immediately. Bare `/mode` also runs immediately, printing the current mode and the available switches (`/mode:default`, `/mode:accept-edits`, `/mode:plan` - or press shift+tab to cycle).
137
137
 
138
138
  `/effort` only opens its selector when the current model supports reasoning effort levels; otherwise it prints a notice that effort isn't supported for that model.
139
139
 
package/dist/bundled/command-code-knowledge/reference/headless.md CHANGED
@@ -264,11 +264,11 @@ Flags useful for headless and automated workflows:
264
264
  | `--theme <theme>` | Set the color theme (`dark`, `light`, or `auto` to match the terminal background) |
265
265
  | `--config <key=value>` | Set any setting headlessly (repeatable) - see below |
266
266
  | `--yolo` | Allow file writes and shell commands |
267
- | `--auto-accept` | Start in auto-accept mode (alias for `--permission-mode auto-accept`) |
267
+ | `--accept-edits` | Start in accept edits mode (alias for `--permission-mode accept-edits`) |
268
268
  | `--skip-onboarding` | Skip taste onboarding (for CI/automated runs) |
269
269
  | `-t, --trust` | Auto-trust project (skip initial permission prompt) |
270
270
  | `--plan` | Start in plan mode (read-only exploration) |
271
- | `--permission-mode <mode>` | Set permission mode: `standard`, `plan`, `auto-accept` |
271
+ | `--permission-mode <mode>` | Set permission mode: `standard`, `plan`, `accept-edits`, `yolo` |
272
272
 
273
273
  ---
274
274
 
package/dist/bundled/command-code-knowledge/reference/models.md CHANGED
@@ -41,6 +41,7 @@ The model catalog — every id `/model`, `--model`, `model:effort` shorthand, an
41
41
  | `Qwen/Qwen3.6-Max-Preview` | Qwen 3.6 Max Preview | — | — | $1.3/$7.8 · cache $0.26 (write $1.63) | Go and above | vibe coding & efficient agent execution |
42
42
  | `Qwen/Qwen3.6-Plus` | Qwen 3.6 Plus | — | — | $0.5/$3 · cache $0.1 | Go and above | agentic coding & reasoning |
43
43
  | `meituan/LongCat-2.0` | LongCat 2.0 | 1.05M | — | $0.3/$1.2 · cache $0.006 | Go and above | trillion-parameter agentic coding with 1M context |
44
+ | `stepfun/Step-5-Preview` | Step 5 Preview | 1M | low, medium, high | $1/$2.7 · cache $0.05 | Go and above | 600B sparse-MoE agentic coding with 1M context |
44
45
  | `stepfun/Step-3.7-Flash` | Step 3.7 Flash | 256K | — | $0.2/$1.15 · cache $0.04 | Go and above | multimodal sparse-MoE reasoning |
45
46
  | `stepfun/Step-3.5-Flash` | Step 3.5 Flash | 1M | — | $0.1/$0.3 · cache $0.02 | Go and above | fast sparse-MoE agentic reasoning |
46
47
  | `tencent/hy3-paid` | Tencent Hy3 | 262K | — | $0.14/$0.58 · cache $0.035 | Go and above | sparse-MoE reasoning & agentic tool use |
@@ -104,5 +105,6 @@ The model catalog — every id `/model`, `--model`, `model:effort` shorthand, an
104
105
  |---|---|---|---|---|---|---|
105
106
  | `xai/grok-4.5` | Grok 4.5 | 500K | low, medium, high | $2/$6 · cache $0.5 | Go and above | smartest model for coding, agentic tasks, knowledge work |
106
107
  | `xai/grok-4.6` | Grok 4.6 | 500K | low, medium, high, xhigh | $2/$6 · cache $0.5 | GOAT and above | frontier performance on coding, knowledge work, and STEM |
108
+ | `xai/grok-4.7` | Grok 4.7 | 500K | low, medium, high, xhigh | $2/$6 · cache $0.5 | GOAT and above | coding and knowledge work, built for multi-hour tasks |
107
109
 
108
110
  Rates are the advertised price list resolved from the billing source of truth (promos are already baked in): input / output / cache-read per 1M tokens, plus cache-write where the provider bills it. Min plan is the cheapest public plan that serves the model, ordered Go < GOAT < Pro < Max (see plans.md). Models without an effort column entry decide their own reasoning depth. Full pricing detail: https://commandcode.ai/docs/resources/pricing-limits
package/dist/bundled/command-code-knowledge/reference/permissions.md CHANGED
@@ -23,11 +23,13 @@ The mode and the flag that turns it on are different names - so both columns:
23
23
  | Mode | How to set it | In one line |
24
24
  | :--- | :--- | :--- |
25
25
  | `default` | the default; `/mode:default`, shift+tab | Prompt before anything that changes things. Reads are free. |
26
- | `auto-accept` | `/mode:auto-accept`, shift+tab, `--auto-accept` | Do normal edits (and safe file commands) without asking. |
26
+ | `accept-edits` | `/mode:accept-edits`, shift+tab, `--accept-edits` | Do normal edits (and safe file commands) without asking. |
27
27
  | `plan` | `/mode:plan`, shift+tab, `--plan` | Read-only. Explore and plan; only the plan file may be written. |
28
- | `bypass` | `--yolo` / `--dangerously-skip-permissions` (launch only) | Do basically everything without asking. |
28
+ | `yolo` | shift+tab, or `--yolo` / `--dangerously-skip-permissions` to start in it | Permission bypass: do basically everything without asking. |
29
29
  | `dont-ask` | `"defaultMode": "dont-ask"` in settings, or `--permission-mode dont-ask` | Never ask. Run what's pre-approved; deny the rest. The CI/CD mode. |
30
30
 
31
+ `auto-accept` and `bypass` are accepted aliases for `accept-edits` and `yolo` wherever a mode name is typed (settings, flags, `/mode`).
32
+
31
33
  **2. Three rule lists tune it.** Order: `deny` wins, then `ask`, then `allow`.
32
34
 
33
35
  ```json {{ title: '.commandcode/settings.json' }}
@@ -42,7 +44,7 @@ The mode and the flag that turns it on are different names - so both columns:
42
44
 
43
45
  **3. Some things never prompt.** Reads and read-only shell (`ls`, `cat`, `git status`), plus the control-flow tools `ask_user_question`, `agent`, and `run_command`.
44
46
 
45
- **deny beats ask beats allow, in every mode.** A mode only decides calls the rules leave unresolved. `bypass` still can't run past a `deny` rule, an `ask` rule, or the root/home delete breaker.
47
+ **deny beats ask beats allow, in every mode.** A mode only decides calls the rules leave unresolved. `yolo` still can't run past a `deny` rule, an `ask` rule, or the root/home delete breaker.
46
48
 
47
49
  ---
48
50
 
@@ -116,37 +118,37 @@ A mode sets the baseline. Cycle with **shift+tab**, or switch with **`/mode`**.
116
118
  | Mode | Meaning |
117
119
  | :------------ | :------------------------------------------------------------------------------------------------ |
118
120
  | `default` | Prompt for anything mutating; reads are free. |
119
- | `auto-accept` | Do normal workspace edits (and safe filesystem shell: `mkdir`, `touch`, `cp`, `mv`, non-recursive `rm`, `rmdir`, `sed`) without asking. Does **not** auto-accept arbitrary shell, MCP tools, or recursive deletes. |
121
+ | `accept-edits` | Do normal workspace edits (and safe filesystem shell: `mkdir`, `touch`, `cp`, `mv`, non-recursive `rm`, `rmdir`, `sed`) without asking. Does **not** auto-accept arbitrary shell, MCP tools, or recursive deletes. |
120
122
  | `plan` | Read-only exploration. Reads, searches, and read-only shell (`git status`) run; only the plan file may be written. |
121
- | `bypass` | Do basically everything without asking. Deny rules, explicit ask rules, and the root/home removal breaker still apply. Enter with `--yolo` / `--dangerously-skip-permissions`; throwaway environments only. |
122
- | `dont-ask` | Never ask. Run only what policy already allows (reads, read-only shell, `allow` rules); **deny** the rest. The mirror of bypass: for unattended runs where a wrong prompt should fail, not wait. |
123
+ | `yolo` | Permission bypass: do basically everything without asking. Deny rules, explicit ask rules, and the root/home removal breaker still apply. Enter with shift+tab, or `--yolo` / `--dangerously-skip-permissions` to start in it; throwaway environments only. |
124
+ | `dont-ask` | Never ask. Run only what policy already allows (reads, read-only shell, `allow` rules); **deny** the rest. The mirror of yolo: for unattended runs where a wrong prompt should fail, not wait. |
123
125
 
124
- Aliases: `manual` → `default`, `acceptEdits` → `auto-accept`, `dontAsk` → `dont-ask`, `bypassPermissions` → `bypass`. Legacy `standard` also maps to `default`.
126
+ Aliases: `auto-accept` → `accept-edits`, `bypass` → `yolo`. Claude Code's spellings work too: `manual` → `default`, `acceptEdits` → `accept-edits`, `dontAsk` → `dont-ask`, `bypassPermissions` → `yolo`. Legacy `standard` also maps to `default`.
125
127
 
126
128
  ### Switching modes
127
129
 
128
130
  Three ways, mid-session:
129
131
 
130
- - **shift+tab** cycles `default` → `auto-accept` → `plan` → `default`. Launched with `--yolo`, `bypass` joins as a fourth rung after `plan`. (`alt+m` is an equivalent binding for terminals that swallow shift+tab.) `dont-ask` isn't a rung - set it via settings or CLI; shift+tab from it re-enters the cycle at `auto-accept`.
131
- - **`/mode`** shows the current mode; **`/mode:default`**, **`/mode:auto-accept`**, **`/mode:plan`** (or `/mode <name>`, any spelling) switch directly. Bypass is deliberately **not** slash-switchable - slash commands are agent-invokable, so a mid-session route into bypass would let the model kill its own prompts. `/mode:yolo` is gone; the command says "launch with `--yolo`."
132
+ - **shift+tab** cycles `default` → `accept-edits` → `plan` → `yolo` → `default`. (`alt+m` is an equivalent binding for terminals that swallow shift+tab.) `--yolo` also starts a session directly in `yolo`. `dont-ask` isn't a rung - set it via settings or CLI; shift+tab from it re-enters the cycle at `accept-edits`.
133
+ - **`/mode`** shows the current mode; **`/mode:default`**, **`/mode:accept-edits`**, **`/mode:plan`** (or `/mode <name>`, any spelling) switch directly. Yolo is deliberately **not** slash-switchable - slash commands are agent-invokable, so a mid-session route into permission bypass would let the model kill its own prompts. `/mode yolo` answers with "press shift+tab to cycle into it, or launch with `--yolo`."
132
134
  - **CLI flags** pick the start mode:
133
135
 
134
136
  ```bash {{ title: 'Terminal' }}
135
- cmd --permission-mode auto-accept # default | standard | plan | auto-accept | dont-ask
136
- cmd --auto-accept # shorthand for --permission-mode auto-accept
137
+ cmd --permission-mode accept-edits # default | standard | plan | accept-edits | yolo | dont-ask
138
+ cmd --accept-edits # shorthand for --permission-mode accept-edits
137
139
  cmd --plan # start in plan mode
138
- cmd --yolo # bypass - alias for --dangerously-skip-permissions; use with care
140
+ cmd --yolo # yolo (permission bypass) - alias for --dangerously-skip-permissions; use with care
139
141
  ```
140
142
 
141
- `--permission-mode` wins over `--plan`. Bypass has no `--permission-mode` value - it's **launch-flag-only** (`--yolo` / `--dangerously-skip-permissions`).
143
+ `--permission-mode` wins over `--plan`. `--permission-mode yolo` starts in permission bypass, same as `--yolo` / `--dangerously-skip-permissions`; the `disableBypass` kill switch covers all three.
142
144
 
143
- A mode switch also answers a prompt already on screen: `auto-accept` or `bypass` **approves** it (you said "stop asking"); `plan` **denies** it. A safety-forced prompt - destructive command, sensitive file, explicit `ask` rule - is never answered this way; it stays put for an explicit yes/no.
145
+ A mode switch also answers a prompt already on screen: `accept-edits` or `yolo` **approves** it (you said "stop asking"); `plan` **denies** it. A safety-forced prompt - destructive command, sensitive file, explicit `ask` rule - is never answered this way; it stays put for an explicit yes/no.
144
146
 
145
147
  ---
146
148
 
147
149
  ## Writing rules
148
150
 
149
- Three lists under `permissions`, checked in order: **deny** (always wins) → **ask** (always prompts, even in bypass; denies in dont-ask) → **allow**. Three tools skip the lists: `ask_user_question` (its UI is the interaction), `agent` (delegation has no side effect), and `run_command` (it just dispatches a slash command you named). Tools a sub-agent calls are still gated.
151
+ Three lists under `permissions`, checked in order: **deny** (always wins) → **ask** (always prompts, even in yolo; denies in dont-ask) → **allow**. Three tools skip the lists: `ask_user_question` (its UI is the interaction), `agent` (delegation has no side effect), and `run_command` (it just dispatches a slash command you named). Tools a sub-agent calls are still gated.
150
152
 
151
153
  A rule is a tool name, optionally with a specifier:
152
154
 
@@ -255,7 +257,7 @@ The `agent` tool is always allowed and never prompts. A sub-agent runs the **sam
255
257
 
256
258
  Every prompt offers three choices: allow once, allow **and remember**, or deny with feedback. The remembered scope matches the subject:
257
259
 
258
- - **File ops** - *"Yes, allow all edits this session"* turns on auto-accept for the session (same as shift+tab).
260
+ - **File ops** - *"Yes, allow all edits this session"* turns on accept edits for the session (same as shift+tab).
259
261
  - **Shell** - *"Yes, don't ask again for `git` commands in this project"* persists a `Shell(git:*)` allow rule to project settings. For a compound command, one rule per non-read-only base. Bases that run arbitrary code (`bash`, `python`, `curl`, …) persist the exact command, not a prefix.
260
262
  - **MCP / other** - *"Yes, don't ask again for `mcp__server__tool` in this project"* persists the tool name to project settings.
261
263
 
@@ -271,17 +273,17 @@ Some prompts are forced by a safety check, not a mode or rule. They offer only o
271
273
 
272
274
  ### The root/home removal circuit breaker
273
275
 
274
- The **only** built-in safety prompt that survives `bypass`: a removal of the filesystem root or your home dir - `rm -rf /`, `rm -rf ~`, `rm -rf $HOME` - always stops for confirmation, in every mode that can ask (`dont-ask` and `plan` deny instead).
276
+ The **only** built-in safety prompt that survives `yolo`: a removal of the filesystem root or your home dir - `rm -rf /`, `rm -rf ~`, `rm -rf $HOME` - always stops for confirmation, in every mode that can ask (`dont-ask` and `plan` deny instead).
275
277
 
276
278
  Spoof-resistant. It catches removals through env-var prefixes, process wrappers (`timeout`, `nice`, …), compound commands, quoted payloads (`bash -c "rm -rf /; echo ok"`), command substitution (`echo $(rm -rf /;)`), glued separators (`/;`), and `$HOME`/`${HOME}` spellings (quoted or not, with `/` or `/*` suffixes - `$HOMEDIR` stays literal).
277
279
 
278
- ### Recursive deletes prompt under auto-accept
280
+ ### Recursive deletes prompt under accept edits
279
281
 
280
- The `auto-accept` safe-filesystem fast path refuses `rm -r/-R/-rf/--recursive` (and `find … -delete`): `rm -rf dist` prompts exactly as in `default`. Plain single-file `rm` stays fast. Deliberate, safe direction: accepting edits isn't accepting bulk irreversible deletion. A content-specific allow rule (`Shell(rm -rf dist)`) still auto-allows, and `bypass` runs it.
282
+ The `accept-edits` safe-filesystem fast path refuses `rm -r/-R/-rf/--recursive` (and `find … -delete`): `rm -rf dist` prompts exactly as in `default`. Plain single-file `rm` stays fast. Deliberate, safe direction: accepting edits isn't accepting bulk irreversible deletion. A content-specific allow rule (`Shell(rm -rf dist)`) still auto-allows, and `yolo` runs it.
281
283
 
282
284
  ### Sensitive writes
283
285
 
284
- Writing any of these prompts in `default` and `auto-accept` unless a content-specific allow rule opts in (`bypass` skips this gate):
286
+ Writing any of these prompts in `default` and `accept-edits` unless a content-specific allow rule opts in (`yolo` skips this gate):
285
287
 
286
288
  ```text {{ title: 'Sensitive paths (prompt on write)' }}
287
289
  Secret material: .env, .env.*, *.pem, *.key, id_rsa, id_ed25519, credentials
@@ -298,16 +300,16 @@ A "content-specific" allow rule must name the path (`Edit(.env.local)`) - a bare
298
300
 
299
301
  Outside-workspace reads, writes, and shell working dirs first ask to admit the directory into the session's root set - the same grant as `/add-dir` or `permissions.additionalDirectories` - then the normal mode rule applies.
300
302
 
301
- - `bypass` grants the directory silently; `dont-ask` denies unless it's pre-approved in settings.
303
+ - `yolo` grants the directory silently; `dont-ask` denies unless it's pre-approved in settings.
302
304
  - The **OS temp dir** (`/tmp`, `$TMPDIR`, `os.tmpdir()`) is granted silently in every mode - temp files are disposable, so asking to "extend access" to the machine's own temp dir is friction, not protection. Reads run prompt-free; writes skip the escalation but still confirm like any workspace write (sensitive names like `/tmp/.env` still force the prompt). `deny`/`ask` rules still outrank the grant, and a symlink resolving outside temp takes the normal gate.
303
305
  - Approving an `ask` rule on an outside path **also grants the directory**, so the tool-level backstop never rejects a call you just approved.
304
306
  - **Registered skill directories** are readable without a grant (skill resources live outside the workspace by design). Writes into them still gate.
305
307
  - **Plan-file writes are exempt in plan mode** - the mode's sanctioned output.
306
308
  - Absolute paths **inside a shell command string** are *not* external-dir gated - a command arg isn't a reliable file boundary. Use shell `ask`/`deny` rules.
307
309
 
308
- ### Disabling bypass
310
+ ### Disabling yolo (permission bypass)
309
311
 
310
- Set `permissions.disableBypass` to `"disable"` (or `true`) to make bypass unenterable. Enforced at every layer: the engine evaluates a requested `bypass` as `default`, and the CLI neutralizes `--dangerously-skip-permissions` (and `--yolo`) at entry, so the TUI mode cycle and stored auto-approve decisions can't silently answer prompts as if bypass were live. Best set in the user-global file a project can't edit.
312
+ Set `permissions.disableBypass` to `"disable"` (or `true`) to make yolo unenterable. Enforced at every layer: the engine evaluates a requested `yolo` as `default`, and the CLI neutralizes `--dangerously-skip-permissions` (and `--yolo`) at entry, so the TUI mode cycle and stored auto-approve decisions can't silently answer prompts as if yolo were live. Best set in the user-global file a project can't edit.
311
313
 
312
314
  ---
313
315
 
@@ -320,9 +322,9 @@ Every tool call falls through one fixed ladder. First rung that matches wins:
320
322
  │
321
323
  ▼
322
324
  1 deny rules ───────────► DENY
323
- │ (even bypass)
325
+ │ (even yolo)
324
326
  2 ask rules ────────────► ASK
325
- │ (even bypass)
327
+ │ (even yolo)
326
328
  3 outside workspace? ───► ASK to admit
327
329
  │
328
330
  4 plan mode + mutates? ─► DENY
@@ -334,35 +336,35 @@ Every tool call falls through one fixed ladder. First rung that matches wins:
334
336
  7 read-only? ───────────► ALLOW
335
337
  │ (every mode)
336
338
  8 rm -rf / ~ $HOME ─────► ASK
337
- │ (even bypass)
338
- 9 bypass mode? ─────────► ALLOW
339
+ │ (even yolo)
340
+ 9 yolo mode? ───────────► ALLOW
339
341
  │
340
342
  10 sensitive write? ─────► ASK
341
343
  │
342
344
  11 allow rules ──────────► ALLOW
343
345
  │
344
- 12 auto-accept + in ws? ─► ALLOW
346
+ 12 accept edits + in ws? ─► ALLOW
345
347
  │
346
348
  ▼
347
349
  ASK (DENY in dont-ask)
348
350
  ```
349
351
 
350
- Read that top to bottom and two things fall out. **Deny beats ask beats allow**, in every mode. And `bypass` sits at rung 9, *after* your rules, the external-directory gate, and the circuit breaker, so `--yolo` skips ordinary prompts and the sensitive-write prompt, but never your explicit rules and never the root/home breaker.
352
+ Read that top to bottom and two things fall out. **Deny beats ask beats allow**, in every mode. And `yolo` sits at rung 9, *after* your rules, the external-directory gate, and the circuit breaker, so `--yolo` skips ordinary prompts and the sensitive-write prompt, but never your explicit rules and never the root/home breaker.
351
353
 
352
354
  The long form of each rung:
353
355
 
354
- 1. **Deny rules** - blocked in every mode, including bypass.
355
- 2. **Ask rules** - always prompt, even under bypass. In `dont-ask` the would-be prompt becomes a deny.
356
- 3. **External-directory gate** - a read, write, or shell cwd **outside the workspace** first asks to admit the directory (like `/add-dir` / `permissions.additionalDirectories`); then the normal mode rule applies. Bypass grants silently. The **OS temp dir** (`/tmp`, `$TMPDIR`, `os.tmpdir()`) is granted silently in every mode - reads never prompt, writes skip the escalation but follow the normal mode rule. Skill dirs are readable without a grant; plan-file writes in plan mode skip this gate.
356
+ 1. **Deny rules** - blocked in every mode, including yolo.
357
+ 2. **Ask rules** - always prompt, even under yolo. In `dont-ask` the would-be prompt becomes a deny.
358
+ 3. **External-directory gate** - a read, write, or shell cwd **outside the workspace** first asks to admit the directory (like `/add-dir` / `permissions.additionalDirectories`); then the normal mode rule applies. Yolo grants silently. The **OS temp dir** (`/tmp`, `$TMPDIR`, `os.tmpdir()`) is granted silently in every mode - reads never prompt, writes skip the escalation but follow the normal mode rule. Skill dirs are readable without a grant; plan-file writes in plan mode skip this gate.
357
359
  4. **Plan mode gate** - operation-based: reads, searches, read-only shell run; everything that writes or mutates is denied. The only write allowed is a plan file under `~/.commandcode/plans/`.
358
- 5. **Taste-directory writes** - a product-workflow guard (allowed when taste learning is on, else redirected to the `taste` tool); not a safety prompt, so bypass skips it.
360
+ 5. **Taste-directory writes** - a product-workflow guard (allowed when taste learning is on, else redirected to the `taste` tool); not a safety prompt, so yolo skips it.
359
361
  6. **Malformed writes** - a write/edit with no resolvable file path is denied up front with a correction.
360
362
  7. **Read-only fast path** - reads and read-only shell (`ls`, `cat`, `grep`, `echo`, `head`, …) run without a prompt, every mode. A compound command counts when **every** part is read-only and nothing redirects - `cat file | head -5 || echo none` is free. A read-only command aimed at secret material (`cat .env`, `head id_rsa`) falls out and prompts.
361
- 8. **Root/home removal circuit breaker** - `rm -rf /`, `rm -rf ~`, `rm -rf $HOME` and spoofed variants **ask even under bypass** (deny in `dont-ask`/`plan`).
362
- 9. **Bypass** - everything past the gates above auto-allows.
363
- 10. **Sensitive-write ask** - writing a secret file, a persistence vector (`.bashrc`, `.gitconfig`, …), or a control surface (`.git/**`, `.ssh/**`, `.commandcode` settings) prompts in `default` and `auto-accept` unless a content-specific allow rule opts in.
363
+ 8. **Root/home removal circuit breaker** - `rm -rf /`, `rm -rf ~`, `rm -rf $HOME` and spoofed variants **ask even under yolo** (deny in `dont-ask`/`plan`).
364
+ 9. **Yolo (permission bypass)** - everything past the gates above auto-allows.
365
+ 10. **Sensitive-write ask** - writing a secret file, a persistence vector (`.bashrc`, `.gitconfig`, …), or a control surface (`.git/**`, `.ssh/**`, `.commandcode` settings) prompts in `default` and `accept-edits` unless a content-specific allow rule opts in.
364
366
  11. **Allow rules** - pre-approved calls run without a prompt.
365
- 12. **Accept-edits fast path** - in `auto-accept`, file edits and safe filesystem commands inside the workspace run without a prompt. Recursive deletes excluded - they still prompt.
367
+ 12. **Accept-edits fast path** - in `accept-edits`, file edits and safe filesystem commands inside the workspace run without a prompt. Recursive deletes excluded - they still prompt.
366
368
  13. Otherwise, **ask** - and in `dont-ask`, **deny**.
367
369
 
368
370
  Every policy denial (deny rule, mode gate, malformed input) carries guidance the model can act on, and the turn continues. Only a **human** "no" ends the turn.
@@ -373,10 +375,10 @@ The long form of each rung:
373
375
 
374
376
  The full matrix - every operation against every mode. Authoritative; the tests pin each row.
375
377
 
376
- | Operation | `default` | `auto-accept` | `plan` | `bypass` | `dont-ask` | Why |
378
+ | Operation | `default` | `accept-edits` | `plan` | `yolo` | `dont-ask` | Why |
377
379
  |---|---|---|---|---|---|---|
378
380
  | Matches `deny` rule | deny | deny | deny | deny | deny | Deny rules win. `ask_user_question`, `agent`, `run_command` are unconditional exceptions. |
379
- | Matches `ask` rule | ask | ask | ask | ask | deny | Ask survives bypass; `dont-ask` can't prompt. Same three tools exempt. |
381
+ | Matches `ask` rule | ask | ask | ask | ask | deny | Ask survives yolo; `dont-ask` can't prompt. Same three tools exempt. |
380
382
  | Matches `allow` rule | allow | allow | allow if plan-compatible | allow | allow | Honored after deny/ask and mode gates. |
381
383
  | Direct file read/search inside workspace | allow | allow | allow | allow | allow | Reads are free unless rules say otherwise. |
382
384
  | Direct file read/search outside workspace | ask external-dir, then allow | ask external-dir, then allow | ask external-dir, then allow | allow | deny unless pre-approved | Outside dirs gated separately, then reads allowed. |
@@ -390,19 +392,19 @@ The full matrix - every operation against every mode. Authoritative; the tests p
390
392
  | Read-only shell, e.g. `git status`, `cat README.md \| head -5` | allow | allow | allow | allow | allow | Plan may explore with read-only shell. Compound qualifies when every part is read-only and nothing redirects. Shell cwd follows the external-dir row. |
391
393
  | Secret-looking read via a file tool, e.g. `read_file .env` | allow | allow | allow | allow | allow | Reads free by default; no built-in secret-read prompt for file tools. Use `ask`/`deny`. |
392
394
  | Secret-looking read via shell, e.g. `cat .env` | ask | ask | deny | allow | deny unless allow rule | A read-only shell command with a secret arg (`.env`, `id_rsa`, `*.pem`) falls out of the fast path. |
393
- | Workspace file edit | ask | allow | deny | allow | deny unless allow rule | `auto-accept` accepts normal edits; `dont-ask` runs only pre-approved edits. |
394
- | Protected workspace write, e.g. `.env` or `.git/config` | ask | ask | deny | allow | deny unless pre-approved | Bypass skips normal write-risk prompts; auto-accept doesn't. |
395
+ | Workspace file edit | ask | allow | deny | allow | deny unless allow rule | `accept-edits` accepts normal edits; `dont-ask` runs only pre-approved edits. |
396
+ | Protected workspace write, e.g. `.env` or `.git/config` | ask | ask | deny | allow | deny unless pre-approved | Yolo skips normal write-risk prompts; accept edits doesn't. |
395
397
  | Direct file write outside workspace | ask external-dir, then ask edit/write | ask external-dir, then allow normal edit/write; sensitive still asks | deny, except plan-file writes | allow | deny unless pre-approved | External-dir gate first, then the mode edit/write rule. |
396
398
  | Plan file write under `~/.commandcode/plans/` | ask like outside write | ask external-dir, then allow | allow (no external-dir prompt) | allow | deny unless pre-approved | Plan mode's sanctioned output; never gated in plan mode. |
397
399
  | Safe filesystem shell inside workspace: `mkdir`, `touch`, `cp`, `mv`, non-recursive `rm`, `rmdir`, `sed` | ask | allow | deny | allow | deny unless allow rule | Accepting edits extends to safe filesystem commands on non-sensitive workspace targets. Recursive `rm` excluded. |
398
400
  | Shell cwd outside workspace | ask external-dir, then apply shell rule/mode | ask external-dir, then apply shell rule/mode | ask external-dir for read-only shell; deny mutating shell | allow | deny unless pre-approved | The shell working dir is external-dir gated. |
399
401
  | Shell command args outside workspace | shell rule/mode | shell rule/mode | shell rule/mode | allow | shell rule/mode | Path args inside a command string are never external-dir gated; use shell `ask`/`deny` rules. |
400
402
  | Other mutating shell | ask | ask | deny | allow | deny unless allow rule | Governed by shell rules and the active mode. |
401
- | MCP / custom side-effecting or unknown tool | ask | ask | deny | allow | deny unless allow rule | Unknown side effects prompt unless bypass or an explicit rule. |
402
- | Root/home removal, e.g. `rm -rf /` or `rm -rf ~` | ask | ask | deny | **ask** | deny | The circuit breaker survives bypass. |
403
- | Recursive workspace delete, e.g. `rm -rf dist` | ask | ask | deny | allow | deny unless allow rule | Recursive deletes prompt outside bypass. A content-specific allow rule (`Shell(rm -rf dist)`) still auto-allows. |
403
+ | MCP / custom side-effecting or unknown tool | ask | ask | deny | allow | deny unless allow rule | Unknown side effects prompt unless yolo or an explicit rule. |
404
+ | Root/home removal, e.g. `rm -rf /` or `rm -rf ~` | ask | ask | deny | **ask** | deny | The circuit breaker survives yolo. |
405
+ | Recursive workspace delete, e.g. `rm -rf dist` | ask | ask | deny | allow | deny unless allow rule | Recursive deletes prompt outside yolo. A content-specific allow rule (`Shell(rm -rf dist)`) still auto-allows. |
404
406
 
405
- Reading a column: a mode only changes calls the rules leave **unresolved**. `deny` and `ask` behave the same in every interactive mode; `dont-ask` turns every would-be ask into a deny; `bypass` auto-allows everything but deny rules, ask rules, and the breaker.
407
+ Reading a column: a mode only changes calls the rules leave **unresolved**. `deny` and `ask` behave the same in every interactive mode; `dont-ask` turns every would-be ask into a deny; `yolo` auto-allows everything but deny rules, ask rules, and the breaker.
406
408
 
407
409
  ---
408
410
 
@@ -435,10 +437,10 @@ Rules live under `permissions` in `.commandcode/settings.json` (shared, checked
435
437
  }
436
438
  ```
437
439
 
438
- - **`defaultMode`** - the start mode (`default`, `auto-accept`, `plan`, `bypass`, `dont-ask`; alternate spellings like `acceptEdits` and legacy `standard` work too).
440
+ - **`defaultMode`** - the start mode (`default`, `accept-edits`, `plan`, `yolo`, `dont-ask`; `auto-accept` and `bypass` are accepted aliases, as are `acceptEdits` and legacy `standard`).
439
441
  - **`allow` / `ask` / `deny`** - rule lists. They **accumulate across settings files**: a `deny` in your user-global settings can't be erased by a project file.
440
442
  - **`additionalDirectories`** - extra dirs that count as inside the workspace for reads and writes (same accumulation).
441
- - **`disableBypass`** - `"disable"` (or `true`) makes bypass unenterable.
443
+ - **`disableBypass`** - `"disable"` (or `true`) makes yolo (permission bypass) unenterable.
442
444
 
443
445
  ### Precedence
444
446
 
@@ -450,15 +452,15 @@ Denied at any level, allowed at none. A managed or user-global `deny` beats a pr
450
452
 
451
453
  The reasoning behind the behavior, so you don't reverse-engineer it:
452
454
 
453
- 1. **Rules over a hardcoded safety matrix.** No built-in `.env` file-read prompt, no bypass-surviving recursive-delete prompt. Sensitive reads are a rules concern (`ask`/`deny`), so each project decides what's sensitive. One carve-out: the read-only **shell** fast path screens secret args, so `cat .env` prompts instead of riding `cat`'s free pass.
455
+ 1. **Rules over a hardcoded safety matrix.** No built-in `.env` file-read prompt, no yolo-surviving recursive-delete prompt. Sensitive reads are a rules concern (`ask`/`deny`), so each project decides what's sensitive. One carve-out: the read-only **shell** fast path screens secret args, so `cat .env` prompts instead of riding `cat`'s free pass.
454
456
  2. **One ordered pipeline.** The order in [How a decision is made](#how-a-decision-is-made) is the spec; tests pin it.
455
457
  3. **Asymmetric matching.** Deny/ask aggressive, allow conservative. Failing toward a prompt is the safe direction.
456
458
  4. **External directories are a separate gate**, before the mode rule, with skill read roots and plan-file writes exempted where the mode sanctions them.
457
- 5. **The circuit breaker survives bypass and is spoof-resistant.**
459
+ 5. **The circuit breaker survives yolo and is spoof-resistant.**
458
460
  6. **`disableBypass` is enforced at every layer** - engine, CLI entry, TUI mode cycle, decision store.
459
461
  7. **Shell command args aren't a file boundary.** Absolute paths in a command string follow shell rules and the mode, not the file-tool boundary.
460
462
  8. **Generic tools get a real prompt.** MCP/custom tools render a generic permission prompt, not a fake file-edit prompt.
461
- 9. **Recursive deletes prompt under auto-accept.** Safe direction: bulk irreversible deletion isn't an edit.
463
+ 9. **Recursive deletes prompt under accept edits.** Safe direction: bulk irreversible deletion isn't an edit.
462
464
  10. **Policy denials guide the model; only human vetoes end the turn.** Every engine denial carries actionable guidance, so the model adapts and the turn continues.
463
465
 
464
466
  ---
package/dist/bundled/command-code-knowledge/reference/plan-mode.md CHANGED
@@ -27,28 +27,28 @@ In plan mode the agent can read files, search, and reason. It **cannot** edit fi
27
27
 
28
28
  ## The permission modes
29
29
 
30
- Plan mode is one rung on the permission-mode cycle. `shift+tab` moves between them: `default` → `auto-accept` → `plan` → back to `default`.
30
+ Plan mode is one rung on the permission-mode cycle. `shift+tab` moves between them: `default` → `accept-edits` → `plan` → `yolo` → back to `default`.
31
31
 
32
32
  | Mode | File edits | Shell commands | Use it when |
33
33
  | ---- | ---------- | -------------- | ----------- |
34
34
  | **plan** | Blocked | Blocked | Exploring, designing, reviewing sensitive flows |
35
35
  | **default** | Prompt for approval | Prompt for approval | Controlled iteration, the everyday mode |
36
- | **auto-accept** | Applied directly | Run directly | The approach is clear and you're iterating fast |
36
+ | **accept edits** | Applied directly | Run directly | The approach is clear and you're iterating fast |
37
37
 
38
- Two modes sit off the cycle. `dont-ask` is selected from settings or `--permission-mode dont-ask`, and `shift+tab` from it moves to `auto-accept` and rejoins the normal cycle. `bypass` is only reachable by launching with `--yolo`, which also adds it to the cycle as a fourth rung (`plan` → `bypass` → `default`).
38
+ `dont-ask` sits off the cycle. It is selected from settings or `--permission-mode dont-ask`, and `shift+tab` from it moves to `accept-edits` and rejoins the normal cycle. `yolo` (permission bypass) is the fourth rung, after `plan`; `--yolo` (or `--dangerously-skip-permissions`) also starts a session directly in it.
39
39
 
40
- To jump straight to a mode without cycling, use `/mode` or its shorthands: `/mode:default`, `/mode:auto-accept`, `/mode:plan`.
40
+ To jump straight to a mode without cycling, use `/mode` or its shorthands: `/mode:default`, `/mode:accept-edits`, `/mode:plan`.
41
41
 
42
42
  **Permissions**
43
43
  Modes are only the baseline. The complete guide covers allow/ask/deny rule
44
44
  syntax, the decision ladder every tool call runs, safety behaviors, and the
45
45
  full mode-by-operation decision table.
46
46
 
47
- Bypass mode is deliberately **not** reachable through `/mode`. Slash commands
48
- are agent-invokable, so a mid-session route into bypass would let the model
47
+ Yolo (permission bypass) is deliberately **not** reachable through `/mode`. Slash commands
48
+ are agent-invokable, so a mid-session route into it would let the model
49
49
  disable its own permission prompts.
50
50
 
51
- Command Code creates a [checkpoint](./sessions.md) before modifying files in any mode, so an auto-accept run is always rewindable.
51
+ Command Code creates a [checkpoint](./sessions.md) before modifying files in any mode, so an accept edits run is always rewindable.
52
52
 
53
53
  ### Picking a mode
54
54
 
@@ -58,12 +58,12 @@ Command Code creates a [checkpoint](./sessions.md) before modifying files in any
58
58
  | Debugging a complex issue | Plan |
59
59
  | Multi-file refactor | Plan |
60
60
  | Security review | Plan |
61
- | Small bug fix | Auto-accept |
62
- | Routine refactor | Auto-accept |
63
- | Running tests and adjusting | Auto-accept |
64
- | Quick typo fix | Auto-accept |
61
+ | Small bug fix | Accept Edits |
62
+ | Routine refactor | Accept Edits |
63
+ | Running tests and adjusting | Accept Edits |
64
+ | Quick typo fix | Accept Edits |
65
65
 
66
- The usual loop: start in **plan**, explore and agree on the approach, approve the plan, let it run in **auto-accept**, rewind with checkpoints if something goes sideways.
66
+ The usual loop: start in **plan**, explore and agree on the approach, approve the plan, let it run in **accept edits**, rewind with checkpoints if something goes sideways.
67
67
 
68
68
  ---
69
69
 
@@ -131,12 +131,12 @@ Inside the reader one line is always selected, comments pin inline under their l
131
131
 
132
132
  All of these open the same surface, scoped to a plan written during the **current session**.
133
133
 
134
- 1. **Finishing plan mode.** The agent writes the plan and calls `exit_plan_mode`, which opens plan review as the approval surface: the plan *is* the approval prompt. Approving here can also switch you into auto-accept mode so implementation runs without further prompts.
134
+ 1. **Finishing plan mode.** The agent writes the plan and calls `exit_plan_mode`, which opens plan review as the approval surface: the plan *is* the approval prompt. Approving here can also switch you into accept edits mode so implementation runs without further prompts.
135
135
  2. **Asking for it.** Outside plan mode, say *"review plan"* / *"open plan review"*. The agent calls the `plan_review` tool, which opens the panel for the most recent plan file, instead of pasting the plan back as a wall of text.
136
136
  3. **`/plan-review`.** Jumps straight into a review of this session's latest plan.
137
137
  4. **`/plans`.** Opens the full-screen plan browser: every plan from this session and past sessions, with status badges, comment counts, and search. `/plans <name>` jumps straight into a named plan.
138
138
 
139
- **The automatic backstop.** Some models write a plan file and stop without ever presenting it. When a run ends naturally with a plan that was written but never reviewed (in **default** or **plan** mode), the harness presents the review panel itself. Approving continues the run with an instruction to implement; declining lets the run end so you can steer. Modes that mean "don't interrupt me" (auto-accept, bypass, and dont-ask) skip the backstop.
139
+ **The automatic backstop.** Some models write a plan file and stop without ever presenting it. When a run ends naturally with a plan that was written but never reviewed (in **default** or **plan** mode), the harness presents the review panel itself. Approving continues the run with an instruction to implement; declining lets the run end so you can steer. Modes that mean "don't interrupt me" (accept edits, yolo, and dont-ask) skip the backstop.
140
140
 
141
141
  ### Reading and commenting
142
142
 
@@ -225,9 +225,9 @@ Because a canceled plan is recorded rather than discarded, planning never feels
225
225
  | `/plan [task]` | Enter plan mode; `/plan <task>` plans that task |
226
226
  | `/plans [name]` | Browse, review, and annotate saved plans; bare `/plans` opens the browser |
227
227
  | `/plan-review` | Review this session's latest plan |
228
- | `/mode [default\|auto-accept\|plan]` | Show or switch the permission mode |
228
+ | `/mode [default\|accept-edits\|plan]` | Show or switch the permission mode |
229
229
  | `/mode:plan` | Switch to plan mode (read-only, no side effects) |
230
- | `/mode:auto-accept` | Switch to auto-accept mode |
230
+ | `/mode:accept-edits` | Switch to accept edits mode |
231
231
  | `/mode:default` | Switch to default mode |
232
232
 
233
233
  ### CLI flags
@@ -235,9 +235,9 @@ Because a canceled plan is recorded rather than discarded, planning never feels
235
235
  | Flag | Description |
236
236
  |------|-------------|
237
237
  | `--plan` | Start in plan mode |
238
- | `--auto-accept` | Start in auto-accept mode |
239
- | `--permission-mode <mode>` | `default`, `plan`, `auto-accept`, or `dont-ask` (legacy `standard` accepted) |
240
- | `--yolo` | Bypass all permission prompts, and add `bypass` to the `shift+tab` cycle |
238
+ | `--accept-edits` | Start in accept edits mode |
239
+ | `--permission-mode <mode>` | `default`, `plan`, `accept-edits`, `yolo`, or `dont-ask` (`auto-accept`, `bypass`, and legacy `standard` accepted as aliases) |
240
+ | `--yolo` | Bypass all permission prompts (start the session in `yolo` mode) |
241
241
 
242
242
  ### Tools
243
243
 
package/dist/bundled/command-code-knowledge/reference/product-help.md CHANGED
@@ -3,7 +3,7 @@
3
3
  # Command Code — Product Knowledge
4
4
 
5
5
  ## KEYBOARD SHORTCUTS
6
- - Shift+Tab: Toggle mode (default → auto-accept → plan)
6
+ - Shift+Tab: Toggle mode (default → accept edits → plan → yolo)
7
7
  - Ctrl+O: Toggle expanded tool output
8
8
  - Alt+P: Quick model switch (Option+P on macOS)
9
9
  - Ctrl+G: Open input in external editor ($EDITOR)
@@ -55,9 +55,9 @@
55
55
  - /hotkeys: Show all keyboard shortcuts
56
56
  - /todos: Manage the session todo list — x to remove an item, c to clear
57
57
  - /plan [task]: Enter plan mode; `/plan <task>` plans that task
58
- - /mode [name]: Show or switch the permission mode — /mode [default|auto-accept|plan]
58
+ - /mode [name]: Show or switch the permission mode — /mode [default|accept-edits|plan]
59
59
  - /mode:default: Switch to default mode (prompt before edits/commands)
60
- - /mode:auto-accept: Switch to auto-accept mode (accept edits automatically)
60
+ - /mode:accept-edits: Switch to accept edits mode (accept edits automatically)
61
61
  - /mode:plan: Switch to plan mode (read-only, no side effects)
62
62
  - /plans [name]: Browse, review, and annotate saved plans
63
63
  - /plan-review: Review this session's latest plan
@@ -125,8 +125,8 @@
125
125
  - --list-models: List the models available for use
126
126
  - --local-only: For BYOK: local-only with your BYOK providers, no Command Code traffic (same as CMD_LOCAL_ONLY=1)
127
127
  - --plan: Start in plan mode
128
- - --permission-mode <mode>: Set permission mode (standard, plan, auto-accept)
129
- - --auto-accept: Start in auto-accept mode
128
+ - --permission-mode <mode>: Set permission mode (standard, plan, accept-edits, yolo)
129
+ - --accept-edits: Start in accept edits mode
130
130
  - --yolo: Bypass all permission prompts (alias for --dangerously-skip-permissions)
131
131
  - --add-dir <directory>: Add directory to workspace context
132
132
  - -w, --worktree [name]: Run in an isolated managed worktree (name, path, or #PR; generated when omitted)
@@ -299,6 +299,7 @@ Valid model ids (the /model catalog — use these EXACT ids):
299
299
  - Qwen/Qwen3.8-Flash
300
300
  - Qwen/Qwen3.7-Flash
301
301
  - meituan/LongCat-2.0
302
+ - stepfun/Step-5-Preview
302
303
  - stepfun/Step-3.7-Flash
303
304
  - stepfun/Step-3.5-Flash
304
305
  - tencent/hy4-preview
@@ -312,6 +313,7 @@ Valid model ids (the /model catalog — use these EXACT ids):
312
313
  - sakana/fugu-ultra
313
314
  - xai/grok-4.5
314
315
  - xai/grok-4.6
316
+ - xai/grok-4.7
315
317
  - meta/muse-spark-1.1
316
318
  - meta/muse-spark-1.2
317
319
  - meta/muse-spark-1.2-contributor
package/dist/bundled/command-code-knowledge/reference/tools.md CHANGED
@@ -17,7 +17,7 @@ Before a single tool runs, Command Code puts real engineering between the model
17
17
  3. **Output truncation.** Text results are capped at **25,000 tokens**; over-limit output is replaced with a retry-with-a-narrower-query notice rather than sliced mid-thought (tools that bound themselves, like `read_file` and the web tools, are exempt).
18
18
  4. **Repair notes.** Any repairs that fired are prepended as `<repair_note>` tags so the model learns the canonical shape - and each repair is emitted as a telemetry event (rule names and keys only, never your values).
19
19
 
20
- On top of that, the workspace boundary is enforced everywhere: reads are confined to your project (plus `/add-dir` directories), and writes stay inside it in every normal mode. The exception is `--yolo`/bypass, which - rather than prompting - silently admits an outside directory as a new workspace root on first write, so it is the one mode that can write outside your project. Read-only tools and read-only-classified shell commands never prompt in any mode.
20
+ On top of that, the workspace boundary is enforced everywhere: reads are confined to your project (plus `/add-dir` directories), and writes stay inside it in every normal mode. The exception is yolo (`--yolo`, permission bypass), which - rather than prompting - silently admits an outside directory as a new workspace root on first write, so it is the one mode that can write outside your project. Read-only tools and read-only-classified shell commands never prompt in any mode.
21
21
 
22
22
  ---
23
23
 
@@ -102,7 +102,7 @@ Every write gets:
102
102
  - **Atomic writes**: unique temp sibling + rename, file mode preserved, symlink targets replaced correctly.
103
103
  - **Encoding preservation**: UTF-8 and UTF-16LE BOMs survive the round trip.
104
104
  - **Secret scanning veto** before any disk work, and per-file mutation serialization so concurrent writes can't tear a file.
105
- - The workspace **write boundary holds in every normal mode**. Under `--yolo`/bypass it is not a hard stop: an outside-workspace write silently admits that directory as a new root instead of prompting.
105
+ - The workspace **write boundary holds in every normal mode**. Under yolo (`--yolo`) it is not a hard stop: an outside-workspace write silently admits that directory as a new root instead of prompting.
106
106
 
107
107
  In [plan mode](./plan-mode.md), `write_file` stays available for exactly one destination: your plans directory (`~/.commandcode/plans/`), validated traversal- and symlink-safe.
108
108
 
@@ -403,11 +403,11 @@ Free-text replies are always available, answers can carry attached images, per-o
403
403
 
404
404
  ### `enter_plan_mode` / `exit_plan_mode`
405
405
 
406
- The model can *propose* mode switches; you decide. `enter_plan_mode` takes no arguments and fails safe (entering only narrows what the agent can do). `exit_plan_mode` presents the plan - preferring the freshest plan file written this session (256 KB cap) - with a three-way approval: proceed with auto-accept, proceed in default mode, or stay planning. Your edits to the plan text persist.
406
+ The model can *propose* mode switches; you decide. `enter_plan_mode` takes no arguments and fails safe (entering only narrows what the agent can do). `exit_plan_mode` presents the plan - preferring the freshest plan file written this session (256 KB cap) - with a three-way approval: proceed with accept edits, proceed in default mode, or stay planning. Your edits to the plan text persist.
407
407
 
408
408
  ### `plan_review`
409
409
 
410
- Re-open the plan review panel for the most recent plan file written this session to `~/.commandcode/plans/`. Takes no arguments. Presents the full plan with two outcomes: approve (optionally with auto-accept) to begin implementing, or cancel to keep refining. Read-only, since its only side effect is a possible auto-accept switch.
410
+ Re-open the plan review panel for the most recent plan file written this session to `~/.commandcode/plans/`. Takes no arguments. Presents the full plan with two outcomes: approve (optionally with accept edits) to begin implementing, or cancel to keep refining. Read-only, since its only side effect is a possible accept edits switch.
411
411
 
412
412
  Use it whenever a plan should be re-reviewed after changes, rather than pasting plan contents as a text reply. **Not available in plan mode** - `exit_plan_mode` is the plan-mode path, and calling `plan_review` there returns an error pointing you back to it. See [Plan Review](./plan-mode.md#plan-review).
413
413
 
@@ -445,10 +445,10 @@ Which tools the model even *sees* depends on the mode:
445
445
 
446
446
  | Mode | Tool surface |
447
447
  | --- | --- |
448
- | `default`, `auto-accept`, `dont-ask`, `bypass` | Everything except `exit_plan_mode`. |
448
+ | `default`, `accept-edits`, `dont-ask`, `yolo` | Everything except `exit_plan_mode`. |
449
449
  | `plan` | Write tools, `enter_plan_mode`, and all `mcp__*` tools removed. `write_file` stays (plans directory only), `shell_command` stays (read-only commands only), and the `task_*` CRUD tools stay - capturing a plan as tasks is planning. |
450
450
 
451
- Visibility filtering is backed by a second, fail-closed runtime check, so a tool offered under one mode can never execute under another. Deny rules from your [permission settings](./permissions.md) win in **every** mode, including bypass.
451
+ Visibility filtering is backed by a second, fail-closed runtime check, so a tool offered under one mode can never execute under another. Deny rules from your [permission settings](./permissions.md) win in **every** mode, including yolo.
452
452
 
453
453
  ---
454
454